Health Data Policy

• This policy is about your health data: anything that shows your physical or mental health, including your recovery. Because BetterStep is a recovery app, we treat everything that identifies you in BetterStep, even your name and email address, as health data. • We collect it to build and run your recovery plan, and for nothing unrelated. • We never sell it. We never use it for ads. We never give it to advertisers or data brokers. If BetterStep itself is ever merged or sold, section 6 says what happens to your health data and what we do first. • We never use it to train AI, ours or anyone else's. We run the AI ourselves, on computing power we rent. What you write is never sent to an outside AI service such as ChatGPT, Claude or Gemini. • Your clinic sees nothing unless you tap Share. You can stop sharing anytime. • You can see, correct, copy or delete your health data. Delete it all anytime: Settings > Delete all my data. • Questions or requests: info@betterstep.io

Who we are. BetterStep is run by better step pro LLC (Identification Number 405766620), 13 M. Tamarashvili, Tbilisi, Georgia. In this policy, "BetterStep", "we" and "us" mean this company. Who it is for. Everyone who uses the BetterStep app or website in the United States, wherever in the US they live. It is our Consumer Health Data Privacy Policy under Washington's My Health My Data Act, Nevada's consumer health data law and Connecticut's data privacy law. If you live outside the United States, our Privacy Policy applies to you instead. How it fits with our other documents. Our Privacy Policy covers all your other personal information. It also explains how we protect your data, how long we keep it, and what we do if there is a breach. If the two seem to say different things about your health data, this policy applies. Our Sub-processors page names each company that helps us run BetterStep, what it receives, and where it works. What it does not cover. Records that a US clinic creates about you and gives us to handle for it under HIPAA (the US health privacy law for doctors, hospitals and health insurers) or the federal addiction records law (42 CFR Part 2). This includes the notes your clinic writes about you in BetterStep. Your clinic's privacy notice covers those records, and we handle them only on your clinic's instructions. It also includes the record of which staff at a US clinic opened your information. We keep that record for the clinic, as one of the security records HIPAA requires; section 10 of our Privacy Policy says for how long. What it is. This policy is a notice. It explains what we do with your health data and the rights you have. It is not a contract and does not change our Terms of Use.

Health data is information linked to you that shows your past, present or future physical or mental health. It includes: • information about your recovery from alcohol, drugs, gambling, pornography, gaming or any other addiction; • your moods, cravings, sleep and body readings; • information we work out from other information, such as a score calculated from your check-ins. Some laws call this "consumer health data". Just using a recovery app can show that someone is in recovery, so we treat everything that identifies you in BetterStep as health data.

We collect only what we need to provide the service you asked for. • Account details: Name, email address, sign-in details. Where it comes from: You; Google or Apple, if you sign up with them. What we use it for: Running your account and contacting you about it. • Your background: Date of birth, gender, ethnicity, height and weight, any accessibility needs, where you live (country, state, city and postal code), who you live with, what you do for work, what motivates you. Where it comes from: You. What we use it for: Fitting your plan to you, choosing where your data is stored, and pointing you to local help. • Your recovery profile: What you are recovering from, your history with it, your answers to short standard questionnaires. Where it comes from: You. What we use it for: Building your plan and working out your questionnaire scores. • Daily check-ins: Mood, stress, cravings, sleep, confidence, whether you feel hungry, angry, lonely or tired, and any slips. Where it comes from: You. What we use it for: Adjusting your plan, showing your progress, and working out your recovery score and support score. • What you write: Journal and reflection entries, messages with the in-app AI assistant, your safety plan (including any people you list in it). Where it comes from: You. What we use it for: Replying to you, writing your insights, checking for signs that you may be in danger, and keeping your safety plan. • Body readings: Heart rate, heart rate variability, sleep, steps, distance, calories, blood oxygen, breathing rate, temperature, body measurements, recovery scores. Where it comes from: Your phone or wearable, only if you connect it, through our wearable connection provider. What we use it for: Showing your readings and trends, and working out your recovery score and support score. • Heart rate check: Heart rate, heart rate variability and a stress reading, calculated on your phone from your fingertip through the camera. The video never leaves your phone. The camera reads only small color changes in your fingertip; it never captures or creates a fingerprint or any other biometric identifier. Where it comes from: Your phone, only if you use the check. What we use it for: Same as body readings. • What we work out: Clean days, streaks, completed tasks, your recovery score, points (Bettercoins), questionnaire scores, your AI-written insights, your support score (section 4), and whether the safety check was triggered. Where it comes from: We create it from the information above. What we use it for: Showing your progress, rewarding you, and, if you share with a clinic, helping your clinic know when to reach out. • Technical information: Device type, operating system, app version, language, a notification token, crash reports that can include your IP address (the number that identifies your internet connection). Where it comes from: Your device. What we use it for: Sending your reminders, fixing crashes, and keeping BetterStep safe. • Messages to us: Anything you send when you contact us. Where it comes from: You. What we use it for: Answering you. What we do not collect: your phone's GPS or precise location, your photos, recordings of your voice, your phone's address book, genetic data, fingerprints, face scans or any other biometric identifier, or payment details. We never use your body readings or the heart rate check to identify who you are. If we ever need something new, we will update this policy and ask you first. No geofencing. We never set up a virtual boundary around a clinic, pharmacy, treatment center or any other place to identify, track or message people who go there.

We use your health data only to: 1. create and run your account; 2. build your daily plan, tasks and reminders, and adjust them as you go; 3. show your progress and write your insights; 4. check what you write for signs that you may be in danger, and show you support; 5. calculate your support score and, if you share with a clinic, alert your clinic when you may need extra support; 6. share with your clinic, only if you tap Share (section 6); 7. send you messages about your account, security and changes to our policies; 8. keep BetterStep safe and working: fix crashes, and prevent fraud and misuse; 9. understand how BetterStep is used and make it better, using information that no longer identifies you; 10. follow the law. How our AI uses it. BetterStep uses AI (a computer program that writes text) to reply to you in the in-app chat, write your insights, give each chat a short title, and check what you write for signs that you may be in danger. It uses what you write and the parts of your profile and check-ins it needs. We run the AI model ourselves, on computing power we rent in the United States from the hosting company named on our Sub-processors page. That company provides the servers only. Our contract does not allow it to look at what passes through the AI, use it for itself or use it to train AI. What you write is never sent to an outside AI service such as ChatGPT, Claude or Gemini. Your support score. Our software calculates a number from 0 to 100 from your recent check-ins and, if connected, your body readings. It estimates how likely a hard stretch is in the coming days, so a clinic you share with can reach out early. It is not shown in the app, and you can ask us for yours anytime. It is not a diagnosis, and software alone never makes a decision about you. A person at your clinic decides what to do. We never: • sell your health data; • use it for advertising or marketing, or share it with advertisers, advertising networks or data brokers; • use readings from Apple Health, Health Connect or a wearable for advertising, marketing or data mining; • use it to make decisions about your insurance, job, housing or credit; • use it to train AI models, including large language models (the kind of AI that writes text), whether ours or anyone else's; • use it for a new purpose without asking you first.

What you agree to when you turn on "Let BetterStep use my health info for a personalized service" • What health data: the information in section 3. • Why: to build and run your recovery plan, and the other uses in section 4. • Who receives it: the companies that run BetterStep for us (section 6). Your clinic receives it only if you later tap Share. • How to take it back: Settings > Delete all my data, or email info@betterstep.io. BetterStep can't build your plan without this information, so the app needs this switch on. It starts off, and you switch it on yourself. "Let BetterStep store my data" This second switch is your permission for us to store your data in the United States, as shown on the "Where your data is stored" page. You can open that page from the switch before you agree. The app needs this switch on too. It starts off, and you switch it on yourself. Under both switches, the app reminds you: "You can delete all of your data anytime from Settings." Sharing with your clinic: a separate yes If a clinic invites you, the app asks whether to share your progress with that clinic, by name, and shows what it will see. Nothing is shared unless you tap Share. Not now keeps everything private. Once you share, your clinic can see the information listed in section 6, and that can include entries you made before you shared. You can stop sharing anytime in Settings. Phone permissions: optional Body readings, the camera for the heart rate check, contacts (to save a safety plan contact to your phone) and notifications each need your phone's permission. You can say no, or turn any of them off in your phone's settings, and the rest of the app keeps working. We never hold back points or rewards because you said no. Taking your consent back • To stop everything: tap Settings > Delete all my data, or email info@betterstep.io. We stop collecting and using your health data and erase it (section 7). Because the app can't work without your health data, you won't be able to keep using BetterStep after that. You're welcome to come back and start again whenever you're ready. • To stop sharing with your clinic: stop sharing in Settings. Your clinic sees nothing new from then on. • To stop body readings or other phone features: turn them off in your phone's settings. Taking consent back does not make our earlier use of your data unlawful. Anything new needs a new yes We will ask for your permission again before we collect a new kind of health data, share it with a new kind of recipient, or use it for a new purpose.

Companies that run BetterStep for us These companies handle your health data only on our instructions, under written contracts. The contracts require them to keep it confidential, protect it, use it only for the job we give them, and delete it when we tell them to. • Hosting, database, backups and AI servers: All of it, stored on servers in the United States • Network security (part of hosting): Your app's traffic as it passes through • Connecting Apple Health, Health Connect and wearables: Your body readings and connection details, only if you connect • Crash and error reports: Technical details about the error and your IP address. What you write is not included • Push notifications: Your notification token and the reminder text. Reminders never mention your recovery details • Email: Your email address and the emails we send you • Our mailbox: Messages you send to info@betterstep.io, including any health data you choose to put in them, and our replies • Sign-in with Google or Apple: Your sign-in details, only if you choose them. Google or Apple learns that you use BetterStep • Turning the app's prepared scripts into spoken audio: Nothing about you The Sub-processors page names each company, what it receives, and where it works. Your clinic, only if you tap Share If you share, your clinic can see: • your name and email address; • your recovery profile and questionnaire scores; • your daily check-ins (mood, stress, cravings, sleep and slips), your clean days, check-in streak and recovery score, and your body readings, if you connected a wearable or use the heart rate check; • what you did in your daily tasks and exercises, including your journal and reflection entries; • your support score and alerts: when your score suggests you may need extra support, when the safety check is triggered, or when your body readings stay well outside a healthy range for several days; • the notes your clinic writes about you. Your clinic is responsible for how it uses what it sees, under the laws that apply to it. Nobody else, except in these cases • When the law requires it. We share health data when a valid law, court order or legal process requires it. We push back on requests that are too broad, share only what is required, and tell you first unless the law forbids it. • To protect BetterStep and its users. We share the minimum needed to stop fraud, security attacks or illegal activity. • If our company changes hands. If BetterStep, or the part of our business that runs it, is merged, sold, reorganized or transferred (including in a bankruptcy), your health data may move to the new owner as part of that deal. The health data laws do not treat that as a sale, as long as the new owner follows them, and it must. The new owner must also keep following this policy, or ask your permission before changing how your health data is used. We will tell you in the app or by email before your health data moves, so you can delete it first if you want to. If the law or the deal doesn't allow us to tell you before, we will tell you as soon as we can. • Information that no longer identifies you. We may use or share information stripped of anything that could identify you. We do not try to identify anyone from it, and anyone who receives it must promise the same. Affiliates. We do not share your health data with any affiliate (a company under the same ownership as BetterStep). No one else collects it through BetterStep. We don't let other companies collect information about your activity over time and across websites and apps through the BetterStep app or website. We never sell your health data.

You can ask us to: • confirm whether we collect, share or sell your health data (we never sell it); • show you your health data, and give you a list of everyone outside BetterStep we shared it with, with an email address or web page for contacting each one; • give you a copy you can move to another service; • correct health data that is wrong; • delete your health data; • take back your consent (section 5). How to ask. Tap Settings > Delete all my data to delete. For anything else, email info@betterstep.io with the subject "Health Data Request". No longer have the app? Email us from the address on your account. Someone you authorize can ask for you, with your signed permission. Reviewing and correcting your health data. You can see most of it in the app. To see all of it, or to fix anything that is wrong, email us. Checking it's you. We usually confirm by replying to the email address on your account. We only ask for what we need to confirm it is you. When we reply. Within 10 working days. If a request is complex, we may take up to 10 more working days, and we will tell you why before the first 10 are up. What deletion covers. • We erase your health data from our live systems within 10 working days. If you ever find something we missed, email info@betterstep.io and we will remove it promptly. Copies in our backups are erased as backups are replaced, usually within 90 days and within 6 months at most. Until then, backups are locked away and used only to restore BetterStep after a failure. • We tell every company that holds your data for us to delete it too. • If you shared with a clinic, we tell your clinic about your request. Records your clinic already copied into its own systems are your clinic's to manage, under the health privacy laws that apply to it. • We keep a record that you asked and what we did, for 7 years, so we can show we followed the law. It never includes your recovery information. • If a law or court order requires us to keep something, we keep only what is needed, only for that purpose, and delete it when that purpose ends. Some laws also let us keep a limited amount of information to bring or defend a legal claim; we do that only where the law that protects you allows it. Free, with no penalty. Requests are free. Using your rights never changes the price, quality or features you get. If we say no. We will tell you why. You can appeal by replying to our answer with the word "Appeal". We will decide within 45 days and explain the result in writing. If we still say no, our answer will tell you how to complain to your state's Attorney General.

We review this policy at least once a year. If we make an important change, we tell you in the app or by email before it takes effect, and update the dates at the top. If we ever want to use health data we already have in a new way, we ask your permission first.