Privacy Policy

• We collect what you tell the app, your daily check-ins, and, only if you connect them, readings from your phone or wearable. • We use it to build and run your recovery plan. We don't use it for anything unrelated. • We never sell your data. We never use it for ads. We never give it to advertisers or data brokers. If BetterStep itself is ever merged or sold, section 8 says what happens to your data and what we do first. • Your clinic sees nothing about you unless you choose to connect with it. • We run the AI ourselves, on computing power we rent. Your words are never sent to an outside AI service such as ChatGPT, Claude or Gemini, and no company, including the ones whose servers we rent, is allowed to use them to train AI. • If you live in the United States, your data is stored in the United States. Wherever you live, the app shows you where your data is stored (the United States or the EU) before you agree. • You can delete all of your data anytime: Settings > Delete all my data. • Questions: info@betterstep.io The rest of this policy gives the details.

BetterStep is run by better step pro LLC (Identification Number 405766620), 13 M. Tamarashvili, Tbilisi, Georgia. In this policy, "BetterStep", "we" and "us" mean this company. We decide how your personal information is used. In EU and UK law, that makes us the "controller". Contact for anything in this policy: info@betterstep.io

This policy covers the BetterStep app for iPhone and Android, and our website, betterstep.io. Words we use: • Personal information: anything that identifies you or could reasonably be linked to you. • Health information: personal information about your physical or mental health, including your recovery from addiction. Other documents that work with this one: • Terms of Use: the rules for using BetterStep. • Health Data Policy (our Consumer Health Data Privacy Policy): more detail and rights for your health information under US state health data laws, including those of Washington, Nevada and Connecticut. • Sub-processors page: the companies that help us run BetterStep, what each one does, and where. What this policy is. This policy is a notice. It explains what we do with your information and the rights you have. It is not a contract, and it is not part of our Terms of Use. If you work at a clinic: your staff account on the BetterStep clinic dashboard is covered by the dashboard's own privacy notice, not this one.

We collect only what we need for the purposes in section 4. What you tell us • Account: your email address, name and login details. If you sign up with Google or Apple, we receive your name and email address from them. Apple may give us a private relay email address instead of your real one; we then use that address. • About you: your date of birth, gender, ethnicity, height and weight, any accessibility needs, where you live (country, state, city and postal code, so we can point you to local help), who you live with, what you do for work, what motivates you, and similar background questions. • Your recovery profile: what you are recovering from, your history with it, and your answers to short standard questionnaires about your use and your recovery. • Daily check-ins: mood, stress, cravings, sleep, confidence, whether you feel hungry, angry, lonely or tired, and any slips. • What you write and choose: journal and reflection entries, messages with the in-app AI assistant, your safety plan (including any people you choose to list in it, such as a friend's name and phone number), and your choices in exercises. Only list people who are okay with it. If you connect a clinic, it can read your journal and reflection entries (section 8). • Messages to us: anything you send when you contact us. What we work out from it • Your progress: clean days, streaks, completed tasks, your daily recovery score (the progress number you see in the app; the support score in section 7 is worked out from the same information) and in-app points (Bettercoins). • Your insights: short texts our AI writes for you (section 6). • Your questionnaire scores: the scores from your questionnaire answers. • Your support score: a number from 0 to 100 that estimates how likely a hard stretch or a slip is in the coming days, so your clinic can reach out early (section 7). From your phone or wearable, only if you allow it • Body readings: if you connect Apple Health, Health Connect, Samsung Health or a wearable (for example Garmin, Fitbit, Oura, Polar or Whoop), we receive, through our wearable connection provider: heart rate, heart rate variability, sleep, steps, distance, calories, blood oxygen, breathing rate, temperature, body measurements and recovery scores. You choose what to share in your phone's or wearable's settings and can turn it off there anytime. If you connect a clinic, it can see these readings (section 8). • Heart rate check: if you use the in-app heart rate check, the app uses your phone's camera to read your pulse from your fingertip. The video stays on your phone. We save only the numbers the app calculates from it, such as your heart rate, heart rate variability and a stress reading. The camera reads only small color changes in your fingertip to estimate your pulse. It never captures, stores or creates a fingerprint, a scan of your hand or face, or any other biometric identifier, and we never use it to identify you. Collected automatically • Device and app information: device type, operating system, app version, language, and a notification token so we can send you reminders. • Crash and error reports: technical details when the app breaks, which can include your IP address (the number that identifies your internet connection). From other people and companies • Google or Apple, if you sign up with them (see above). • Your clinic, if it invites you: your name and email address, so it can send the invite. Your clinic may see whether you accepted the invite. If you connect, the notes your clinic writes about you are stored in BetterStep too. What we do not collect We do not use your phone's GPS or collect your precise location. We do not use geofencing: we never set up a virtual boundary around a clinic, pharmacy, treatment center or any other place to track or message people who go there. We do not collect your photos, recordings of your voice, or payment details. We do not read or upload your phone's address book. The app only adds a contact to your phone when you ask it to, for someone you chose for your safety plan. If we ever need something new, we will update this policy and ask you first.

We use your information to: 1. create and run your account; 2. build your daily plan, tasks and reminders, and adjust them as you go; 3. show your progress and write your insights; 4. check what you write for signs that you may be in danger, and offer you support (section 6); 5. calculate your support score and, if you connected a clinic, alert your clinic when you may need extra support (section 7); 6. share information with your clinic, only if you choose to connect; 7. send you messages about your account, security and changes to this policy; 8. keep BetterStep safe and working: fix crashes, and prevent fraud and misuse; 9. understand how BetterStep is used and make it better, using information that no longer identifies you (section 8); 10. follow the law. We only send you marketing emails if you say yes, and every one has an unsubscribe link. We never: • sell your personal information; • use it for advertising, or share it with advertisers, advertising networks or data brokers; • use your health information, including readings from Apple Health, Health Connect or a wearable, for advertising, marketing or data mining; • use it to make decisions about your insurance, job, housing or credit; • let any company, including the ones whose servers we rent, use it to train AI; • send what you write to an outside AI service; • use it for a new purpose without asking you first.

When you sign up, you agree to the Terms of Use and confirm you have read this policy and, if you live in the United States, the Health Data Policy. During setup, the app asks for two permissions. Both start switched off, and you switch each one on: • "Let BetterStep use my health info for a personalized service." Your consent for us to collect and use your health information (your recovery profile, check-ins, what you write, your scores and any body readings) for the purposes in section 4. • "Let BetterStep store my data." Your consent for us to store your data in the location shown on the "Where your data is stored" page, which you can open from that switch before you agree (section 9). BetterStep cannot build or run your plan without this information, so the app needs both permissions. Everything else in the app is optional. Taking your permission back. Because the app cannot work without these two permissions, you take them back by deleting your data: Settings > Delete all my data. You can also email info@betterstep.io. We then stop using your information and erase it as described in section 10. Taking your permission back does not make our earlier use of your information unlawful. Phone permissions are optional. Body readings, the camera (for the heart rate check), contacts (to save a safety plan contact to your phone) and notifications each need your phone's permission. You can say no or turn any of them off in your phone's settings; the rest of the app keeps working. We never hold back points or rewards because you turned a phone permission off. Connecting a clinic is your choice (section 8). You can disconnect anytime in Settings. Marketing emails are off unless you say yes. You can unsubscribe anytime. We do not track you. We don't link what you do in BetterStep with information from other companies' apps or websites, and we don't use advertising or tracking tools. That is why the app never shows Apple's "Allow tracking" request.

What it does. BetterStep uses AI (a computer program that writes text) to write your insights and suggestions, reply to you in the in-app chat, give each chat a short title, and check what you write for signs that you may be in danger. When you chat, you are talking with AI, not a person. What it receives. The text you write, and the parts of your profile and check-ins it needs to answer you. Where it runs. We run the AI model ourselves, on computing power we rent from the hosting companies named on our Sub-processors page, in your region (section 9). Those companies provide the servers only. Our contracts do not allow them to look at what passes through the AI, use it for themselves or use it to train AI. Your words are never sent to an outside AI service such as ChatGPT, Claude or Gemini. What we promise: • Your information is never used to train any company's AI. • AI results are used only to support you inside BetterStep. The safety check. If something you write suggests you may be in danger or thinking about harming yourself, the app shows you support resources, including crisis lines. If you connected a clinic, your clinic also gets a private alert, so it has the chance to check in on you. Your clinic decides whether and when to act on it, and it may not see the alert right away. Our Safety Protocol page on betterstep.io explains these steps in more detail. What AI can't do. AI can be wrong. It offers coaching, education and reflection. It is not therapy or medical advice, and it does not replace your doctor, counselor or clinic. BetterStep is not an emergency service. It does not contact emergency services, or the people in your safety plan, for you. If you are in danger right now, call or text 988 (the Suicide and Crisis Lifeline in the US) or call 911.

How the support score works. Our software calculates it from your recent check-ins (such as mood, cravings, sleep, confidence, how hungry, angry, lonely or tired you feel, and slips) and, if connected, your body readings. The result is a number from 0 to 100. Who sees it. The score is not shown in the app. If you connected a clinic, your clinic sees it. You can ask us for yours anytime. Clinic alerts. If you connected a clinic, your clinic gets an alert when your score suggests you may need extra support, when the safety check in section 6 is triggered, or when your body readings stay well outside a healthy range for several days. People decide, not software. The score and alerts help your clinic decide when to reach out. They are not a diagnosis. BetterStep makes no decision with legal or similarly serious effects on you by software alone. A person at your clinic decides what to do.

Companies that help us run BetterStep. They work only on our instructions, under written contracts that require them to protect your information at least as well as this policy does, use it only for the job we give them, and delete it when the job is done. By job: • hosting, database, backups and AI servers; • network security; • the connection to Apple Health, Health Connect and wearables; • crash and error reports; • push notifications; • email, and the mailbox that receives the messages you send us; • sign-in with Google or Apple; • turning the app's prepared scripts into spoken audio (nothing about you is sent for this). The Sub-processors page names each company, what it receives, and where it works. Your clinic, only if you choose. Some clinics use BetterStep to support their patients. Your clinic already has your name and email address; that is how it invites you, and it may see whether you accepted. Nothing you enter or do in BetterStep is shared with your clinic unless you choose to connect. If you connect, your clinic can see: • your name and email address; • your recovery profile and questionnaire scores; • your daily check-ins (mood, stress, cravings, sleep and slips), your clean days, check-in streak and recovery score, and your body readings, if you connected a wearable or use the heart rate check; • what you did in your daily tasks and exercises, including your journal and reflection entries; • your support score and the alerts in section 7; • the notes your clinic writes about you. Once you connect, your clinic can see this information, and that can include entries you made before you connected. Your clinic is responsible for how it uses what it sees, under the laws that apply to it. You can disconnect anytime in Settings. Your clinic then sees nothing new. Anything your clinic already copied into its own records stays under your clinic's control. Information your clinic gives us. Anything your clinic enters about you is handled only on your clinic's instructions and under our contract with the clinic. For US clinics, that contract includes a Business Associate Agreement (the contract HIPAA, the US health privacy law, requires). For US addiction treatment programs, it also includes a Qualified Service Organization Agreement (the contract the federal addiction records law, 42 CFR Part 2, requires). We never share those records except as those laws and the contract allow. In particular, we do not give them to police or courts without your written consent or a court order that meets 42 CFR Part 2. When the law requires it. We share information when a valid law, court order or legal process requires it. We push back on requests that are too broad, share only what is required, and tell you first unless the law forbids it. To protect BetterStep and its users. We share the minimum needed to stop fraud, security attacks or illegal activity. If our company changes hands. If BetterStep, or the part of our business that runs it, is merged, sold, reorganized or transferred (including in a bankruptcy), your information may move to the new owner as part of that deal. The new owner must keep following this policy and the privacy laws that protect your information, or ask for your permission before changing how it is used. We will tell you in the app or by email before your information moves, so you can delete your data first if you want to. If the law or the deal doesn't allow us to tell you before, we will tell you as soon as we can. We never sell your information on its own. Information that no longer identifies you. We may use or share information that has been stripped of anything that could identify you (de-identified, as the law defines it). We do not try to identify anyone from it, and anyone who receives it must promise the same.

• If you live in the United States, your data is stored on servers in the United States. • If you live in the EU or the UK (once BetterStep is offered there), your data is stored on servers in the EU. • If you live anywhere else, your data is stored in one of these two regions. • Wherever you live, the "Where your data is stored" page in the app shows your storage location before you agree. We use the country you give us during setup to choose it. Your account, recovery information, what you write, your body readings, your AI processing and your backups stay in your region. US data and EU data are kept apart. The "Where your data is stored" page lists each type of data and where it is kept. Services that work worldwide. Sign-in with Apple or Google, and the delivery of push notifications through Apple and Google, run on those companies' own worldwide systems. They receive only what the job needs, such as your sign-in details or a device token, never your recovery information. Our team. Our team, including staff in Georgia, may view your data from outside your region to run and support BetterStep. When they do, your data stays on the servers in your region. Legal safeguards. • EU and UK users: Georgia does not have an EU or UK "adequacy" decision, so we use the European Commission's Standard Contractual Clauses, and the UK Addendum to them, to protect your data when our team views it from outside the EU or UK. • US users: the United States is not on Georgia's list of countries with equivalent data protection. Privacy laws in the US may protect data less than laws in some other countries. We store your data there with your permission (the second switch in section 5) and under written contracts with every company that stores or handles it. • Users everywhere else: the safeguards above for the region where your data is stored apply to you too, and we store it there with your permission (the second switch in section 5).

• Your account, profile, check-ins, what you write, body readings, scores, progress and insights: Until you delete it or your account • Accounts no one has used for 3 years: We may delete the account. If we do, we email you first and wait at least 30 days for you to sign in • Crash and error reports: Deleted automatically within 90 days • Messages with our team: Until you delete your account, or 2 years after your last message, whichever comes first • Records of which clinic staff viewed your information: 7 years, so we can always show who saw your information. For US clinics, we keep these for your clinic as part of the security records the US health privacy law (HIPAA) requires • Records of your permissions and of your requests to us (dates and what was asked, never your recovery information): 7 years, so we can show we followed the law • Records that you accepted the Terms of Use, opted out of arbitration or rejected a change to it, and of any purchases (dates and what was accepted or bought, never your recovery information): 7 years after your account closes, so we can show what we agreed When you tap Delete all my data, we erase your information from our live systems within 10 working days, and we tell every company that holds a copy for us to erase it too. If you ever find something we missed, email info@betterstep.io and we will remove it promptly. Copies in our backups are erased as backups are replaced, usually within 90 days and within 6 months at most. Until then, backups are locked away and used only to restore BetterStep after a failure. What deletion does not reach: four things. Records your clinic already copied into its own systems (ask your clinic). Information you shared with a clinic that the law requires it to keep. The records in the last three rows of the table above. Information we must keep because a law or court order requires it; we keep only what is needed, only for that purpose, and delete it when that purpose ends. Some laws also let us keep a limited amount of information to bring or defend a legal claim; we do that only where the law that protects you allows it.

• Your data is encrypted (scrambled so outsiders can't read it) while it travels and while it is stored on our servers and in backups. • Only the people who need your data to run BetterStep can view it, and they are bound to keep it confidential. • Clinic staff use a separate sign-in, and every time they open a patient's information, it is logged. No system is perfectly secure. If a breach affects your information, we will tell you without unreasonable delay, within the deadline the law sets for you, and never later than 60 days after we discover it. We will explain what happened, what information was involved, what we are doing about it, what you can do, and how to reach us. We also notify the authorities the law requires, including the US Federal Trade Commission where its Health Breach Notification Rule applies. A breach includes anyone receiving your health information without permission, not only hacking.

Wherever you live, you can ask us to: • tell you what information we hold about you, where it came from, and which companies received it; • give you a copy you can move to another service; • correct information that is wrong; • delete your information; • take back a permission you gave; • limit or stop a particular use of your information. How to ask: tap Settings > Delete all my data to delete, or email info@betterstep.io for anything. No longer have the app? Email us from the address on your account with the subject "Delete my data", and we will delete everything as described in section 10. Someone you authorize can ask for you, with your signed permission. Checking it's you: we usually confirm by replying to the email address on your account. We only ask for what we need to confirm it is you. When we reply: within 10 working days. If a request is complex, we may take up to 10 more working days, and we will tell you why before the first 10 are up. Free, with no penalty: requests are free, and using your rights never changes the service you get. If we say no: we will tell you why. You can appeal by replying to our answer with the word "Appeal". We will decide within 45 days and explain the result. If you are still not satisfied, you can contact the regulator where you live (sections 13 to 15).

The same rights in every state. Many US states give their residents the rights in section 12, plus the right to opt out of the sale of personal information, targeted advertising, and profiling that leads to legal or similarly serious decisions. We give all these rights to every US user, wherever you live. Selling, sharing and targeted ads. We do not sell personal information, including health or other sensitive information, and we do not share it for targeted advertising. We have not done so in the past 12 months. We do not profile you to make legal or similarly serious decisions about you. So there is nothing to opt out of today. If that ever changes, we will ask your permission first where the law requires it, and we will honor opt-out requests and signals such as Global Privacy Control. Do Not Track and other companies' tracking. We don't track you across other websites and apps, and we don't let other companies collect information about your activity across websites and apps through BetterStep. So a browser's Do Not Track signal does not change anything we do. Sensitive information. Your health information, your ethnicity, your account login and, for some users, information about sexual health, are "sensitive" under several state laws. We use them only to provide the service you asked for, and for the other limited purposes those laws allow. Health data laws (Washington, Nevada, Connecticut and others). Our Health Data Policy explains how we collect, use and share your health information, your rights, and how to use them. Washington residents can also contact the Washington State Attorney General. HIPAA. HIPAA is the US health privacy law for doctors, hospitals and health insurers. When you use BetterStep on your own, HIPAA does not apply to the app; this policy, our Health Data Policy and the state laws in this section do. When a US clinic shares your treatment information with us, we protect it as HIPAA and 42 CFR Part 2 require (section 8). California. • California's medical privacy law (the Confidentiality of Medical Information Act, Civil Code section 56.06) treats a company that offers software for managing your own health information as a "provider of health care", but only for that law's confidentiality rules. That is why we protect the health information you give the app the way that law requires: we do not disclose it without your permission, except where that law allows, such as to the companies that run BetterStep for us under confidentiality contracts, or when the law requires it. It does not mean BetterStep provides health care. BetterStep is self-help software (section 3 of our Terms of Use). • We do not share personal information with other companies for their own marketing. • The table below lists what we collected in the past 12 months, where it came from, and who received it. We use each category for the purposes in section 4 and keep it as described in section 10. We have sold none of it and shared none of it for targeted advertising. • Identifiers (Name, email, device and notification IDs, IP address). Source: You, your device. Who received it: Companies that run BetterStep for us; your clinic, if you connect (name and email only). • Geolocation data (Country, state, city and postal code you give us (never your phone's GPS)). Source: You. Who received it: Companies that run BetterStep for us. • Personal records (Name, email, height and weight, who you live with). Source: You. Who received it: Companies that run BetterStep for us; your clinic, if you connect (name and email only). • Protected characteristics (Age, gender, ethnicity, accessibility needs). Source: You. Who received it: Companies that run BetterStep for us. • Professional or employment information (What you do for work). Source: You. Who received it: Companies that run BetterStep for us. • Biometric information (Heart rate, heart rate variability, sleep and activity readings). Source: Your phone or wearable, if connected. Who received it: Companies that run BetterStep for us; your clinic, if you connect. • Internet or device activity (App version, crash reports). Source: Your device. Who received it: Companies that run BetterStep for us. • Inferences (Your support score, recovery score, questionnaire scores, insights). Source: We create them. Who received it: Companies that run BetterStep for us; your clinic, if you connect (support score, recovery score and questionnaire scores only). • Sensitive personal information (Health and recovery information, ethnicity, account login). Source: You, your device. Who received it: Companies that run BetterStep for us; your clinic, if you connect (health and recovery information only). Nevada. We do not sell covered information as Nevada law defines it.

This section applies once BetterStep is offered in the EU or the UK. Our legal reasons for using your information: • Run your account and the app: Our contract with you • Use your health information and other sensitive information (recovery profile, ethnicity, check-ins, what you write, scores, body readings): Your explicit consent • Share information with your clinic: Your explicit consent • Keep BetterStep safe, fix problems, prevent fraud: Our legitimate interest in a safe, working service • Understand how BetterStep is used, with information that no longer identifies you: Our legitimate interest in improving BetterStep • Keep records of your permissions and requests: Our legal duty to show we follow the law What you must give us: your email address and the two permissions in section 5, because the app cannot work without them. Everything else is optional. Your extra rights: you can also ask us to restrict how we use your information, and object to any use based on our legitimate interest. Our representatives. Before we offer BetterStep in the EU or the UK, we will appoint a representative in each and name them here. If the law requires us to have a Data Protection Officer, we will name them here too. Complaints: please tell us first, so we can put it right. Email to info@betterstep.io is easiest, but you can reach us any way that suits you. We will confirm we received your complaint within 30 days and look into it properly. You can also complain to the data protection authority in the EU country where you live or work. In the UK, that is the Information Commissioner's Office (ico.org.uk).

You can complain to the State Audit Office of Georgia, which oversees personal data protection in Georgia.

Our website uses only the cookies it needs to work. It does not use advertising or tracking cookies, or tools that follow you across other websites.

BetterStep is only for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn we have, we delete it.

We review this policy at least once a year. If we make an important change, we will tell you in the app or by email before it takes effect, and update the date at the top. If we ever want to use your health information in a new way, we will ask your permission first.