Privacy Policy

• We collect your account details, the recovery information you give us, your daily check-ins, your written entries and chat messages, and — with your permission — health and activity data from your connected device. • We use this information to provide and personalise the app for you and, only if you choose to connect a clinician, to share selected information with that clinician. • Your written entries are processed by a trusted third-party AI provider to power insights and chat. AI output is for self-reflection only and is not professional advice. • We do not sell your personal data, and we do not use it for advertising. • Your recovery and health information is sensitive ("special category") data. We process it only with your explicit consent, which you can withdraw at any time. • You can access, correct, export, or delete your data, and exercise your other rights, at any time (Section 10). • Providing health data and connecting a clinician are your choice; if you withdraw consent, the features that rely on that data will stop working.

This Policy covers the BetterStep mobile application and related services. It does not cover third-party services you choose to connect (such as your wearable platform or app store), which have their own privacy policies.

Information you provide: • Account: your email and name; and, if you use social sign-in, basic profile information from Google or Apple. • Onboarding and recovery profile: your recovery focus, self-assessment answers and self-reflection scores, age, gender, country, support-network or relationship status, and motivation. • Daily check-ins: mood, stress, cravings, sleep, and similar self-reports. • Your entries and content: journal and reflection entries, chat messages with the in-app assistant, any safety-plan entries, and your exercise and value selections. • Information we derive: a personal progress signal generated from what you tell us, your clean-day count, streaks, and in-app rewards state. Information collected with your permission, from your connected device or health platform (through our aggregation provider): heart rate, heart-rate variability, sleep, steps, distance, calories, blood-oxygen, respiration, temperature, body-composition, and recovery measures. Information collected automatically: technical and diagnostic data such as device identifiers, app version, your push-notification token, and — through our error-monitoring provider — your IP address and crash diagnostics. We do not currently record or store voice or audio from you, and we do not transcribe speech. If we add such a feature, we will update this Policy and ask for your consent first. You are responsible for the accuracy of the information you provide, and for not submitting another person's personal or identifying information without their consent.

• Create and run your account and provide the core features — Performance of our contract with you. • Process your recovery and health information to provide tracking, insights, exercises, and your progress signal — Your explicit consent (special-category data). • Personalise content and notifications — Your consent, and our legitimate interest in improving your experience. • Share information with a clinician you choose to connect — Your explicit consent. • Keep the Service secure, prevent fraud, and fix problems — Our legitimate interest; legal obligation. • Send you service and account emails — Performance of our contract. • Comply with the law (for example, breach notification) — Legal obligation. You may withdraw your consent at any time (Section 10). Withdrawal does not affect processing already carried out, and some features will not work without the data they require.

Your recovery status, recovery data, health and biometric data, and your derived progress signal are sensitive ("special category") data. We process them only with your explicit consent, which we request separately from your acceptance of our Terms, present to you in clear terms before any processing begins, and record (including the version and date of your consent). We apply heightened security and limit access to those who need it. You can withdraw this consent at any time and delete this data (Section 10); withdrawing it stops the features that depend on it.

To power insights, profile analysis, task suggestions, and the in-app chat, your written text is processed by a third-party AI provider — currently OpenAI (United States). An Anthropic (United States) provider may also be used. AI-generated text and insights can be inaccurate or incomplete, are provided for self-reflection only, are not professional or medical advice, and must not be relied upon for any health, safety, or treatment decision. We do not route your data to any AI provider outside the United States or the European Union, and we do not send it to any provider in China. We configure our AI providers so that your data is not used to train their models. Your personal progress signal is generated by our software from the information you provide. It is for self-reflection only — it is not a medical diagnosis, a measurement of any condition or its severity, or an automated decision. It does not by itself produce any legal or similarly significant decision about you; where it informs care, a human clinician is involved.

We share personal data only with the following, and never for advertising: • Service providers that operate the app for us. They may use your data only on our instructions and under a data-processing agreement. They are, by purpose: – AI text processing — OpenAI (and an Anthropic path), United States – Text-to-speech for in-app audio — ElevenLabs – Image generation, where used — Replicate – Wearable and health-data aggregation — Terra – Hosting and database — our cloud hosting provider and database service – Error monitoring — Sentry – Push notifications — Google Firebase – Sign-in — Google and Apple – Email — SendGrid A current list of our service providers is available on request. • A clinician you choose to connect. We share your recovery profile, check-ins, progress signal, and any clinical notes. Clinicians are independent professionals, responsible for their own use of this information. • Legal and safety reasons — where required by law, to enforce our Terms, or to protect the rights and safety of our users or the public. • A business transfer — if we are involved in a merger, acquisition, or sale of assets, your data may transfer subject to this Policy. We do not sell your personal data, and we do not share it for third-party advertising.

We are based in Georgia, and some of your data is processed and stored in the United States (and in the European Union, for error monitoring) by the service providers listed in Section 6. Because these countries are not on Georgia's list of countries with adequate data protection, we transfer your data on the basis of your explicit, informed consent, which you give separately at sign-up and which we record. If you withdraw it, we can no longer provide the features that depend on these providers. We also enter into data-processing agreements with each provider. We do not transfer your data to China, and we do not use any provider that would process it there. We may further strengthen these protections with standard contractual clauses and a transfer permit from the Personal Data Protection Service of Georgia.

We keep your personal data only for as long as your account is active and for a reasonable period afterward, unless the law requires us to keep it longer or it is needed to resolve a dispute. After that, we delete or anonymise it. You can ask us about the retention period for a specific type of data at any time.

We protect your data with technical and organisational measures, including encryption in transit and at rest, access controls, a separate sign-in system for clinician access, and an audit log of clinician activity. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal-data breach occurs, we will notify the Personal Data Protection Service of Georgia and affected users as required by law (and, where the U.S. Health Breach Notification Rule applies, the U.S. Federal Trade Commission and affected U.S. users).

Subject to applicable law, you have the right to: • access the personal data we hold about you; • correct inaccurate data; • delete your data; • withdraw your consent at any time; • object to or restrict certain processing; • receive a portable copy of the data you provided; and • not be subject to a decision producing legal or similarly significant effects based solely on automated processing. To exercise any right, contact us at info@betterstep.io. You can also delete your account in the app (Section 11). If you are in Georgia, you may also lodge a complaint with the Personal Data Protection Service of Georgia. If you are in the United States, our Consumer Health Data Privacy Notice describes additional state rights (including in California, Washington, and Nevada), such as the right to limit the use of sensitive personal information and to opt out of any "sharing."

You can delete your account in the app at any time. To have all of your associated data erased — including your check-ins, health data, journal entries, assessments, and progress signal — contact us at info@betterstep.io and we will complete the erasure within 30 days. We may keep limited data where the law requires it or to resolve a dispute (for example, access audit logs), and our backups are purged on a rolling schedule.

The Service is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it.

We may update this Policy from time to time. For material changes, we will give you reasonable prior notice (in the app or by email) and update the "Last updated" date above. If you continue to use the Service after a change takes effect, you accept the updated Policy.