Consumer Health Data Privacy Policy
Angles of Recovery Care LLC (a Massachusetts limited liability company) · Effective July 6, 2026
This policy explains how we collect, use, and share consumer health data as defined by the Washington My Health My Data Act, Nevada SB 370, and similar laws. It applies to our direct-to-consumer app and website. If you use AORC through a treatment program or other HIPAA-covered organization, that data is governed by HIPAA and our agreement with your program; this policy covers everyone else.
Health data we collect
- Wellness check-in responses — your 1–5 ratings on questions such as mood, anxiety, stress, cravings, and motivation, and any free text you add.
- Journal entries and mood ratings you write in the app.
- Exercise activity — which coping-skill exercises you view or complete, and post-exercise reflections.
- Crisis-signal data — if your text or scores indicate a possible crisis, we create an internal crisis flag (see "Crisis-detection safety net" in our Privacy Policy, §7).
- Inferences — the app suggests coping skills based on your recent check-ins.
- Account and usage data (name, email, feature usage) when tied to the above.
Sources: you provide this data directly in the app. We do not buy health data, and we do not collect it from data brokers, advertisers, or other apps.
Why we collect it (purposes)
To provide the services you request: daily check-ins, personalized coping-skill suggestions, journaling, progress tracking, reminders you configure, resource finding, and crisis-support surfacing. We also use de-identified, aggregated data to improve the service. We do not use your health data for advertising.
Who receives it
We share consumer health data only with service providers acting on our instructions (processors), under contracts limiting their use to providing our service:
- Supabase (database and authentication hosting)
- Amazon Web Services (cloud infrastructure and AI processing — coping-skill recommendations and crisis-language classification via AWS Bedrock, plus AWS SES for email delivery and AWS SNS for SMS delivery of the notifications you enable)
- Vercel (application hosting and first-party analytics)
- Sentry (error monitoring — identifiers, request contents, and free text are stripped or redacted before events are sent; session replay is disabled)
- Stripe (payments — Stripe receives billing data, not your check-ins or journals)
- Google Maps Platform (only when you use the optional "Find Local Resources" feature — your device location and chosen resource category are sent server-side to run that one search, without your name, account identity, or any health information)
Affiliates: AORC has no affiliates. We do not sell your consumer health data, and we do not share it for advertising. We run no third-party advertising trackers or pixels of any kind.
Your rights
You may: access the health data we hold about you; withdraw consent to further collection (you can stop using the features, and we will stop collecting); delete your data (deletion propagates to our processors as described in our Privacy Policy, §9); and appeal if we decline a request.
To exercise any right: email ethan@anglesofrecoverycare.com from your account email. We will verify your identity and respond within 45 days. If we deny your request, you may appeal by replying "Appeal," and we will respond to your appeal within 45 days. If your appeal is denied, you may contact your state Attorney General — Washington residents may contact the Washington Attorney General, and Nevada residents the Nevada Attorney General.
Retention
Active-account data is retained while your account is active. When you delete your account or withdraw consent, personal identifiers, journal entries, check-in responses, and reflections are deleted from our production systems within 30 days, with deletion propagated to our processors; copies may persist in encrypted backups for up to 7 days before being overwritten on the normal backup cycle (backups are used only for disaster recovery and never to restore a deleted account).
Geofencing
We do not use geofencing of any kind. The optional local resource finder runs only a one-time, user-initiated search when you tap it and grant your browser’s location permission; your location is not tracked, stored to your profile, or used to draw boundaries around any place.
Changes
We will notify you of material changes in-app and obtain renewed consent where the law requires it.
Contact
Angles of Recovery Care LLC
(a Massachusetts limited liability company)
ethan@anglesofrecoverycare.com