Privacy Policy

Choiceful, Inc. (collectively, “Choiceful”, “we”, “us”, “our”) provides AI-guided OCD support through the Choiceful website located at https://www.choicefulocd.com, related websites and platforms, and the Choiceful application. The website, platform, content, products, services, features, applications, functionality, and affiliated software owned by Choiceful are collectively referred to as the “Services.”

This Privacy Policy explains how we collect, use, disclose, retain, and protect Personal Information when you access or use the Services. Capitalized terms not otherwise defined in this Privacy Policy have the same meaning as in our Terms of Service.

Please read this Privacy Policy carefully. If you do not agree with it, do not use our Services. By accessing or using the Services, you acknowledge that you have read and understand this Privacy Policy. If you are using the Services on behalf of another individual, you represent that you are authorized to act on that individual’s behalf and that the individual acknowledges and agrees to this Privacy Policy.

This Privacy Policy describes the types of Personal Information we collect from visitors to our Website and our practices for using, maintaining, sharing, and protecting it, including login pages and registration pages (“Secure Pages”). Secure Pages allow users to access our secure Platform and related Services.

All information collected and stored by Choiceful or provided by users through Secure Pages is treated as sensitive medical information. While Choiceful is not a covered entity under the Health Insurance Portability and Accountability Act of 1996 and related regulations and amendments (“HIPAA”), Choiceful operates as a HIPAA Business Associate where applicable and enters into Business Associate Agreements with covered entities in accordance with HIPAA requirements.

Choiceful aligns its privacy and security activities with HIPAA and applicable state laws regarding the protection of medical records information (“Privacy Laws”), and uses and discloses such information in compliance with this Privacy Policy.

We reserve the right to amend this Privacy Policy at any time. We will notify you and/or require you to accept the updated Privacy Policy if the modified Privacy Policy implements material changes from Choiceful’s then-current Privacy Policy. It is your responsibility to carefully review this Privacy Policy each time you visit, access, or use the Services.

Choiceful may provide notices using any reasonable means now known or later developed, including email, regular mail, SMS, MMS, text message, or postings on the Website or Platform. We will not make retroactive changes that reduce your privacy rights unless legally required to do so.

Your continued use of our Services after we make changes constitutes your acceptance of those changes. The amended Privacy Policy supersedes all previous versions.

The Personal Information we collect depends on how you interact with us, the portions of the Services you use, and the choices you make. We receive and collect information you directly submit to us and information we gather when you use our Services or interact with our advertising and applications on third-party websites and services.

When you are asked to provide Personal Information, you may decline, and you may use web browser or operating system controls to prevent certain types of automatic data collection. If you choose not to provide or allow information necessary for certain services or features, those services or features may not be available or fully functional.

Cookies are small text files placed by a website and stored by your browser on your device. Cookies can recognize your browser over time when it connects to the same web server.

Web beacons are electronic images, also called single-pixel or clear GIFs, contained within a website or email. They allow the web server hosting the image, often a third party, to log information about your device and set or read cookies. We may include web beacons in email messages or newsletters to understand whether you open and act on them.

Mobile analytics and advertising IDs are generated by iOS and Android operating systems and can be accessed by apps. Our apps may contain software that enables us and third-party analytics and advertising partners to access these mobile IDs.

We and our analytics and advertising partners use these technologies to collect data such as pages visited, links clicked, usage information, identifiers, and device information. This data may be used to store preferences, enable sign-in, analyze performance, track site and app interaction, develop inferences, deliver and tailor interest-based advertising, combat fraud, and fulfill other legitimate purposes, subject to applicable law and your consent and opt-out rights.

We may use automated, machine learning, generative artificial intelligence, or similar technologies, including conversational assistants, support chatbots, companion-style chat features, transcription, summarization, recommendation, classification, scheduling workflow automation, and decision-support tools (collectively, “AI Features”) in connection with the Services.

Personal Information includes information processed through AI Features, including prompts, messages, files, documents, images, audio, video, recordings, transcripts, metadata, and other information you or authorized users provide or submit to AI-enabled features (“AI Inputs”). AI Features may generate responses, summaries, transcripts, notes, recommendations, classifications, workflow automations, decision-support outputs, analyses, and other generated content (“AI Outputs”).

We and our third-party partners, including large language models accessed through AWS Bedrock, including Claude developed by Anthropic, may use and process AI Inputs, AI Outputs, and related Personal Information to provide, maintain, support, secure, and improve the Services and AI-enabled features; generate requested outputs; troubleshoot and debug; monitor performance; and detect misuse, fraud, and security incidents. AWS Bedrock does not use your data to train, fine-tune, or evaluate underlying AI models.

Text-to-speech audio for guided meditations is generated using Google’s generative speech service. The meditation script we send to that service is personalized to you and may reflect information from your clinical profile. It is sent without your name, email address, or account identifier.

Your rights and choices regarding such processing are described in the “Your Rights” section and may be exercised by contacting support@choicefulOCD.com, in each case to the extent provided by applicable law.

The Services rely on automated analysis of your activity and User Content in order to personalize your care. This analysis is central to how the product works, and we want you to understand it.

These processes support your care and the safety of the Services. They do not produce legal or similarly significant effects such as denial of credit, employment, insurance, or medical treatment, and they are not used to make punitive decisions about your account. Account enforcement decisions are described in the “Suspension and Termination” section of our Terms of Service and receive human review except where immediate action is necessary.

If you would like to understand a specific automated determination affecting you, request human review of it, correct the information behind it, or object to this processing, contact support@choicefulOCD.com. We will honor these requests to the extent provided by applicable law.

Choiceful processes Personal Information for legitimate business purposes, fulfillment of our services to you, compliance with legal obligations, and/or your consent.

In some states, we may be required to obtain your consent before collecting and using certain sensitive Personal Information that constitutes Healthcare Information.

We may de-identify your information and use or create de-identified information for any business or other purpose not prohibited by applicable law.

We may use Personal Information to contact you with offers, promotions, and other marketing communications. You may opt out of receiving these messages by following the unsubscribe link in the applicable message or contacting support@choicefulOCD.com.

We send transactional email related to your account, such as sign-in codes, subscription and billing notices, and service updates. These cannot be turned off while your account is active, because they are necessary to provide the Services.

If you enable notifications, we send push notifications to your device, such as exposure practice reminders, daily check-in reminders, and re-engagement messages. You can turn these off at any time in the App’s notification settings or in your device settings. Delivering push notifications requires sending a device token to our push notification provider.

We send marketing and promotional email only where permitted by law. You may opt out at any time using the unsubscribe link in the message or by contacting support@choicefulOCD.com. Opting out of marketing does not stop transactional messages.

Choiceful does not send SMS or text messages.

We may use analytics and advertising programs to collect information about you and your behavior as a consumer. These may include Facebook, Google Analytics, Reddit, and AppsFlyer. You can review each provider’s privacy policy and opt-out settings for more information.

You can also use third-party opt-out controls such as the Network Advertising Initiative and Digital Advertising Alliance.

We do not sell, share, or otherwise disclose Personal Information for reasons other than those described in this Privacy Policy. We may disclose aggregated information and information that does not identify an individual user without restriction. Our continued use of aggregated and de-identified data will comply with applicable law.

Some cookies on our Site are placed by third parties, such as analytics providers, advertising networks, and social media platforms. These third parties may collect information about your online activities over time and across different websites. We do not control third-party cookies, and their use is governed by the privacy policies of the respective third parties.

AppsFlyer: we use AppsFlyer for mobile install attribution and marketing analytics. AppsFlyer receives limited device and attribution data, together with a small set of account lifecycle events — such as email verification, onboarding completion, and trial start — so that we can measure advertising effectiveness. It does not receive your OCD themes, obsessions, chat content, clinical profile, risk assessments, or any other clinical information. You can opt out at https://www.appsflyer.com/optout.

Google: Google may use information to maintain and improve services, develop new services, provide personalized services including content and ads, and protect Google, its users, and the public. You can adjust Google Ads settings at http://www.google.com/settings/ads and install the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

Meta/Facebook: in addition to browser-based tools, we send Meta server-side conversion events to measure advertising effectiveness. These events report that a milestone occurred — such as completing registration — together with your email address and account identifier in irreversibly hashed form, your IP address, and browser information. They do not include your OCD themes, obsessions, chat content, or any other clinical information. Meta may use information to personalize and improve its products, promote safety, provide measurement and analytics, communicate with users, and research and innovate. Meta provides tools to view and manage ad preferences and privacy rights.

Reddit: Reddit may use information to provide and improve services, measure advertising effectiveness, and deliver personalized content and ads. Reddit may use pixel data to match activity on our Site with a Reddit account or browser profile for advertising attribution and audience targeting. You can review Reddit’s Privacy Policy and ad preferences settings.

You can access, review, update, or change account information through our Services. If you have questions about accessing other Personal Information or would like to correct or delete Personal Information we collect and maintain, contact support@choicefulOCD.com. We will accommodate requests as required by law.

For residents of Washington and Nevada, please review the “Consumer Health Data” section below, which serves as our consumer health data privacy notice. For residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, the rights below may apply.

We will respond to rights requests within 45 days. In some cases, we may require up to an additional 45 days depending on the complexity and number of requests, and we will notify you if more time is required.

To securely handle data rights requests, requests must be submitted from the email address associated with your account. You may designate an authorized agent in writing or through a power of attorney. Before accepting such a request, we will require proof of authorization and may need you to verify your identity directly.

This section is our consumer health data privacy notice for residents of Washington under the My Health My Data Act, residents of Nevada under NRS 603A, and residents of any other state with comparable requirements. It describes how we handle information that identifies your past, present, or future physical or mental health status (“Consumer Health Data”).

We collect Consumer Health Data directly from you, when you complete intake, chat with the AI, log exposure practice and distress ratings, complete daily check-ins, generate meditations, or progress through the treatment course. We also generate Consumer Health Data about you, in the form of the clinical profile, metrics, summaries, and risk assessments described in “Automated Analysis and Decision-Making.” We do not purchase Consumer Health Data, and we do not collect it from data brokers.

We use Consumer Health Data to deliver the Services you have asked for: to personalize your treatment, maintain continuity of care between sessions, generate treatment content, identify patterns that may indicate therapeutic risk, provide support you request, secure the Services, and comply with law.

We do not sell Consumer Health Data, and we do not share it with advertising or marketing partners. Consumer Health Data is disclosed only to the processors that host and operate the Services on our behalf, as identified in “Disclosure of Your Personal Information,” each of which is contractually restricted to processing it for us; to a clinical provider network when you yourself request a therapy consultation; and where required by law or valid legal process.

You have the right to confirm whether we are collecting, sharing, or selling your Consumer Health Data; to access it; to withdraw consent to its collection and sharing; and to have it deleted. To exercise these rights, or to appeal a decision we make about a request, contact support@choicefulOCD.com from the email address associated with your account. Deleting your account through the App deletes your Consumer Health Data on the timeline described in “Data Retention.” Withdrawing consent to the collection of Consumer Health Data means we can no longer provide the Services, because the Services cannot function without it.

We retain Personal Information as long as necessary and relevant for our operations. We may also retain Personal Information from closed accounts to comply with law, prevent fraud, resolve disputes, troubleshoot problems, assist investigations, enforce Terms of Service, collect fees owed, and take other actions permitted by law. After information is no longer necessary, we dispose of it according to our data retention policies.

We strive to use industry-standard data collection, storage, processing practices, and security measures to protect against unauthorized access, accidental loss, or disclosure. Safeguards may vary based on the sensitivity of the information collected and stored.

No security method is foolproof. We cannot warrant or guarantee the absolute security of Personal Information transmitted to or from the Services. Any transmission of Personal Information is at your own risk. You are responsible for maintaining the security of any password, user ID, or other authentication used to access protected or secure areas.

If you believe your account security has been compromised, notify us immediately at support@choicefulOCD.com. We will never send an email requesting confidential information such as account numbers, usernames, passwords, or Social Security Numbers.

In the event of a data or security breach, we will promptly investigate, validate the root cause, remediate vulnerabilities within our control where applicable, comply with directly applicable laws and regulations, cooperate with affected users as applicable, document actions taken, conduct a post-incident review, and notify you as required by applicable law.

We retain Personal Information for as long as necessary to provide the Services and for our legitimate business purposes, or as required to comply with legal obligations, resolve disputes, and enforce agreements. The specifics below match the retention terms in our Terms of Service.

You can delete your account at any time from within the App, or by contacting support@choicefulOCD.com. When you delete your account it is deactivated immediately — you are signed out and can no longer sign in, and your information is no longer used to provide the Services. Your account remains recoverable for 30 days so that an accidental deletion can be undone; after 30 days, your account and the Personal Information and content associated with it are permanently deleted from our active systems. Residual copies may persist in encrypted backups until those backups expire on our normal rotation schedule.

Deleting an individual conversation in the App removes it from your view and from the context used to personalize your future sessions, but we retain the underlying transcript so that we can investigate safety concerns, respond to support requests and disputes, and preserve the integrity of your clinical record. Retained transcripts are deleted when your account is permanently deleted. If you want a specific conversation erased rather than hidden, contact support@choicefulOCD.com.

Cancelling a subscription does not delete your account or your data; your account remains active on the free tier until you delete it.

Our Services may contain links to third-party websites, services, applications, or other resources not operated by us (“Third Party Services”). Information you provide to these parties is not subject to this Privacy Policy. You are responsible for reviewing their policies.

This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices of any Third Party Service, including third-party websites or services linked from the Services. Inclusion of a link does not imply endorsement.

We are not responsible for the information collection, use, disclosure, or security practices of other organizations, such as Facebook, Twitter, Instagram, YouTube, Pinterest, LinkedIn, Apple, Google, Microsoft, app developers, app providers, social media platforms, operating system providers, wireless service providers, or device manufacturers.

Our Services are available to users who are 13 years of age or older. We do not knowingly collect Personal Information from children under 13. If you are under 13, do not use our Services or provide Personal Information to us.

Users between 13 and 17 may use the Services with appropriate parental or guardian consent where required by applicable law, and Choiceful applies additional privacy-protective defaults for minor users in compliance with the California Age-Appropriate Design Code and other applicable law. If you are a parent or guardian and believe your child under 13 provided Personal Information to us, contact support@choicefulOCD.com and we will take steps to delete such information.

We may send communications, including emails, using your Personal Information. You may opt out of certain communications, such as newsletters or promotions, by emailing your preference. Even if you opt out, we may still send communications necessary to provide ongoing services you request.

We will only send offers, promotions, and other marketing communications if you have expressly agreed to receive those messages. If you later change your mind, you may opt out by emailing support@choicefulOCD.com.

We are located in the United States. We may store and process Personal Information in any country where we have facilities or engage service providers. By using the Services, you understand that your information may be transferred to countries outside your country of residence, including the United States, which may have data protection rules different from those of your country.

If you would like additional information about our privacy practices, have questions, or would like to make a request, contact us at support@choicefulOCD.com.

Choiceful Inc., 435 W 31st Street, New York, NY 10001, Attn: Brian Yu.