Government & Law Enforcement Requests

This page explains how HEAL responds to requests for member data from US federal, state and local government agencies and law enforcement, from authorities outside the United States, and from private parties in lawsuits (including family-court matters). It is written for both members and requesters. It is not legal advice, and it does not create rights for any third party. HEAL may object to any request on any lawful ground.

• Recovery data is highly sensitive. Being identified as someone in recovery can affect a person’s job, housing, custody of their children and safety. We start from the position that this information should stay private.
• Valid legal process is required. Outside a genuine emergency, we disclose member data only when legally compelled by process that is valid, properly served and issued by an authority with jurisdiction over HEAL.
• We notify members. We tell affected members about a request before we disclose, so they can seek legal help, unless we are legally prohibited from doing so (for example by a court-issued non-disclosure order), or notice would create a real risk of death or serious harm.
• We narrow overbroad requests. We ask requesters to narrow requests that are unclear or broader than the matter requires, and we may go to court to challenge them.
• We disclose the minimum. When we must disclose, we provide only the specific data that the process requires.
• We never volunteer data. HEAL does not provide member data to government agencies or anyone else voluntarily, sell it, or give bulk or “backdoor” access to our systems.

We describe this honestly so requesters don’t ask for what doesn’t exist, and members know what could be requested.

We do not have

• Meeting recordings. HEAL meetings are live audio only and HEAL does not record them. There is no audio, transcript or recording to produce.
• Public attendee lists. We don’t publish who attends meetings.
• Real names or photos, in many cases. Members may use a pseudonym, and avatars are an emoji on a color — never a photograph.
• Exact locations. Help requests carry only a coarse area that members type themselves, never an address. We don’t collect precise device location.
• Payment information. HEAL is free and doesn’t collect payment details.
• Data we’ve deleted. When a member deletes their account, their records are removed from our live systems. Copies may remain in backups for a limited period until they are overwritten.

We may have

• Account information: email address, display name, avatar choice, account creation date and the consents a member gave.
• Sign-in records: active session records, which can include IP address and browser or device type.
• Meeting records needed to run meetings: RSVPs, and room-presence records (when a member joined or left a room, whether they were muted or removed). These are used to run meetings and are not public.
• Help board content: requests, offers and their status, and contact details a member chose to reveal after accepting an offer.
• Safety records: reports members make and moderation actions taken.
• Workbook answers and check-in notes, which are encrypted — see below.

Workbook answers and mood check-in notes are sealed with AES-256-GCM encryption before they are stored. HEAL’s staff tools never retrieve them, and the encryption protects them if our database were ever exposed.

We want to be precise about the limits. This is not end-to-end encryption: the encryption key is held by HEAL’s servers so the app can show members their own entries. That means HEAL is technically able to decrypt this content, and a court could order us to. Encryption does not on its own put workbook content beyond the reach of legal process.

What we commit to instead is how we respond. We treat any request for workbook or check-in content as the most sensitive kind of request we can receive. We will require a search warrant or court order specifically describing that content, we will notify the member unless legally prohibited, and we will use the legal means available to us to challenge or narrow the request.

Members can delete individual entries, revoke share links, or delete their account at any time; see Your Data Rights & Deletion.

HEAL follows the Stored Communications Act (part of the Electronic Communications Privacy Act, 18 U.S.C. §§ 2701–2713), which sets the process required for different kinds of data:

• Subpoena. A valid subpoena may compel only basic subscriber information, such as the email address and display name on an account, account creation date, and sign-in IP addresses with their dates and times.
• Court order under 18 U.S.C. § 2703(d). Required for other non-content records, such as meeting RSVPs and room-presence records, help request status records, or moderation history.
• Search warrant. Required for the content of a member’s communications or stored material, such as offer messages and the text of help requests, reports and workbook or check-in content. A warrant must be issued under the Federal Rules of Criminal Procedure or an equivalent state procedure, on a showing of probable cause.

Where state law gives members more protection — for example the Washington My Health My Data Act or state laws protecting reproductive and gender-affirming health information, where relevant — we apply the more protective rule. HEAL is not a 42 CFR Part 2 program, but we take guidance from the strict protections Part 2 gives substance use treatment records when deciding how hard to push back.

The Stored Communications Act allows us to disclose information voluntarily when we believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay (18 U.S.C. § 2702(b)(8) and (c)(4)).

Emergency requests must come from a law enforcement or public-safety officer and must be sent to legal@teleheal.com with the subject line “Emergency disclosure request”. They must describe the emergency, explain why it requires disclosure without delay, and identify the specific information needed. We review them as quickly as we can, but please remember HEAL is not monitored around the clock — if a life is at risk right now, act on what you already know and contact emergency services directly.

We evaluate each emergency request on its facts and disclose only what is needed to address the emergency. We may notify the member afterwards.

HEAL is based in, and stores data in, the United States. Authorities outside the US should use a Mutual Legal Assistance Treaty (MLAT), letters rogatory, or another process recognized under US law, including any applicable agreement under the CLOUD Act. We consider emergency requests from foreign authorities on the same basis as US emergency requests.

We honor valid preservation requests under 18 U.S.C. § 2703(f) from US government entities while they obtain formal legal process. We will preserve a snapshot of the specific records identified for 90 days, extendable once by a further 90 days on a renewed request. A preservation request does not by itself lead us to disclose anything. Because members can delete their own data, a preservation request must identify the account precisely and be sent promptly.

The Stored Communications Act generally does not allow us to disclose the content of members’ communications to private parties, even under a civil subpoena. If you are a party to a civil case, the best route is to ask the member directly — members can request a copy of their own data from HEAL at any time.

We know that recovery information is often sought in custody, divorce, employment and similar disputes, and that its disclosure can do lasting harm. For any civil or family-court request we will:

• require valid, properly served process, and a court order for anything beyond basic subscriber information;
• notify the member and give them reasonable time to object or seek a protective order before we respond;
• object to requests that are overbroad, unduly burdensome or seek privileged or protected health information; and
• seek reimbursement of our reasonable costs of responding, where the law allows.

When we notify a member, we email the address on their account with a copy or description of the request, the requesting party and, where possible, how long they have to respond before we act. We generally wait at least 10 days before producing data, unless an order requires otherwise. If a non-disclosure order prevents notice, we may ask the court to lift or shorten it, and we notify the member once it expires.

Requests about providers listed or considered in our vetted directory — for example, for evidence submitted during a review — are handled under the same principles. Evidence is kept in private storage with access logged, and we will tell the provider about the request unless prohibited.

HEAL uses third-party companies to host and run the service (see Service Providers). Requests for HEAL member data should be sent to HEAL, not to them. If a service provider receives a request for HEAL data, we expect them to redirect it to us where the law allows.

We intend to publish a transparency report at least once a year, showing the number and types of requests we received, how many accounts they concerned, and how we responded — including how often we pushed back or disclosed nothing. We will report in the ranges the law allows for national-security requests. Until the first report is published, HEAL has nothing to report.

Send all requests in writing to legal@teleheal.com. Each request must include:

• the name of the requesting agency or party, the name and title of the person making the request, and a verifiable official email address and phone number;
• a copy of the legal process (signed, dated and issued by an authority with jurisdiction), or for emergency requests the information described above;
• the email address or exact display name of the HEAL account concerned — we cannot search for people by real name or description;
• the specific data requested and the date range, kept as narrow as possible; and
• any non-disclosure order, with its duration.

We don’t accept requests made informally — by phone, text, social media, in-app message, or through members, hosts or volunteers — and staff and volunteers are instructed not to answer them. Accepting delivery of a request by email is for convenience only and does not waive any objection, including to service or jurisdiction.

If you have questions about a request involving your account, or about what we hold, write to privacy@teleheal.com. You can request a copy of your data, and delete your account, at any time. If you receive a request from someone claiming to act for HEAL and asking for your information, don’t respond — tell us at legal@teleheal.com.