Privacy Policy

HEAL (Help Each Other Achieve Life) (“HEAL”, “we”, “us”) runs a free, peer-led recovery community for life after addiction treatment, for people in recovery, their families and allies. This policy explains what we collect, why, who can see it and the choices you have, across the website (teleheal.com), the HEAL member app on the web (app.teleheal.com), the desktop and mobile apps, the HEAL shop (shop.teleheal.com), Supporter plans, live meetings, the workbook, the help board, the provider directory and the emails and notifications we send.

It doesn’t cover websites we link to, such as a listed provider’s site or a crisis line. Those are run by others under their own policies.

HIPAA is the federal law that governs how doctors, hospitals, health plans and their contractors handle medical records. 42 CFR Part 2 is a stricter federal rule for records kept by federally assisted substance use disorder treatment programs.

HEAL is neither. We don’t provide treatment or diagnose anything, and we don’t bill insurance. We aren’t a HIPAA “covered entity” or “business associate”, and we aren’t a Part 2 program. Those laws therefore don’t govern what you share with HEAL, and we don’t claim to be “HIPAA compliant”.

That makes our own promises matter more. This policy, the Consumer Health Data Privacy Policy, state privacy laws, and the Federal Trade Commission Act (which prohibits unfair or deceptive practices) all apply. So does the FTC’s Health Breach Notification Rule. We hold ourselves to them.

If a treatment provider, doctor or counselor has your records, HIPAA or Part 2 may still protect those records with them. Nothing you do on HEAL changes that, and HEAL never receives records from providers.

We collect only what we need to run each part of HEAL. Most of it comes from you. Some is created automatically when your device talks to our servers.

We don’t ask for your legal name, date of birth, address, diagnosis, treatment history, insurance or a photo. Please don’t put identifying details about yourself or anyone else in places other members can see.

• To provide HEAL: your account and sign-in; saving your workbook and check-ins; RSVPs, reminders and live rooms; the help board, offers and contact reveal; share links; the directory.
• To run the shop and Supporter plans, if you use them: taking payment, making and delivering orders, handling returns and misprint claims, sending order and shipping emails, renewing, changing and cancelling plans, sending receipts and failed-payment notices, applying supporter perks, and keeping the tax and accounting records the law requires.
• To keep the community safe: holding high-risk help requests for human review and showing crisis resources; handling reports, blocks and host actions; preventing spam and abuse (including bot checks at sign-up); investigating misuse.
• To communicate with you: verification and password emails, the reminders and notifications you’ve left switched on, answers to your questions, and important changes to HEAL or this policy. We send the newsletter only if you confirm your subscription.
• To improve HEAL: understanding which pages and features help people, through the analytics described below, and through anonymous meeting feedback summaries. We don’t use workbook or check-in content for this.
• To protect HEAL and comply with law: security monitoring, keeping a record of staff actions, keeping consent and privacy-request records, and responding to valid legal process as described in our law enforcement guidelines.

Data protection law in these places asks us to name the legal basis for each use:

• Sealed private writing. Workbook answers, share-link snapshots and check-in notes are encrypted with AES-256-GCM before they’re stored. The key is held only by our application server, not the database, so a copy of the database alone can’t reveal them. No staff screen, report, log, analytics event, background job or notification reads them. Our server opens them only to show them to you, or to the person you share them with.
• Minimal by design. Pseudonyms are fine, avatars are emoji, help-board locations are coarse areas rather than addresses, and we don’t collect precise location.
• No profiling. We don’t use your information to draw conclusions about your health, risk or behaviour, or to target anything at you. The only automatic check is the high-risk screen on help requests, and it sends a request to a person for review and shows you crisis resources. It never makes a decision about you.
• Purpose-limited access. Community data such as help requests, reports and meeting presence is seen only by the staff whose role needs it (see the next section).
• Consent and control. You decide whether to tell us you’re in recovery, what you write, and whether to share any of it. See the Consumer Health Data Privacy Policy for your rights over this information.

HEAL staff and trained volunteers use a staff console. Each role sees only what its job requires, and the console records every privileged action in an audit log.

• Hosts see the display names and avatars of the people in their room and can mute or remove them. They don’t see emails.
• Moderators see reports, the content reported, help requests (including those held for review and the risk topics flagged), and the moderation history of the accounts involved. To run meetings safely they can also see, for a single meeting, the display names of members who RSVP’d, who joined and when, and who is in the room now. Every time a staff member opens those lists it is recorded in the audit log. Meeting feedback is shown to staff only as totals, and only once at least three people have answered.
• Reviewers see provider vetting records, not member data.
• Administrators can see account details (including email address), staff notes, privacy and export requests, and the audit log. They can also see analytics. That includes, for an individual account, which features were used and when, which devices and app versions, an activity calendar, the city-level places it has been seen from in the last 90 days, and whether the member is online now. Check-ins appear only as counts. Administrators who run the shop and Supporters can also see orders (with names and shipping addresses), refunds, and supporters’ plans and payment history, but never full card numbers.

Service providers

A few companies host and operate parts of HEAL for us: Railway, Vercel, Cloudflare, Resend, LiveKit, Expo (650 Industries), Stripe, Printful, Google Analytics, Anthropic, OpenAI. They process data only on our instructions and only for the service they provide. Our service providers page lists what each one does, the data it handles and where.

People you choose to share with

• In meetings, the other people in the room see and hear your display name, avatar, role, mute and raised-hand status, and anything you say. There are no public attendee lists.
• On the help board, signed-in members see your request, display name and coarse area. If you accept an offer, the helper sees the contact detail you chose to reveal, and you see theirs.
• Share links show only the prompts you picked, to anyone holding the link, until it expires or you revoke it. If you give a recipient’s email, we email them the link with your display name.

Legal requirements and safety

We disclose information only when the law requires it, such as a valid subpoena or court order, or when we believe in good faith that it’s necessary to prevent imminent death or serious physical harm. We read every request narrowly, push back on recovery information, and tell you before we disclose unless the law or an emergency prevents it. Our Government & Law Enforcement Requests page explains how.

Business transfers

If HEAL reorganizes, merges or transfers its operations to another organization, member data may move with it. If it does, any successor must honour this policy, including its promises about recovery information: no sale, no advertising use, sealed workbook content and your deletion rights. We will notify you in advance and give you the chance to delete your account before anything changes.

With your consent

Beyond the cases above, we share personal information only when you’ve asked us to or clearly agreed.

Both are optional. If you never shop or support HEAL, none of the information below is collected about you.

• Payments. Stripe processes shop payments and Supporter plans, runs fraud checks (which can use your device and network information) and, where enabled, calculates sales tax. You enter card details directly into Stripe. HEAL never sees or stores full card numbers; we receive confirmations and limited details such as the card brand and last four digits. Stripe also uses some payment data as its own controller for fraud prevention and legal compliance, under Stripe’s privacy policy.
• Making and shipping orders. Printful receives the recipient’s name, shipping address, phone number (if you give one) and the items, so it can make and deliver them. It receives no payment card details and nothing about your account or recovery. Carriers receive what’s on the shipping label.
• Supporter status is private by default. Other members can’t see that you’re a supporter unless you switch on the supporter badge or join the public supporters wall. The wall shows only your display name, avatar, plan and when you became a supporter.
• Kept apart from recovery information. Purchases and support are stored separately from your workbook, check-ins, meetings and help-board activity. They are never used to draw conclusions about your health, never used for advertising and never sold. Because buying from or supporting a recovery community could suggest a connection to recovery, we give this information the same protections as health data (see the Consumer Health Data Privacy Policy).
• Emails. Order, shipping, receipt and failed-payment emails are part of the purchase. A reminder about an unfinished checkout is sent only if you opt in. Card statements and email subjects show HEAL’s name; we aim to keep them free of words like “recovery” or “addiction”.

The Shop Terms of Sale and Supporter Terms explain the purchase and billing terms.

We write notifications on the assumption that someone else might see your lock screen or inbox.

• Mobile push (sent via Expo, then Apple or Google) is generic: for example “A meeting you saved starts in 45 min.” It doesn’t include the meeting name or type.
• Desktop reminders are created on your computer and say only that your meeting is starting.
• Email about meetings and the help board is generic, for example “A meeting you saved starts soon” or “There’s an update on your help request”, with a link into HEAL. It doesn’t include a meeting’s title, a help request’s title or another member’s name.
• In-app notifications, which you see only inside HEAL once signed in, can include a meeting’s title, the title of your help request and another member’s display name, so you can tell what they’re about.
• Never included anywhere: workbook text, check-in notes or mood, diagnoses, or who attended a meeting.

You can switch email and push on or off for each kind of notification, set quiet hours and mute notifications for a time in your notification settings. Account and safety messages, such as password resets and moderation notices, can’t be switched off. Every newsletter has a one-click unsubscribe link.

Website. We use our own first-party analytics and Google Analytics 4 in Consent Mode. In the United States, analytics is on by default and you can turn it off in one click; if your browser sends a Global Privacy Control signal, it starts off. Everywhere else, nothing optional runs until you choose. Advertising storage is always off for everyone, because HEAL runs no ads. Without consent, our own analytics counts page views without any cookie or identifier, using a hash of your IP address and browser that changes daily, and we filter out bots. Signed-in members’ visits are linked to their account ID in our own analytics only; we never send your account ID to Google.

Member web and desktop app. These don’t load Google Analytics or our website tracker. The server records which days you were active and from which city, as described above.

Mobile app. The app sends usage events (screens, feature use, performance and errors) to our server. We keep them keyed to a random install ID and, when you’re signed in, your account ID. They never contain anything you typed, but they can show which features you used, such as joining a meeting or posting a help request in a given category, so those stay with HEAL. Only app opens, sessions, screen names (such as “/meetings/[id]”, never the meeting itself), errors and performance timings are passed on to Google Analytics, keyed to the random install ID and never to your account ID.

Shop. The shop at shop.teleheal.com is meant to use the same cookie choice and analytics as the website. When an order is paid or refunded, our server reports the order number, items and amounts to Google Analytics so we can see what sells, never your name, email or address. Support payments are counted the same way, without any detail about you.

The Cookie & Storage Policy lists every cookie and storage item and how to change your choices. We honour Global Privacy Control as described there.

We keep information only as long as we need it, then delete it or strip it of anything that identifies you. In summary:

• Account, profile, workbook and check-ins stay while your account is open. They’re deleted or anonymized immediately when you delete your account.
• Help requests leave the board automatically after 30 days. Share links last 1–14 days (7 by default) unless you revoke them sooner.
• Sign-in sessions last 30 days and are refreshed while you use HEAL.
• The city-level places your account has been seen from are forgotten 90 days after the last visit from each place, and the record of which days you were active (with the city) after 13 months.
• Raw first-party analytics and app events are deleted after 13 months, and Google Analytics keeps event data for 14 months. Daily totals with no identifiers are kept for trends.
• Shop orders and supporter payment records are kept for as long as tax and accounting law requires, which we expect to be about seven years (counsel will confirm the exact period). After you delete your account, we keep only what those laws need, with your HEAL profile unlinked.
• Safety records (reports and moderation actions), the staff audit log, and consent and privacy-request records are kept longer, in minimal form, because they protect members and show we kept our promises.

The full schedule, and what deletion does to each kind of data, is in Your Data Rights & Deletion.

Data travels over encrypted connections (TLS). Workbook answers and check-in notes get the additional AES-256-GCM sealing described above. Passwords are stored only as hashes, and share links are stored only as a hash of their secret token. Our sign-in system encrypts tokens from any linked sign-in provider. Every request is authorized on the server, other members’ private records return “not found”, and sensitive actions are rate-limited and recorded in the staff audit log.

No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires, including under state breach laws and the FTC Health Breach Notification Rule. More detail, and how to report a vulnerability, is on our Security & Responsible Disclosure page and at security@teleheal.com.

HEAL is for adults aged 18 and over. Everyone confirms “I’m 18 or older” when they sign up, and we record when they did; we can’t create an account without it. We don’t knowingly collect personal information from anyone under 18, including children under 13 protected by the Children’s Online Privacy Protection Act (COPPA). If we learn that an account belongs to someone under 18, we will close it and delete its information. If you believe a minor is using HEAL, please tell us at privacy@teleheal.com. If you’re a young person who needs support now, call or text 988.

Laws in California (CCPA as amended by the CPRA) and many other states give residents rights over their personal information. Separate health-data laws in Washington, Nevada and Connecticut add more rights. We give these rights to every member, wherever you live.

Your rights

• Know and access: what we collect, why, where it comes from and who receives it, and a copy of your information in a portable format.
• Correct: fix inaccurate information. You can edit most of it yourself.
• Delete: have your information deleted, subject to narrow exceptions explained in Your Data Rights & Deletion.
• Opt out of sale, “sharing” for cross-context behavioral advertising, targeted advertising and profiling. We don’t do any of these with member data.
• Limit the use of sensitive personal information, and withdraw consent to processing of health data.

Categories we collect (the CCPA disclosure for the past 12 months)

The sources and purposes for each category are set out in “What we collect” and “How we use it” above. We keep each category for the periods in our retention schedule.

No sale, no sharing for advertising (“Do not sell or share my info”)

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. That is true for everyone, so there is nothing you need to switch off: “Your privacy choices · Do not sell or share my info” in the cookie notice brings you here. We have no actual knowledge of selling or sharing the information of anyone under 16. HEAL runs no ads. The member apps contain no advertising code, and on the website Google Analytics runs with advertising storage, ad user data and ad personalization always denied. A Global Privacy Control (GPC) signal from your browser is treated as an opt-out of sale and sharing, and it also switches off our optional website analytics.

Sensitive personal information

We use sensitive personal information (your login, health-related information and the content of help-board messages) only to provide the service you asked for, keep it secure and safe, and as the law permits. We don’t use it to infer characteristics about you. Because of that, California law doesn’t require a separate “limit” link, but you can still ask us to stop any particular use at privacy@teleheal.com.

Notice at collection

This policy is our notice at collection. We describe the categories and purposes before or when we collect information, at sign-up, in onboarding and on each feature. We won’t collect new categories, or use them for materially different purposes, without telling you first.

How to make a request

• In the app: Profile → Your data (export, correct or delete), or delete your account straight away from your account settings.
• By email: privacy@teleheal.com. You don’t need an account to ask.

Verification. Requests from inside your signed-in account are already verified. For email requests, we confirm control of the email address on the account and may ask for a detail only the account holder would know. We never ask for government ID or health information to verify you, and we use what you give us only for the request.

Authorized agents. Someone you authorize can make a request for you. We’ll ask for your signed permission (or a power of attorney) and may ask you to confirm the request directly with us.

Timing. We aim to respond within 30 days and always within 45 days. If it’s reasonably necessary we may extend by another 45 days, and we’ll tell you why. Requests are free.

Appeals. If we decline any part of your request, we’ll explain why. You can appeal by replying or by emailing privacy@teleheal.com with “Appeal” in the subject. A different person will review it and answer within 45 days (60 days in Connecticut and some other states, if needed). If you’re not satisfied, you can contact your state Attorney General, and we’ll tell you how.

No discrimination. Membership is free. Exercising your rights will never change your access, the quality of the service, or how anyone treats you. Supporter plans and their shop discount aren’t offered in exchange for your personal information, so they aren’t a “financial incentive” under California law. Deleting your account does end an active plan, because a plan needs an account to belong to.

Other notices. California’s “Shine the Light” law doesn’t apply because we don’t disclose personal information to third parties for their direct marketing. Under Nevada’s privacy law (NRS 603A), you can ask us not to sell your information. We don’t sell it, but we’ll confirm that in writing if you ask.

HEAL is built for the United States, and our servers and service providers are mainly in the US. If you use HEAL from elsewhere, your information is transferred to and processed in the US, where privacy law may differ from yours. Where the law requires a transfer safeguard, such as for data leaving the EEA, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) in our agreements with service providers, or on their certification under the EU-US Data Privacy Framework and its UK and Swiss extensions, where they hold one.

Under the GDPR and UK GDPR you can access, correct, delete, restrict or object to our use of your information, receive it in a portable format, and withdraw consent at any time without affecting earlier processing. Make a request the same way as above. You can also complain to your local data protection authority (in the UK, the Information Commissioner’s Office), though we’d welcome the chance to sort it out first. If you order from the shop, Printful may make your order at a production facility outside the US, near your delivery address, and Stripe may process payments through its affiliates outside the US. HEAL hasn’t yet appointed an EU or UK representative. We will before actively serving those regions.

When we change this policy, we’ll update the date at the top. If a change is material, especially anything about recovery information, sharing or your rights, we’ll tell you in the app or by email before it takes effect. Where the law requires it, we’ll ask for your consent again. We will never apply a less protective policy to information we collected under a more protective one without your consent.

Privacy questions, requests and appeals: privacy@teleheal.com. Every address routes to a person, not a bot. Security concerns: security@teleheal.com.

The legal entity behind HEAL, and its postal address, will be listed here before launch.