Consumer Health Data Privacy Notice

1. Consumer Health Data We May Collect

• Topics, concerns, experiences, goals, behaviors, routines, relationships, or support needs you choose to discuss.
• Messages and information you provide in AI Assistant or Companion conversations.
• Conversation summaries, classifications, memory entries, recommendations, and other information generated from your Openly activity.
• Assessment, check-in, tool, exercise, and program responses or scores.
• Support preferences, communication style preferences, and Companion choices.
• Safety-related information that arises while you use the Service.
• Information about support interactions, such as conversation or feature activity.

2. Sources of Consumer Health Data

• You directly.
• Your interactions with Openly’s AI Assistant and Companions.
• Assessments, check-ins, tools, programs, and activities you complete.
• Information generated from your activity within Openly.

The initial Openly service does not ingest medical records or identifiable health-related information from external health sources such as healthcare providers, health information exchanges, external health applications, or payer clinical feeds.

3. How We Use Consumer Health Data

• Provide the AI-guided support, tools, programs, assessments, resources, and other features you request.
• Personalize support style, recommendations, resources, tools, programs, and next steps.
• Generate summaries and permitted memory/context for continuity.
• Operate safety classification and safety-response controls.
• Troubleshoot, secure, maintain, and operate Openly.
• Prevent fraud, misuse, abuse, or unauthorized access.
• Comply with applicable law or lawful legal process.

Internal model-improvement use is not part of the required core processing purpose. It is governed by a separate optional permission. Declining that permission does not block ordinary Openly access.

4. AI-Assisted Processing

AI is used throughout Openly to generate responses, summaries, classifications, recommendations, personalization, and navigation. Private content may be processed by service providers that help deliver these features. Third-party AI providers are not authorized to use private Openly conversations or consumer health data to train their general-purpose models.

5. When We Disclose or Provide Access to Consumer Health Data

Service providers acting on our behalf may process only the information reasonably necessary for their authorized role. Limited authorized Chaperone personnel may access information for approved operational, security, privacy-request, incident, troubleshooting, or data-governance purposes. Openly is not a monitored human support or crisis-response service.

We may also disclose information when you direct us to do so, in connection with lawful legal process, where disclosure is permitted or required for serious safety concerns, or as part of a business transaction subject to applicable protections.

6. No Sale, Advertising, or Cross-Site Collection

Openly does not sell consumer health data. We do not use or disclose private support conversations, assessment information, tool responses, or other consumer health data for third-party targeted advertising or cross-context behavioral advertising. We do not permit third-party advertising, cross-site tracking, or session-replay technologies to collect consumer health data from the user-facing Openly product.

7. Consent for Core Sensitive / Health Data Processing

For the initial Iowa, Minnesota, and Wisconsin pilot, Openly uses affirmative consent before beginning ordinary features that require substantive sensitive or health-support information. This consent is separate from acceptance of the Terms of Use. If you do not provide the required consent, Openly cannot provide the ordinary personalized conversation features that depend on this processing.

8. Separate Optional Permission for Model Improvement

Openly separately asks whether you want eligible portions of your conversations to help evaluate and improve Openly’s AI systems. This optional permission is OFF unless you affirmatively allow it. Declining does not reduce ordinary access. When permission is active, eligible content must pass through the approved de-identification and minimization process before it is released into an internal improvement dataset.

9. Your Consumer Health Data Rights

• Confirm whether Openly processes consumer health data about you.
• Access covered consumer health data.
• Correct inaccurate information where applicable.
• Delete covered consumer health data.
• Withdraw consent and request that consent-based processing cease.
• Receive certain data in a portable format where applicable.
• Ask about certain third-party disclosures where applicable.
• Appeal a privacy-request decision.

Submit a request through our Your Privacy Rights page or by emailing privacy@chaperone.health.

10. Response, Withdrawal, and Deletion Timing

We generally aim to respond to verified privacy requests within 45 days. Verified consumer-health deletion requests are processed within 30 days as a launch target. If processing depends on your consent, Openly will stop the applicable consent-based processing as soon as practicable and no later than 15 days after receiving a valid withdrawal request, subject to permitted exceptions.

11. Security and Data Minimization

Openly limits collection, internal access, and processor access to information reasonably needed for approved purposes. Chaperone uses layered technical and organizational safeguards and publishes only verified security claims on the Security page.

12. Changes and Contact

We may update this Notice as Openly or legal requirements change. Material changes will receive appropriate notice and additional consent where required. Questions may be sent to privacy@chaperone.health or mailed to Chaperone Health, Inc., 1500 N Grant St #11603, Denver, CO 80203.