Privacy Policy

1. Information We Collect

Account and profile information

• Name or display name
• Email address and phone number
• Account identifiers and authentication information
• Age and state eligibility confirmation
• Communication, language, time-zone, profile, and support preferences
• Information you choose to include in your profile

Support and consumer health information

When you use Openly, you may choose to provide information about your wellbeing, experiences, relationships, behaviors, goals, concerns, routines, or support needs. This may come from AI conversations, assessments, check-ins, tools, programs, topic selections, support preferences, memory controls, activities, and safety-related interactions.

Openly may also generate information from your activity, such as summaries, topic classifications, recommendations, progress information, memory entries, and other support-related signals. We treat this information with heightened care.

Communications with Chaperone

If you contact support, report a problem, submit feedback, respond to a survey, or otherwise communicate with us outside an Openly support conversation, we may collect your contact information, the contents of the request, related account or technical information, and information needed to investigate or respond.

Usage, device, and technical information

• IP address
• Browser and device type
• Operating system and application/browser version
• Login and access information
• Pages or features used
• Dates and times of activity
• Session and interaction information
• Error, diagnostic, performance, and security information

Openly does not use third-party advertising, cross-site tracking, or session-replay technology in the user-facing product. Product analytics are first-party and use constrained event schemas that exclude private conversation text and user-entered support content.

The initial Openly service does not ingest medical records or identifiable health-related information from external health sources such as healthcare providers, health information exchanges, external health applications, or payer clinical feeds.

2. How We Use Information

• Create, authenticate, maintain, and secure your account.
• Provide AI conversations, tools, assessments, programs, resources, check-ins, and navigation.
• Maintain continuity and permitted memory across interactions.
• Personalize support style, tools, resources, recommendations, and next steps.
• Operate safety classification and safety-response controls.
• Respond to support and privacy requests.
• Troubleshoot, secure, maintain, test, and improve the Service.
• Prevent fraud, misuse, abuse, and unauthorized access.
• Comply with applicable law and lawful legal process.

Internal AI model improvement is a separate, optional purpose. Openly does not use a user’s eligible conversation content for internal model-improvement datasets unless the user gives the separate permission described in AI & Data Use. Any user-derived content released into an improvement dataset is de-identified and minimized under the applicable process.

3. AI-Assisted Processing

AI powers the core Openly experience. It may generate responses, summaries, topic classifications, recommendations, personalization, memory-related context, and navigation. Private Openly content may be processed by service providers that help deliver these features.

Chaperone does not authorize third-party AI providers to use private Openly conversations or consumer health data to train their general-purpose AI models. Production AI processing should be routed through the governed provider configuration approved for Openly.

4. How We Disclose Information

Service providers

We use service providers for functions such as hosting, database and file storage, realtime communications, email and SMS delivery, AI processing, scheduled jobs, application monitoring, security, and infrastructure. Providers may process information only as needed for their authorized role and are subject to applicable contractual, confidentiality, privacy, retention, deletion, and security requirements.

Authorized Chaperone personnel

Openly is not a live human support or crisis-monitoring service. Limited authorized personnel may access information when reasonably necessary to operate, secure, troubleshoot, investigate misuse or incidents, respond to privacy/support requests, or perform approved data-governance and quality functions. Access is restricted based on role and operational need.

At your direction

We may disclose information when you expressly direct or authorize us to do so. Clinician, employer, payer, or partner data-sharing features are not part of this initial Openly consumer launch unless separately offered with appropriate disclosures and controls.

Legal and safety reasons

We may disclose information where reasonably necessary and permitted or required by law, including to comply with lawful legal process, protect legal rights, investigate fraud or security threats, or address serious safety concerns.

Business transactions

If Chaperone is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, information may be disclosed or transferred as part of that transaction subject to applicable law and appropriate protections.

5. No Sale, Advertising, or Third-Party Tracking

Openly does not sell personal information or consumer health data. We do not share private support content with advertisers or data brokers, and we do not use private conversation content, assessment responses, tool responses, or other consumer health data for third-party targeted advertising or cross-context behavioral advertising.

6. Consumer Health Data

Information about your mental, emotional, behavioral, or physical wellbeing may receive heightened protection under applicable privacy laws. Openly uses a separate Consumer Health Data Privacy Notice and a separate Sensitive / Health Data Consent for the initial pilot.

7. Your Privacy Choices and Rights

Under our launch privacy baseline, you may request to confirm whether we process information about you, access covered information, correct inaccuracies, delete information, receive certain data in a portable format where applicable, withdraw consent for consent-based processing, obtain information about certain disclosures where applicable, and appeal a privacy decision.

Submit a request through our Your Privacy Rights page or email privacy@chaperone.health. We may need to verify your identity before fulfilling a request. We generally aim to respond to verified privacy requests within 45 days. Verified consumer-health deletion requests are processed within 30 days as a launch target. Where processing depends on your consent, we will stop the applicable consent-based processing as soon as practicable and no later than 15 days after a valid withdrawal request, subject to permitted exceptions.

8. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate operational, security, safety, legal, audit, and compliance needs. Retention may depend on account status, information type, incident documentation, legal obligations, dispute resolution, audit requirements, and backup lifecycles.

When we authenticate a valid deletion request, Openly removes covered identifiable data from active systems within the applicable launch target, subject to permitted exceptions, and instructs applicable processors to delete or return retained covered data where required. Data in encrypted backups may remain until it rotates out through the normal backup lifecycle and is not used for unrelated purposes.

De-identified information is not maintained as identifiable account data. If you previously permitted internal model improvement, finalized appropriately de-identified datasets and completed model versions may no longer be technically linked back to your account and may not be reversible.

9. Data Security

Chaperone uses administrative, technical, and organizational safeguards designed to protect personal information. Public security statements are limited to controls that have been verified for the Openly production deployment. See our Security page for current details.

10. Communications

Openly may communicate by email, SMS, and in-app notification according to available settings and preferences. These communications may include authentication codes, account notices, security alerts, invitations, support reminders, and service notifications.

11. Age and State Availability

Openly is available only to adults age 18 and older and, for the initial pilot, only in Iowa, Minnesota, and Wisconsin. We do not knowingly offer ordinary Openly access to minors. If we learn that an account belongs to a person under 18 or is being used from an unsupported state, we may suspend or close access and take reasonable steps to handle the information appropriately, subject to applicable legal, safety, and security requirements.

12. Third-Party Websites and Services

Openly may link to websites, crisis services, resources, or other services operated by third parties. When you leave Openly and use a third-party service, that third party’s terms and privacy practices apply.

13. Changes to This Privacy Policy

We may update this Privacy Policy as Openly, our technology, or legal requirements change. If we make material changes to how we collect, use, or disclose personal information, we will provide appropriate notice and obtain additional consent where required. The effective date at the top of the published policy identifies the current version.

14. Contact Us