Consumer health data privacy policy · revised 2026-09-23

The health information in your workbook, and your rights over it.

Recovery records are health information. This page covers only that information, as Washington's My Health My Data Act requires. The full privacy policy covers everything else.

What is collected and why

• Recovery records you enter: recovery and clean-time dates, inventories and spot checks, craving, urge, and relapse-plan entries, mood and emotion logs, DBT diary cards, withdrawal and medication records, sleep, meditation, and practice logs, crisis and safety plans, sponsor, meeting, and service notes, and gratitude entries. Used only to store, show, and export your own workbook.
• Program settings: which fellowship tools (A.A., N.A., DBT) you turned on. Used to show the matching screens.
• The fact that you hold an account: an account here can itself suggest recovery. Used to sign you in and send account email (verification and password reset only).
• Screen-use counts while signed in: which workbook screens and controls were used on a given day, linked to the account by a keyed daily hash. Used to see which tools are used, kept 90 days, and included in export and deletion. Not collected when your browser sends Global Privacy Control or Do Not Track.
• Recovery companion messages, only if you turn the companion on: the text you type is passed to the AI provider to get a reply. It is not stored on this server.

Where it comes from

• You, when you type or select it in the workbook.
• Your browser, for the screen-use counts above.

No health information is bought or received from anyone else.

What is shared, and with whom

Health information is not sold and is not used for advertising. Categories of recipients:

• AI provider — only with your separate consent: Recovery companion messages go to OpenRouter, which passes them only to OpenAI. You can withdraw that consent on the companion screen.
• Server hosting provider: stores the database and server snapshots on our behalf.
• Email delivery provider: receives your address and the account message, which shows that you hold an account.
• Google, only if you choose Google sign-in: learns that you signed in here.

There are no affiliates.

Your rights and how to use them

• See and get a copy: sign in and use Data & privacy → Download my data. To confirm what is held or get the list of every recipient above that received your information, email the address below.
• Delete: sign in and use Data & privacy → Delete my account. The live account is removed at once. Server snapshots are deleted within 30 days, and a deletion is applied again if a snapshot is ever restored.
• Withdraw consent: deleting the account withdraws consent to storing records. The companion screen withdraws consent to sending messages to the AI provider.
• By email: write to support@sobrietyhelper.com from the address on the account, with the subject "Health data request." You get an answer within 45 days (one 45-day extension, with notice, when a request is complex).
• Appeal: if a request is refused, reply with the subject "Appeal." You get a written decision within 45 days. If the appeal is denied you can contact the Washington Attorney General at atg.wa.gov/file-complaint.

Using these rights never costs anything and never changes how the workbook works for you.