Consumer Health Data Privacy Notice

This Consumer Health Data Privacy Notice explains how Chaperone handles identifiable information about a person’s mental, emotional, behavioral, or physical wellbeing. It supplements our Privacy Policy and is intended to provide heightened transparency for sensitive support information.

If this Notice provides greater protection for consumer health data than our general Privacy Policy, Chaperone will follow this Notice for that data.

1. Consumer Health Data We May Collect

• Topics, concerns, experiences, goals, behaviors, or support needs you choose to share.
• Messages and information you provide in conversations with Peer Coaches or AI-assisted features.
• Information contained in member-uploaded photos, screenshots, PDFs, and plain-text files, including sensitive health information, and the AI-generated descriptions members approve for sharing with Peer Coaches.
• Conversation summaries, support notes, quality-review information, and safety-related records about support interactions.
• Assessment, check-in, tool, and exercise responses and scores.
• Program enrollment, progress, completion, and activity information.
• Support preferences, including topics and preferred communication or support style.
• Information about support interactions, such as session or messaging activity.
• Information inferred or generated from Chaperone activity, such as summaries, topic classifications, patterns, recommendations, or suggested next steps.

We do not require you to provide more sensitive information than is reasonably necessary to use the Chaperone features you choose.

2. Sources of Consumer Health Data

• You directly.
• Your interactions with Peer Coaches.
• Your interactions with Chaperone’s AI-assisted features.
• Files you choose to upload and the descriptions generated from those files.
• Assessments, check-ins, tools, programs, and activities you complete.
• Information generated from your activity within Chaperone.

The initial Chaperone service does not ingest medical records or identifiable health-related information from external health sources such as healthcare providers, health information exchanges, external health applications, or payer clinical feeds.

3. How We Use Consumer Health Data

• Provide the peer support, tools, programs, assessments, resources, and other services you request.
• Help connect you with an appropriate Peer Coach and support continuity between interactions.
• Personalize recommendations, resources, tools, programs, and next steps.
• Generate summaries and context that help you or an authorized Peer Coach understand relevant prior support information.
• Operate AI-assisted features.
• Measure progress or changes over time.
• Maintain service quality, Coach support, supervision, and quality review.
• Identify and respond to safety concerns.
• Troubleshoot, secure, maintain, and improve Chaperone.
• Prevent fraud, misuse, abuse, or unauthorized access.
• Comply with applicable law or lawful legal process.

4. AI-Assisted Processing

AI may help summarize information, identify support topics, recommend tools or resources, support Coach matching, provide self-guided experiences, assist Peer Coaches, and improve navigation and personalization. AI-assisted features do not turn Chaperone into therapy, medical diagnosis, medical treatment, or emergency care.

Private Chaperone conversations and consumer health data may be processed by service providers that help deliver AI features. Chaperone does not authorize third-party AI providers to use private conversations or consumer health data to train general-purpose AI models. Chaperone routes AI processing through a governed gateway configured to exclude providers that log or train on prompts.

Uploaded attachments may be processed by authorized AI service providers to generate factual descriptions. Only member-approved descriptions, not originals or raw extracted content, are shared with Peer Coaches. Originals ordinarily expire after seven days, while approved descriptions may remain for continuity. Member-initiated deletion removes the attachment description from the Coach conversation, subject to permitted retention exceptions.

Any user-derived information used in Chaperone’s internal model-improvement datasets is de-identified before it enters those datasets.

5. When We Disclose or Provide Access to Consumer Health Data

Service providers acting on our behalf

We may use service providers for hosting, storage, realtime communication, email and SMS delivery, AI processing, scheduled job delivery, monitoring, security, and infrastructure. We limit the information provided to what is reasonably necessary for each provider’s role and require applicable confidentiality, privacy, security, retention, and deletion protections.

Chaperone personnel and Peer Coaches

Authorized Chaperone personnel and Peer Coaches may access consumer health data when reasonably necessary to provide support, maintain continuity, support or supervise Coaches, conduct quality assurance, respond to support requests, investigate safety or security concerns, or maintain the platform. Access is limited based on role and operational need.

Legal and safety-related disclosures

We may disclose information when reasonably necessary to comply with applicable law, lawful legal process, or legal obligations, or where disclosure is permitted or required in connection with serious safety concerns.

Business transactions

If Chaperone is involved in a merger, acquisition, financing, restructuring, bankruptcy, or sale of assets, information may be transferred as part of that transaction subject to applicable privacy requirements.

6. No Sale, Advertising, or Cross-Site Collection

Chaperone does not use precise geolocation information to infer visits to healthcare facilities or to target users based on health-related location activity.

7. Consent

Where applicable, Chaperone obtains affirmative consent before processing sensitive or consumer health data. The consent request describes the categories of information involved, the purposes of processing, categories of service providers involved, and how consent may be withdrawn. Consent to process sensitive health/support data is separate from acceptance of the Terms of Use.

If Chaperone later proposes to collect, use, or disclose consumer health data in a materially different way that requires additional consent, we will provide updated notice and obtain that consent before the new processing begins.

8. Your Consumer Health Data Rights

Depending on applicable law and our privacy practices, you may request to:

• Confirm whether Chaperone is collecting, using, or disclosing consumer health data about you.
• Access consumer health data we maintain about you.
• Correct inaccurate consumer health data where applicable.
• Delete consumer health data.
• Withdraw consent and request that consent-based processing cease.
• Obtain information about certain third parties to which your consumer health data has been disclosed.
• Appeal a decision we make regarding a privacy request.

Submit a request through our Your Privacy Rights page or by emailing privacy@chaperone.health.

9. Response, Withdrawal, and Deletion Timing

We generally aim to respond to verified privacy requests within 45 days. Verified consumer-health deletion requests are processed within 30 days. If processing depends on your consent, Chaperone will stop the applicable consent-based processing as soon as practicable and no later than 15 days after receiving a valid withdrawal request, subject to legally permitted exceptions.

For deletion requests, Chaperone removes covered identifiable information from active systems and, where applicable, notifies relevant processors or service providers that retain covered information so they can delete or return it consistent with applicable law and contract. Data in backups may remain until it rotates out through the normal backup lifecycle and is not used for unrelated purposes.

10. Data Minimization and Access Controls

Chaperone limits collection, internal access, and processor access to information reasonably needed to provide, support, secure, supervise, improve, or safely operate the Service. Access to sensitive information is restricted according to role and operational need.

11. Security

Chaperone uses administrative, technical, and organizational safeguards designed to protect consumer health data from unauthorized access, disclosure, alteration, loss, or misuse. These include encryption, role-based access controls, privileged-access MFA, audit logging, monitoring, environment separation, backup and recovery controls, vulnerability management, and incident-response procedures.

12. Changes to This Notice

We may update this Notice as Chaperone changes or as legal requirements evolve. If we make a material change affecting how we collect, use, or disclose consumer health data, we will provide appropriate notice and obtain additional consent where required. The effective date at the top of the published Notice identifies the current version.

13. Contact Us

Chaperone Health, Inc.
Operating as Chaperone Health
1500 N Grant St #11603, Denver, CO 80203
privacy@chaperone.health