TherapyTrack, an application of BWH99 LLC
Effective Date: September 17, 2026 | Last Updated: September 17, 2026
BWH99 LLC, a New York limited liability company, doing business as TherapyTrack (“we,” “us,” “our”). We operate the TherapyTrack mobile application, a personal mental health journaling and tracking tool.
1376 Midland Ave Apt 811, Bronxville NY 10708 | info@jointherapytrack.com
We have no affiliates that receive consumer health data.
We collect the following categories of consumer health data, in each case only because you enter it or request a feature that requires it:
| Category of Consumer Health Data | Why We Collect It / How We Use It |
|---|---|
| Mental health journal entries and session notes, including personal reflections, goals, and observations you record | To store your entries, display them back to you, and make them searchable by you. Used to generate AI Insights only when you request an Insight. |
| Mood check-in data (up to three entries per day) | To display your mood history and patterns to you over time. Used to generate AI Insights only when you request an Insight. |
| Mental health assessment responses and scores | To record your responses, calculate and display a non-diagnostic score, and show you your score history. Used to generate AI Insights only when you request an Insight. |
| Medication information, including medication names and start and end dates | To maintain the medication history you have chosen to record and display it back to you. |
| Voice recordings of session notes | To convert your spoken notes to text at your request. The recording is used for transcription only. |
| AI-generated Insights about your mental health patterns | To provide you the reflections and suggested topics you requested. |
| Information identifying a mental health provider you work with, where you choose to enter it | To let you organize and search your entries by provider. |
| Whether you currently work with a mental health provider, where you choose to tell us | To let you organize your entries, and for internal reporting on who uses the Service, in aggregate statistical form only. |
| Optional self-reported demographic and background information (age, sex, race or ethnicity, city and state, how you heard about us) | For internal reporting on who uses the Service, in aggregate statistical form only. We do not use this to infer anything about your health status. |
| The fact that you use TherapyTrack, including your account and email address | To create and maintain your account, authenticate you, provide support, and manage your subscription. |
We do not use consumer health data for advertising or marketing of any kind. We do not use it for targeted advertising, and we do not profile you for decisions that produce legal or similarly significant effects.
We collect consumer health data from the following sources only:
We do not obtain consumer health data from any other source. We do not purchase it from data brokers, receive it from advertising networks or analytics platforms, obtain it from other applications or websites, infer it from your device activity, or receive it from any provider, insurer, employer, or other third party.
We share consumer health data only with the service providers listed below, and only to the extent necessary for each to perform the specific function described. Each is engaged under a written agreement that appoints it as our processor and requires it to process data on our instructions.
We do not share consumer health data with any advertiser, data broker, marketing platform, social media platform, insurer, employer, or mental health provider.
The limitations that apply to each provider, and the circumstances in which a provider may retain data, are described below. We have set them out specifically rather than generally, because the restrictions are not identical across providers.
| Recipient | Consumer Health Data Shared | Purpose |
|---|---|---|
| Google LLC (Firestore, Cloud Storage, and related covered services) | Consumer health data stored in your account | Cloud hosting and database. Encrypted in transit and at rest. See Section 4.1. |
| Google LLC (Google Cloud Vertex AI) | The portions of your journal entries, mood data, and assessment responses submitted when you request an Insight | Generating AI Insights at your request. See Section 4.1. |
| Deepgram, Inc. | Voice recordings of session notes, and the resulting transcript | Speech-to-text transcription at your request. See Section 4.2. |
| RevenueCat, Inc. | A randomly generated account identifier, subscription and entitlement status, and app store transaction identifiers, which together indicate that you hold a subscription to a mental health application. RevenueCat does not receive your journal entries, mood data, assessment responses, medication records, audio, name, or email address. | Subscription management. See Section 4.3. |
| Google LLC (Firebase Crashlytics) | None intended. Crashlytics receives crash and device diagnostics, configured to exclude your journal content, mood data, assessments, and medication records. | Diagnosing crashes and errors. |
Under the Google Cloud terms applicable to our account, Google will not use your data to train or fine-tune any artificial intelligence or machine learning model without our prior permission. We have not given that permission and will not give it.
Google processes your data on our instructions to provide the services we have engaged it to provide. We do not request or enable caching of content submitted to generate an Insight.
Safety monitoring. Google operates automated systems that examine content submitted for an Insight in order to detect activity that may violate Google’s acceptable use policies. Where those systems flag submitted content, Google may store it and Google personnel may review it, and Google may contact us about it. Content logged for this purpose is stored in the region we have selected for our project, in the United States, and is subject to Google’s access controls. Retention for this purpose is governed by Google’s terms. We have asked Google to exempt our project from this monitoring; until that request is granted, the above applies.
Before you turn AI Insights on, the app shows you a notice summarizing this, and the feature stays off unless you accept it.
If you would prefer that your entries never be processed this way, switch AI Insights off under Settings, or simply do not use the feature. Nothing is sent for an Insight unless you ask for one.
Google may also process data as necessary to secure its services, to detect abuse of its platform, and to comply with law. These are Google’s obligations as an infrastructure provider and apply to all of its customers.
Every transcription request we send to Deepgram carries Deepgram’s model-improvement opt-out. Your audio and transcripts are therefore not used to train or improve Deepgram’s models and are not shared by Deepgram with any third party for model evaluation or benchmarking. All requests are routed through a single server-side function that applies this setting, so there is no path by which audio reaches Deepgram without it.
These protections depend on our configuration, and we monitor it. If our configuration were to change, we would update this policy and notify you before the change took effect.
If you would prefer that no audio be transmitted to any third party, you can type your session notes instead of dictating them. The voice feature is entirely optional.
RevenueCat receives a randomly generated account identifier, your subscription and entitlement status, and app store transaction identifiers. It does not receive your journal content, mood data, assessment responses, medication records, audio, name, or email address. Because subscription status to this application indicates that you use a mental health service, we treat it as consumer health data and disclose it here.
We have not enabled RevenueCat’s benchmarking feature, and your data is not pooled with that of other companies for comparative reporting.
RevenueCat processes this information only as our processor and on our instructions, under a data processing addendum that forms part of our agreement with it.
We may also disclose consumer health data where we are legally required to do so — in response to a subpoena, warrant, court order, or other valid legal process, or to establish or defend legal claims. Where the law permits, we will make reasonable efforts to notify you first.
We do not sell consumer health data, and we will not. We do not exchange it for money or for any other valuable consideration.
If that ever changes, we will not sell any consumer health data without first obtaining your valid written authorization, separate from your consent to collection and sharing, containing all elements required by RCW 19.373.030 and applicable Nevada law, and revocable by you at any time.
Collection. We collect consumer health data only after you have consented, or, where consent is not required, only to the extent necessary to provide a product or service you have requested.
Sharing. We obtain your separate consent before sharing consumer health data with a processor for a purpose beyond providing the specific feature you requested. Your consent to collection is not treated as consent to sharing.
How consent works. Consent requests are presented clearly and separately, describe the specific data and specific purpose involved, and are not bundled with our Terms of Use or general Privacy Policy. We do not use dark patterns, and declining consent will not deny you access to the Service except where the feature cannot function without it.
Withdrawal. You may withdraw your consent at any time (see Section 7). Withdrawal applies going forward and does not affect processing that already occurred lawfully.
AI Insights consent. The AI Insights feature runs only when you ask for it, and only after a one-time consent notice. If you decline, no content is transmitted for that purpose. You may withdraw this consent at any time by switching AI Insights off under Settings / Profile → General Settings. While it is off, no consumer health data is transmitted for that purpose.
You have the right to:
Verification. We must verify your identity before acting on a request. We will normally do so by confirming that you control the email address on your account. If we cannot verify you, we will tell you why.
Timing. We will respond within 45 days. We may extend once by an additional 45 days where reasonably necessary, and will tell you if we do.
What deletion means. On a deletion request, we permanently delete your consumer health data from our production database, delete your login credentials, and clear the copies held on your device. Our database retains point-in-time recovery snapshots for seven days, and deleted data may persist in those snapshots until they are overwritten, which occurs within that period.
One exception. Deleting your account signs you out of RevenueCat, our subscription provider, but does not remove the subscription transaction record it holds. That record contains a random identifier and your subscription history, and does not contain your name, email address, or any journal, mood, assessment, or medication content.
We may retain a minimal record of the deletion request itself in order to demonstrate compliance, as the law requires.
Appeals. If we deny your request, our response will explain why and how to appeal. To appeal, reply to that response or email info@jointherapytrack.com with the subject line “Consumer Health Data Appeal.” We will respond to an appeal within 45 days. If we deny the appeal, we will provide you a mechanism to contact your state Attorney General.
We do not use geofencing. We do not use any technology that establishes a virtual boundary around any health care facility, mental health provider’s office, pharmacy, or similar location, and we do not collect precise geolocation data at all.
Access to consumer health data within our organization is limited to those personnel and contractors for whom access is necessary to operate the Service, provide support you have requested, or investigate a security incident. Each is bound by confidentiality obligations. We maintain and review access logs.
We will not collect, use, or share consumer health data for a purpose not disclosed in this policy without first obtaining your consent. If we make a material change to this policy, we will notify you within the app and by email before the change takes effect.
BWH99 LLC / TherapyTrack | 1376 Midland ave apt 811. Bronxville NY 10708 |info@jointherapytrack.com| jointherapytrack.com
Washington residents may also contact the Washington State Attorney General. Nevada residents may contact the Nevada Attorney General’s Bureau of Consumer Protection. Connecticut residents may contact the Connecticut Attorney General.