TherapyTrack, an application of BWH99 LLC
Effective Date: September 17, 2026 | Last Updated: September 17, 2026
TherapyTrack is a personal mental health journaling and tracking application operated by BWH99 LLC, a New York limited liability company (“TherapyTrack,” “we,” “us,” or “our”). This Privacy Policy describes how we collect, use, disclose, and protect information in connection with the TherapyTrack mobile application and any related websites and services (collectively, the “Service”).
TherapyTrack is a self-directed journaling tool. We do not provide therapy, medical advice, diagnosis, or treatment, and use of the Service does not create a provider–patient relationship. Please see our Terms of Use for further detail.
Contact: BWH99 LLC, 1376 Midland ave apt 811. Bronxville NY 10708, info@jointherapytrack.com
This policy applies to all users of the Service. The Service is intended solely for individuals 18 years of age or older who are located in the United States or Canada. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will terminate the account and delete the associated information. If you believe a person under 18 has provided us information, contact us at info@jointherapytrack.com.
We collect only what we need to operate the Service. We do not purchase personal information from data brokers, and we do not collect information about you from other applications or websites.
Account information. Your name, email address, and password credentials. Optionally, information identifying a provider you work with (for example, “therapist,” “life coach,” “nurse practitioner,” or a name you enter yourself).
Journal and tracking content (“Your Content”). This is the core of the Service and consists entirely of information you choose to enter:
Optional demographic and background information. You may voluntarily provide your age, sex, race or ethnicity, city and state or province, how you heard about TherapyTrack, and whether you currently work with a mental health provider. Providing any of this is entirely optional and does not affect your access to any feature. Race or ethnicity and information about whether you work with a provider are sensitive information, and we handle them accordingly. See Section 5 for how this information is used.
Communications. Information you send us when you request support or otherwise contact us.
Crash and diagnostic information. If the app crashes or encounters an error, diagnostic information — device type, operating system and version, application version, and a technical record of what the software was doing at the time — is collected through Firebase Crashlytics to help us fix the problem. We have configured this so that it does not receive your journal content, mood data, assessment responses, or medication records.
We do not use advertising identifiers, cross-app tracking, advertising SDKs, tracking pixels, attribution or install-tracking tools, session replay, or third-party marketing analytics anywhere in the Service or on our website.
Information stored on your device. So that the app works without a connection, copies of your entries are stored locally on your device. These are removed when you delete your account or the app.
Subscription information. If you subscribe, we receive from our subscription management provider a record of your subscription status, plan, renewal dates, and platform transaction identifiers. We never receive your full payment card number; payment is processed by Apple or Google.
We do not collect precise geolocation, contact lists, photo libraries, health data from your device’s health application, or biometric identifiers. Where the Service uses Face ID, Touch ID, or a device passcode to unlock the app, that verification happens entirely on your device by your device’s operating system. We never receive, store, or transmit your fingerprint, facial geometry, or any other biometric identifier.
Much of Your Content constitutes sensitive personal information — information concerning mental health, mental health treatment, and medication — under United States federal and state law and Canadian law.
We collect, use, and disclose this information only as needed to provide the features you have asked for, and only in the ways described in this policy. Where applicable law requires your consent to process sensitive information, we obtain that consent before processing, and you may withdraw it at any time as described in Section 10.
We do not use Your Content to infer characteristics about you for any purpose other than generating the AI Insights you request, and we limit our processing of sensitive information to what is strictly necessary to provide the Service.
| Purpose | Information Used |
|---|---|
| Create and maintain your account; authenticate you | Account information |
| Store, organize, search, and display Your Content back to you | Your Content |
| Convert your spoken session notes into text at your request | Voice recordings (see Section 6) |
| Generate AI Insights at your request | Your Content (see Section 7) |
| Operate, secure, troubleshoot, and improve the Service | Device and diagnostic information; account information |
| Manage your subscription, renewals, and billing status | Subscription information |
| Respond to your support requests | Communications; account information |
| Understand who our users are, in order to improve and grow the Service | Optional demographic and background information, in aggregate statistical form only |
| Comply with law and enforce our Terms of Use | As necessary |
We do not use Your Content, or any information about your mental health, for advertising or marketing of any kind. We do not engage in targeted or cross-context behavioral advertising. We do not profile you for decisions that produce legal or similarly significant effects.
The session notes feature includes an optional voice-to-text function. If you use it, the audio you record is transmitted to Deepgram, Inc., our speech-to-text provider, which converts it to text and returns the text to the app for storage in your journal.
Model training. Every transcription request we send to Deepgram is sent with Deepgram’s model-improvement opt-out enabled. This means your audio and transcripts are not used to train or improve Deepgram’s models, and are not shared by Deepgram with any third party for model evaluation or benchmarking. All requests are routed through a single server-side function that applies this setting; there is no path by which audio leaves the app without it. If you prefer that no audio be transmitted to any third party, you may type your notes instead. The feature is entirely optional.
The AI Insights feature analyzes patterns in Your Content — your mood entries, session notes, and assessment responses — and returns written reflections and suggested topics you may wish to explore.
How it works. When you request an Insight, relevant portions of Your Content are transmitted to Google Cloud Vertex AI, the artificial intelligence service we use for this purpose, which generates the output and returns it to the app. Because Google is also our cloud hosting provider, Your Content is processed within the same provider environment in which it is already stored; generating an Insight does not send Your Content to any additional company.
Training restriction. Under the Google Cloud terms applicable to our account, Google will not use Your Content to train or fine-tune any artificial intelligence or machine learning model without our prior permission. We have not given that permission and will not give it.
Our agreement with Google. We have executed a Business Associate Addendum with Google Cloud covering this project. We did this voluntarily; it holds Google to heightened contractual standards for handling health information even though we are not legally required to meet those standards.
Caching. We do not request or enable caching of content submitted for an Insight.
Safety monitoring by Google — please read this carefully. Google operates automated systems that examine content submitted to Vertex AI in order to detect activity that may violate Google’s acceptable use policies. Where those automated systems flag submitted content, Google may store that content, and Google personnel may review it to determine whether a violation occurred, and Google may contact us about it. Retention for this purpose is governed by Google’s terms rather than ours.
What this means for you. If you submit an entry for an Insight and Google’s automated systems flag it — which is more likely for entries describing difficult subjects such as self-harm, trauma, violence, or substance use — that entry may be stored by Google and read by a person at Google. We are not told when this happens, and we do not see the results.
Where flagged content is held. Content logged for this purpose is stored in the same geographic region we have selected for our project, which is in the United States, and is subject to Google’s access controls and access logging.
We are seeking to end this. We have asked Google to exempt our project from this monitoring. Until Google grants that request, the above applies. If it is granted, we will update this policy and tell you.
Your choice. If you would prefer that your entries never be processed this way, do not turn on AI Insights, or switch it off in Settings. Every other part of the Service works without it, and nothing is sent to Google unless you ask for an Insight.
Before you turn the feature on, the app shows you a short notice summarizing this section, and AI Insights stays off unless you accept it.
Purpose limitation. Your Content is transmitted to Vertex AI only to generate the Insight you requested, and for no other purpose.
We do not use Your Content to train any artificial intelligence model of our own. If that ever changes, we will not do so without first giving you notice and obtaining your separate, affirmative opt-in consent, and you will be able to decline without losing access to the Service.
Limitations. AI Insights are automatically generated, are not reviewed by a clinician, and may be inaccurate or incomplete. They are not therapy, medical advice, diagnosis, treatment, or crisis support. Please read Section 9 of our Terms of Use before relying on them.
Your control over this feature. AI Insights never runs automatically. It runs only when you tap to generate an Insight, and only after you have agreed to a one-time consent notice explaining what the feature does. If you decline that notice, no content is ever transmitted for this purpose.
Turning the feature off. You can disable AI Insights at any time under Settings / Profile → General Settings. While it is off, the feature cannot generate anything and no content is transmitted for this purpose. You can turn it back on later if you choose. Insights already generated remain in your account until you delete them.
We do not sell your personal information. We do not share it for cross-context behavioral advertising or targeted advertising. We do not disclose Your Content to advertisers, data brokers, insurers, employers, or your provider.
We disclose information only as follows.
We use the following providers, each of which is contractually restricted to processing information solely to perform services for us and is prohibited from using it for its own purposes:
| Provider | Function | Information Received |
|---|---|---|
| Google LLC (Cloud Firestore, Firebase Authentication, Cloud Functions) | Cloud hosting, database, and authentication | Account information and Your Content, encrypted in transit and at rest, stored in the United States |
| Google LLC (Firebase Crashlytics) | Crash and error diagnostics | Crash and diagnostic information. Configured not to receive Your Content. |
| Deepgram, Inc. | Voice-to-text transcription | Audio you record using the microphone feature |
| Google LLC (Google Cloud Vertex AI) | AI Insights generation | Portions of Your Content submitted for an Insight |
| RevenueCat, Inc. | Subscription management | A randomly generated account identifier, subscription status, entitlement status, and app store transaction identifiers. Does not receive Your Content, your name, or your email address. |
We may disclose information if we reasonably believe it is required to: comply with applicable law, subpoena, warrant, court order, or other valid legal process; establish, exercise, or defend legal claims; enforce our Terms of Use; or detect, prevent, or address fraud, security, or technical issues.
We will disclose Your Content in response to legal process only to the extent we determine we are legally required to do so, and, where we are permitted to do so by law, we will make reasonable efforts to notify you in advance so that you have an opportunity to object.
If BWH99 LLC is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. Any such recipient will be bound by commitments no less protective than this policy with respect to Your Content, and we will notify you before your information becomes subject to a materially different privacy policy.
You may choose to export or share Your Content — for example, by emailing a summary to a provider or generating a report. Once you share information outside the Service, this policy no longer governs it, and the recipient’s own practices and legal obligations apply. We do not transmit Your Content to any provider on your behalf, and no provider has access to your account.
We produce periodic internal reports about who uses the Service, drawn from the optional information described in Section 3.1. These reports contain aggregate statistics only — for example, the share of users in a given age band, or the number of users in a given state. They do not contain records about individual users, and they do not contain names, email addresses, account identifiers, journal content, or city-level location.
We maintain administrative, technical, and physical safeguards designed to protect your information, including:
No system can be guaranteed completely secure. Please use a strong, unique password, keep your device secured, and contact us immediately at info@jointherapytrack.com if you suspect unauthorized access to your account.
Regardless of where you live, you may:
We do not discriminate against you for exercising any of these rights. We will not deny you the Service, charge you a different price, or provide a different quality of service because you exercised a privacy right.
Use the in-app controls, or email info@jointherapytrack.com with the subject line “Privacy Request.” We will acknowledge your request promptly and respond within 45 days, and may extend once by an additional 45 days where permitted, with notice to you.
To protect your information, we must verify your identity before honoring a request. We will generally do so by confirming control of the email address associated with your account and may request additional information where a request concerns sensitive information. If we cannot verify your identity, we will tell you and explain why.
Authorized agents. You may use an authorized agent to submit a request. We may require written proof of the agent’s authority and may require you to verify your own identity directly.
If you are a resident of a state with a comprehensive consumer privacy law — including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia — you have the rights described in Section 10.1, and in addition, as applicable in your state:
Notice at collection (California). The categories of personal information we collect are: identifiers; commercial information (subscription status); internet or electronic network activity information (in-app diagnostics); and sensitive personal information, consisting of health information and, where you provide it, information about gender identity or sexual orientation. The sources, purposes, and recipients are those described in Sections 3, 5, and 8. We retain this information as described in Section 11. We have not sold or shared personal information in the preceding twelve months, and we do not sell or share the personal information of consumers of any age.
Consumer health data (Washington, Nevada, Connecticut). Please see our separate Consumer Health Data Privacy Policy at https://bwh99.org/pages/consumer-health-data.html, which describes additional rights, including the right to withdraw consent to collection and sharing and the right to have consumer health data deleted.
If you are in Canada, you have the right under PIPEDA and applicable provincial law to access the personal information we hold about you, to request correction of inaccurate information, to be informed of the use and disclosure of your information, and to withdraw consent to our collection, use, or disclosure of it, subject to legal and contractual restrictions and reasonable notice. If you are in Quebec, you additionally have the right to request that we cease disseminating your personal information and to data portability, and you may contact our Privacy Officer at info@jointherapytrack.com.
Storage and processing in the United States. BWH99 LLC is located in the United States, and your information — including Your Content — is stored and processed in the United States by us and by the providers listed in Section 8.1. Information stored in the United States may be accessible to United States courts, law enforcement, and national security authorities under United States law. We use contractual and technical safeguards comparable to those we apply to Canadian data, but you should be aware of this before using the Service.
You may direct a complaint to us at info@jointherapytrack.com, and if you are not satisfied with our response, to the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.
We retain Your Content for as long as your account remains active, because the purpose of the Service is to give you long-term access to your own history.
If you delete your account, the following happens immediately on confirmation: your account record and all of your journal entries, session notes, mood logs, assessments, medications, goals, insights, and provider entries are permanently deleted from our production database; your login credentials are deleted; and the copies stored locally on your device are cleared.
Backups. Our database keeps automated point-in-time recovery snapshots for seven days. Deleted information may persist in those snapshots until they are overwritten, which occurs within seven days of deletion. We do not restore deleted accounts from backups.
What is not deleted. Two things persist after account deletion, and we want to be straightforward about them:
Aggregate statistics that included your information before deletion are not recalculated, because they cannot be traced back to you.
We may retain limited information notwithstanding a deletion request where necessary to comply with a legal obligation, resolve a dispute, enforce our agreements, or maintain security records — and only for as long as that purpose requires.
Inactive accounts. We do not automatically delete inactive accounts. Your information remains available to you until you choose to delete it.
We retain aggregated or de-identified information, which cannot reasonably be used to identify you, for as long as it is useful. We do not attempt to re-identify de-identified information.
TherapyTrack is a health application subject to the FTC Health Breach Notification Rule. If we discover unauthorized acquisition of, or unauthorized disclosure of, your identifiable health information, we will notify you — and, where required, the Federal Trade Commission and the media — without unreasonable delay and in no case later than 60 calendar days after discovery. Notice will describe what happened, the information involved, the steps we are taking, what you can do, and how to reach us. We will also comply with any applicable state data breach notification law and, in Canada, with PIPEDA’s breach reporting requirements.
BWH99 LLC is not a covered entity under the Health Insurance Portability and Accountability Act (“HIPAA”). We are not a health care provider, health plan, or health care clearinghouse, and we do not bill insurance. Information you enter into the Service is therefore generally not protected health information under HIPAA, and HIPAA does not govern it.
This does not mean your information is unprotected. It is protected by this policy, by our contracts with our providers, and by the federal and state and Canadian laws described above.
The Service is not a medical record. It is not a substitute for the records maintained by any provider you work with, and we have no obligation to maintain it as a clinical record. If you need your clinical records, request them from your provider.
The Service may contain links to third-party websites or resources. We do not control those sites and are not responsible for their content or privacy practices. Review their policies before providing information to them.
We may update this policy. If we make a material change — including any change to the categories of information we collect, the purposes for which we use it, or the parties to whom we disclose it — we will notify you within the app and by email before the change takes effect, and, where the change involves a new use or disclosure of sensitive information, we will obtain your consent before applying it to information already collected. The “Last Updated” date above reflects the current version. Prior versions are available on request.
BWH99 LLC / TherapyTrack | 1376 Midland ave apt 811. Bronxville NY 10708 |info@jointherapytrack.com| jointherapytrack.com
If you have a concern we have not resolved, you may contact your state Attorney General, the Federal Trade Commission at reportfraud.ftc.gov, or, in Canada, the Office of the Privacy Commissioner of Canada.