Rebuilding ThoughtsBehavioral Health

Privacy Notice

Rebuilding Thoughts is organized under the laws of State of Florida, United States. Questions about this notice can be sent to privacy@rebuildingthoughts.com.

What we collect

  • Account & identity

    Creating and securing your account.

    Retention: For as long as your account is active, plus 30 days.

    Never sent to our AI vendor · Visible to your organization

  • Reflections & Guide conversations

    Matching you to an evidence-based practice.

    Retention: 90 days, then permanently deleted.

    Sent to our AI vendor · Never visible to your organization

  • Voice recordings

    Enabling voice input to the Guide, transcribed then discarded.

    Retention: Deleted immediately after transcription.

    Sent to our AI vendor · Never visible to your organization

  • Practice activity

    Tracking which practices you've completed.

    Retention: For as long as your account is active.

    Never sent to our AI vendor · Never visible to your organization

  • Unconfirmed suggestions

    An AI-drafted interpretation you haven't yet confirmed.

    Retention: Deleted if not confirmed within 24 hours.

    Sent to our AI vendor · Never visible to your organization

  • Session bookings

    Scheduling and running your coaching sessions.

    Retention: For as long as your account is active, plus 1 year for billing records.

    Never sent to our AI vendor · Never visible to your organization

  • De-identified usage counts

    Group-level reporting for your organization (for example, engagement rate).

    Retention: Retained in aggregate indefinitely; never traceable back to an individual.

    Never sent to our AI vendor · Visible to your organization

  • Support messages

    Responding to a question you send our support team.

    Retention: 2 years.

    Never sent to our AI vendor · Never visible to your organization

Your rights

  • See what we hold about you
  • Correct it
  • Delete it
  • Take it with you (export)
  • Withdraw consent
  • Complain

What we do not claim

  • We are not a HIPAA covered entity.
  • We do not hold SOC 2, ISO 27001, or any other third-party security certification today.
  • We do not claim our encryption meets any specific government security standard.
  • We do not offer a legally binding Business Associate Agreement.
  • We do not guarantee uninterrupted service availability.

Open questions we’re answering in public

  • Whether our AI vendor retains conversation data for model training, or only for abuse monitoring.
  • The exact retention window our AI vendor applies to data it processes on our behalf.
  • Whether a future sub-processor will require updating this page before it goes live.
  • The long-term retention policy for de-identified usage counts beyond the current calendar year.
  • Whether voice recordings will ever be retained beyond transcription for quality review.