Privacy notice
This explains what we collect, why we collect it, who else can see it, and what you can ask us to do about it. We have written it to be read, not to protect us.
Effective 29 August 2026. Version legal-1.0.0. Written by the Rebuilding Thoughts team. It is not independently certified and is not legal advice.
The short version
Your reflections belong to you. Your employer or programme never sees what you write. Your Guide is software, and what you write is sent to an AI provider so it can reply. Nobody reads your entries as they happen, so this is not a crisis service.
Who we are
Rebuilding Thoughts is a company registered in the State of Florida, United States. We are the controller of the personal data described here, except where an employer or government programme has bought access for you, in which case we act as their processor for the account and usage records and remain the controller of your private reflections.
Privacy contact: privacy@rebuildingthoughts.com. Postal address on request from privacy@rebuildingthoughts.com.
We are not a medical provider
Rebuilding Thoughts is a self help and coaching platform. It is not medical care, it does not diagnose and it does not prescribe. We are not a HIPAA covered entity, so the health information rules that apply to a clinic do not apply to us. We still treat what you write as sensitive, because it is.
Sessions you book with a licensed therapist are delivered by that practitioner under their own professional and regulatory obligations.
What we collect and why
| What | Why | How long |
|---|---|---|
| Account and identityEmail address, name if you give one, sign in method, role. | To create your account, sign you in, and keep it secure. | While your account exists. Removed when you ask us to delete it. |
| Your reflections and Guide conversationsWhat you type or dictate to your Guide, your first experience answers, and the meanings you confirm.Sent to an AI provider | So your Guide can recognise patterns you have described and suggest a next step that fits. | Kept until you delete it. Free text from your first experience is reduced to structure and the original prose is no longer needed after that. |
| Voice recordings for dictationThe short audio clip captured when you press the microphone.Sent to an AI provider | To turn your speech into editable text in the box you were typing in. | The clip is sent for transcription and is not stored in our database. Only the text you keep is saved. |
| Practice activityWhich practices you opened, completed or left, and whether you said they helped. | To stop suggesting what has not helped you and to describe your rhythm back to you. | Kept while your account exists so pattern recognition keeps working. |
| Unconfirmed suggestionsA possible pattern your Guide has noticed but you have not agreed to yet.Sent to an AI provider | So we can ask you whether it fits before treating it as true. | Expires automatically if you do not confirm it. |
| Session bookingsAppointment time, practitioner, and the fact a session happened. | To book and run sessions with a coach or therapist. | Kept as a business record. Booking data also exists in our scheduling provider's system. |
| De-identified usage countsHow many people in an organisation used the platform in a month. | So an employer or programme can see that their investment is used, without seeing who did what. | Kept as a business record. |
| Messages you send usEnquiry forms, replies to our emails, feedback you submit. | To answer you and to improve the service. | Kept as a business record until no longer needed. |
What we never collect or store
There is no field anywhere in our system for a diagnosis, a disorder, a cause of what you are experiencing, a personality or attachment assessment, or a structured trauma history. Those columns do not exist, which is how the rule is enforced rather than promised.
What your employer or programme can see
If your access was bought by an employer, health plan or government programme, they can see de-identified counts such as how many people used the platform in a month and how many sessions were delivered. They cannot see what you wrote, which practices you did, whether you booked a session, or anything that identifies you as an individual user of the Guide.
We will not build a report that lets a buyer identify an individual's content, and we will not agree to a contract term that asks for one.
Legal bases, if you are in the UK, EU or a similar regime
- Contract. Running your account, delivering practices, and booking sessions.
- Consent. Collecting your reflections and voice, and using AI to respond to them. You give this separately before your first experience and can withdraw it.
- Legitimate interests. Keeping the platform secure, preventing abuse, and producing de-identified usage counts.
- Legal obligation. Keeping financial and business records.
Reflections about your wellbeing are treated as special category or consumer health data. We rely on your explicit consent for them and do not use them for advertising, profiling for third parties, or selling. We do not sell personal data, and we do not share it for cross context behavioural advertising.
Where your data is processed
All processing described here happens in the United States. If you are outside the United States, using the platform means your data is transferred there. We do not offer data residency in another region today and we will not claim to.
Your choices and rights
- See what we hold. Your patterns view shows your stated facts and confirmed meanings. Ask us for the rest.
- Correct it. Anything your Guide has understood about you can be corrected or withdrawn by you.
- Delete it. You can delete your reflections and confirmed meanings. Deleted items stop being used for any future suggestion.
- Take it with you. Ask us for a copy of your data in a portable format.
- Withdraw consent. You can stop using the Guide, turn voice off, or close your account. None of that removes a legal record we must keep.
- Complain. Contact us first. If you are in the UK or EU you may also complain to your national data protection authority.
To use any of these, email privacy@rebuildingthoughts.com. We will not make the service worse for you because you asked.
Children
The platform is for adults. You must be at least 18, or the minimum age of digital consent where you live, to hold an account.
What we do not claim
- We are not a HIPAA covered entity and this platform is not a substitute for medical care.
- We do not hold SOC 2, ISO 27001, or any independent security certification today.
- We do not describe ourselves as GDPR, HIPAA or PCI certified.
- We do not claim that anyone monitors your entries as you write them. Nobody does.
- We do not claim your data stays in your own country.
Questions we have not answered yet
We would rather show the gaps than fill them with reassuring wording. These are open and being chased.
- How long our AI gateway retains prompts and outputs.Awaiting written confirmation from the vendor.
- Whether any model provider in the chain uses our prompts to train models.Awaiting written confirmation. Until we have it we do not claim that your entries are never used for training.
- The exact country where each model call is processed.Awaiting written confirmation. Assume the United States today.
- Independent security certification such as SOC 2 for our own platform.Not held. Formal assessment is planned and will be published here when complete.
- Data residency in the EU, UK or elsewhere outside the United States.Not available today. All processing described here happens in the United States.
Changes
When this notice changes materially we update the version and effective date at the top, and we tell members inside the platform rather than relying on you to check.