Privacy Policy

1. Who We Are

Generational Health ("we," "us," "our") provides a HIPAA-compliant mental health platform — a mobile app and website at generationalh.com — that connects users with an AI Companion, licensed providers, peer supporters, and crisis specialists. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

2. Information We Collect

We collect: (a) account information (name, email, date of birth, phone); (b) demographic and health information you choose to share; (c) insurance information used to verify coverage via pVerify; (d) clinical information (notes, prescriptions, journal entries, AI Companion conversations); (e) consent records via DocuSign; (f) device, log, and usage data (IP, device identifiers, app interactions); (g) payment information for donations (handled by our payment processor — we do not store full card numbers); and (h) any content you provide through forms or messages.

3. How We Use Information

We use information to: (a) provide and improve the Services; (b) verify insurance and process billing; (c) facilitate clinical care, prescriptions, and consent; (d) personalize the AI Companion experience; (e) protect the safety of users and the public; (f) comply with legal and regulatory obligations; and (g) communicate with you about your account, care, and (with your consent) updates from us. We do not sell Protected Health Information.

4. HIPAA & Protected Health Information

We comply with the Health Insurance Portability and Accountability Act (HIPAA). Protected Health Information (PHI) is handled in accordance with our Notice of Privacy Practices and applicable Business Associate Agreements with our vendors. PHI is encrypted in transit and at rest, access is logged, and we apply role-based access controls. Our integrated vendors (pVerify, DoseSpot, Drug Bank, DocuSign) operate under signed BAAs.

5. AI Companion Conversations

Conversations with the AI Companion are stored as part of your record. They may be reviewed by clinical staff for: (a) safety triage (e.g., risk of harm to self or others); (b) quality improvement; and (c) training of clinically supervised models. We do not use your identifiable conversations to train third-party AI models. You can request export or deletion of your conversation history at any time, subject to applicable record-retention laws.

6. Children's Privacy & Minors

We require users to be at least 13 years old. For users under 18, we obtain parental or guardian consent (or verified emancipated-minor self-consent) through DocuSign before collecting health information. We do not knowingly collect data from children under 13 without verifiable parental consent. Parents may review, request deletion, or refuse further collection of their minor child's information by contacting privacy@generationalh.com.

7. How We Share Information

We share information with: (a) your providers and care team to deliver care; (b) integrated vendors (pVerify, DoseSpot, Drug Bank, DocuSign, our payment processor) under BAA or contract; (c) regulators, law enforcement, or courts when required by law or to prevent imminent harm; (d) service providers (cloud hosting, security) under written agreement; and (e) successors in the event of a merger or acquisition (with notice). We do not sell personal information.

8. Your Rights

Depending on your state, you may have the right to: (a) access the personal information we hold about you; (b) correct inaccurate information; (c) request deletion (subject to record-retention requirements for medical records); (d) restrict or object to certain processing; (e) data portability; and (f) opt out of marketing communications at any time. To exercise these rights, email privacy@generationalh.com. We will verify your identity before responding.

9. Data Retention

We retain account and clinical data for as long as required by HIPAA and applicable state record-retention laws (typically 7 years from the last interaction, longer for minors). Donation records are retained for IRS-compliance periods. After the retention period, data is securely deleted or de-identified.

10. Security

We use industry-standard administrative, technical, and physical safeguards — including encryption, access controls, audit logging, and continuous monitoring. No system is 100% secure; if we discover a breach involving your information, we will notify you as required by HIPAA and state breach-notification laws.

11. Cookies & Analytics

Our website uses cookies and similar technologies for authentication, security, and (with your consent where required) analytics. You can manage cookie preferences in your browser. We do not use third-party advertising trackers on pages that handle PHI.

12. Text Messaging (SMS)

We send text messages only to individuals — including patients and on-call clinical staff — who have opted in to receive them. Categories of messages include account and security messages (such as verification codes) and care- and safety-related notifications (such as crisis alerts to on-call staff).

• Message frequency varies based on your activity and role.
• Message and data rates may apply.
• We do not sell or share mobile numbers or SMS opt-in consent with third parties or affiliates for their own marketing purposes. Phone numbers are used only to deliver the messages you have opted into, via our messaging provider.
• You can opt out at any time by replying STOP, and get help by replying HELP. Opting out of a text program does not opt you out of other channels (such as email) or of messages required to provide the Services.

13. International Users

The Services are intended for users in the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data-protection laws than your country.

14. App-Store Disclosures

When you download our app from the Apple App Store or Google Play, the platform may collect limited information (e.g., download events, crash logs) consistent with their own privacy policies. Our in-app data collection is described in this Policy and the in-app Privacy Labels / Data Safety form on each store.

15. Changes to This Policy

We may update this Privacy Policy. Material changes will be posted with an updated effective date and, where appropriate, notified through the app or by email. Your continued use of the Services after changes take effect constitutes acceptance.

16. Contact Us

Questions about this Privacy Policy or your information? Email privacy@generationalh.com, or write to: Generational Health, Privacy Officer, Charlotte, NC. For HIPAA-specific concerns, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.