Notice of Privacy Practices

Our responsibilities

We are required by law to maintain the privacy and security of your PHI. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information. We must follow the duties described in this notice, and we may change its terms at any time. The revised notice will apply to all PHI we already hold.

Your health information rights

• Withdraw consent to share your information with a provider at any time by disconnecting them in Settings.
• Delete your account and the associated information at any time from Settings.

How we use and disclose your information

We use and share your information only as described in this notice, and only with your consent:

• Meal Logging Coordination: When you invite a provider by email and they accept, we share your meal logs — including photos, notes, mood, and completion — with them to support your recovery. Access continues only while your connection stays active.
• Account operations: We use your email and display name to operate your account, send password resets, and deliver meal reminders you have enabled.
• Audit & oversight: We record each time a provider views or reacts to your meal logs so that an administrator can review access to your data.

When we may use or share without your permission

In limited circumstances we may use or disclose your PHI without your written authorization, including:

• As required by law, or to comply with a court order or legal process.

Any other use or disclosure not described in this notice will be made only with your written authorization. You may revoke that authorization at any time.

Safeguards

• All information requires authentication to access; access is restricted by role and by your active provider connections.
• Meal photos are stored privately and served through time-limited links that expire shortly after viewing — they are never made public.
• Each provider's access to your meal logs is recorded in an audit log.
• Sessions time out after a period of inactivity to protect your account on a shared device.

Breach notification

If a breach of unsecured PHI occurs that affects you, we will notify you promptly in writing, no later than 60 days after discovery, in accordance with applicable law. The notice will describe what happened, what information was involved, what we are doing, and what you can do to protect yourself.

Data retention

We keep your information only for as long as needed to provide the service and meet our legal obligations. You can delete your account at any time from Settings, which permanently removes your meal logs, photos, connections, and related records. Audit logs are retained to maintain an accurate record of who accessed your data.

Not a medical service

CosignRecovery is a supportive tool and is not a replacement for medical care or mental health treatment. It does not provide diagnosis, treatment, or emergency services. If you are in crisis, contact a licensed professional or call 988 (Suicide & Crisis Lifeline).

Changes to this notice

We may update this notice from time to time. The current version will always be available in the app, and the effective date above will reflect the most recent change.

Questions

If you have questions about this notice, you may contact us at hello@cosignrecovery.com.