Privacy Policy – Whole Brother Mission

For purposes of this Policy and unless otherwise specified, “data” includes information that is linked to one person or household including things like name, email address, phone numbers, device ID, Third Party identifiers, and contact information. Some jurisdictions might consider this to be “personal data,” “personally identifiable information,” or “sensitive personal data” in certain circumstances. When you use and access our app or website, you accept and agree to both the Terms and Conditions and this Privacy Policy, including that we’ll share certain data with Service Providers.

Do you collect, store, or Process my data?

In this Policy, we refer generally to activities done with data as “Processing” or “Process.” Examples of Processing include collecting, storing, and using data.

The categories of data which we Process are listed below. We Process this data to do things like operate our website and make sure you are able to use our services effectively. We may also Process data to send you periodic emails or text messages. In some cases, these communications are to help provide services. Other times, they are to provide marketing communications. You can opt out of receiving texts or marketing communications at any time. Additionally, provided you opt in, we may Process and share some data with third parties for advertising purposes. You can find more details in the relevant sections of this Policy.

What specific data are you Processing and why do you collect it?

What data we Process depends on how you’re using our website. We explain in the section below the specific data we collect and Process and, in the section following this, the business purpose for collecting and Processing this data.

As highlighted in the table below, we collect and Process “Therapy Data“, which includes health and treatment information that is required to facilitate therapy.

You can find information on how long we store the data we collect and Process these categories of data in the “How long do you retain my data and how do I request data erasure?” section of this Privacy Policy.

“Visitor data”

When you visit the website, we Process information like the particular pages visited or which features you interacted with, the amount of time on the website, site errors, information about the type of device and browser you’re using, and IP address. We may Process IP address, hashed email address, and (if available based on the settings of your device) and will share the information with Third Parties, if you opt in to Advertising (previously “Targeting cookies”) and web beacons.

“Onboarding data”

To create an account with the Platform, the user first fills out a questionnaire. We Process the information used to complete this questionnaire.

“Account data”

Once a user creates an account with the Platform, we Process data such as the account name the user selects, and other demographic and contact information, such as email, age, phone number, emergency contact details, and whether a user verifies their email address.

“Transaction Data”

We Process data about payment transactions on the Platform such as whether a user completed payment for our services, signed up for services using a trial offer, canceled or ended a trial, received a discount or financial aid, or received any extensions or refunds. We also process whether a visitor has registered to create an account.

“Engagement Data”

We Process usage data about how you interact with emails we send and different features when you’re logged into our website. For emails we send, we collect usage data including whether you receive an email, open it, and click any links it contains. When you log onto the website, we also collect usage data about activity conducted during that logged in session such as when a user logs in, the login timing, number and duration of live session scheduled or conducted. This category does not include Therapy Data like the content of any messages sent or received by users or the content of any live sessions.

“Customer Service and Communications Data”

We Process communications users have with our Customer Service team.

“Therapist Data”

In order to engage with Therapists who express an interest in working with us (such as individuals who provide information at in-person or online recruitment events), follow up with Therapists who applied to work with us on the status of their applications, to identify, match, credential, re-credential, run checks, issue 1099s and pay Therapists, we process Therapist information such as the Therapist’s name, bank account information, gender, date of birth, governmental identification numbers (SSN/FEIN), e-mail address, phone number, address, NPI number (if applicable), license information, CAQH number (if applicable), and areas of interest/expertise, education, and job history.

“Clinical Health Record”

We Process “Clinical Health Record” which is a record with the minimum information your therapist would need to identify you and document the services you received. This Record includes your therapist’s internal notes, dates you received services, and the following specific subsets of Onboarding, Account, and Therapy data:

“Onboarding data”: Onboarding Questionnaire Answers
“Account data”: Account name the user selects, phone number (if one is provided), email address, emergency contact details
“Therapy data”: Dates of service, messages with therapist, worksheets, journal entries that are shared with therapist, therapist’s internal notes

What collected data is used for:

Connecting you with therapy services
Communicating with you
Personalizing your web experience
Helping us understand how you use our services, how we can improve our products and services to make them more effective and convenient, and offer you new features
Complying with laws
Protect your safety and the safety of others
Send opportunities, promotions, news, updates and reminders about our services and your account

Do you Process location data?

We process your IP address to determine your rough location so that we can personalize your experience. For example, we show you relevant information about our service that applies to visitors from your country.

We also utilize your rough location to improve your user experience when using our website. For example we auto populate your state (if applicable) and country when you are completing our onboarding questionnaire.

We do not request or process exact location information such as information provided by your phone via GPS.

We Process your address information when you provide it through form submissions. Your contact information is required to comply with therapy regulations and ethical code. It can be used, for example, in case your Therapist believes you are in immediate danger. When you are filing out this field, we may process your rough location to provide autocomplete suggestions for your convenience.

Rough location using your IP address is also Processed by the ReCAPTCHA security API tool we use. ReCAPTCHA is a Service Provider we use to identify potentially malicious actors trying to access our site. Here is the ReCAPTCHA Privacy Policy and Terms of Service.

How do we use Artificial Intelligence?

We use Artificial Intelligence (AI) and Natural Language Understanding (NLU) algorithms to support and develop features to provide you services and improve the quality of the services. Our processing of data may include some automated and some human (or manual) methods of processing. The automated processing typically includes features aimed at completing manual, repetitive tasks more efficiently. For example, we may use AI features to detect security risks, synthesize information for customer service agents, and help therapists manage and document sessions more effectively. We expect these improvements to ultimately improve our services and experiences for Members and Therapists. To help ensure these tools remain fair and accurate, as well as protect the privacy of our Members and Therapists, we either thoroughly review a model or build it internally and do not use any Therapy Data, such as sessions data, journal entries, messages, worksheets, or any other type of private communication you have with your Therapist in a session to train an AI or NLU model.

What are the purposes for sharing my data?

Here’s some more information about the purposes for which we share your data:

Your data may be shared to comply with applicable laws. For example, a court might subpoena information from us where we would be required to share certain information requested in the subpoena. This is not unique to Whole Brother Mission and is applicable to in-person therapy as well. Keep in mind that, as a general rule, we defer to your chosen Therapist to decide to produce (or not produce) any psychotherapy notes or messages you have had with them. Many jurisdictions have strict rules governing Therapist/client relationships and the confidentiality requirements associated with that. We encourage you to discuss with your Therapist early on if you have concerns about their disclosure obligations.
We may share certain data with that provide limited services that help us operate the Platform. Examples include:
- Data hosting and storage providers: For example, cloud hosting providers such as Amazon Web Services (AWS).
- Technology Service Providers: For example, we sometimes integrate tools into our Platform which give our Platform more functionality, like technology that helps us provide live audio, video and group meetings.
- Customer Service Providers: For example, we use a tool that helps keep track of requests and questions from our Members, visitors and Therapists in a secure way. Email management and communication Service Providers: For example, we may use a tool that makes reaching out to you easier for us and more convenient for you.
- Billing and payment processing Service Providers: For example, we use Stripe to help process payments in a secure way. Stripe also assists us in paying Therapists and issuing tax documents to them. For this purpose, we may share email addresses of Therapists with Stripe and other data that is needed to pay Therapists such as a Therapist’s name and tax ID.
- Reporting and analytics Service Providers: For example, we might use a service to help us keep track of which pages and features are most used on our site.
- Advisors and lawyers: To assist with business matters.
- We may share some of your data with Service Providers to ensure the safety and security of the Platform and that of our users.
If you’re a Therapist on our Platform, or being recruited to join us, in addition to the above, we may share certain data with Therapist recruiters in order to facilitate, monitor, and track the recruitment process.
For Members who receive services in connection with an employer, organization, or other business partner, we may share group-level usage data, which cannot be directly connected to you, with your organization. In the instance of Members who receive services through an Employee Assistance Program (“EAP”), your EAP will provide notice for any individual-level data which is shared with the EAP, if you are utilizing one and have provided them with consent for us to do so. If you have any questions on how your data will be used by or shared with your EAP, please reach out to your EAP directly.
We may share some of your data in connection with an asset sale, merger or bankruptcy.

Note that if you make any information publicly available on our website, such as with a public post, anyone may see and use such information.

If you opt in to Analytics, we may use analytics cookies from trusted Service Providers to Process data for activities including but not limited to analyzing traffic sources, visits, and site interactions. This analysis helps us to improve our products and services.

If you opt in to Advertising and web beacons, information regarding your activity on our websites, excluding activity when you’re logged in and have started therapy, may be shared for advertising purposes.

How do you use my data to comply with the law?

When required by law, we cooperate with government agencies. This is not unique to Whole Brother Mission and is applicable to in-person therapy as well. For example, a court might subpoena information from us where we would be required to share certain information requested in the subpoena. Keep in mind that, as a general rule, we defer to your chosen Therapist to decide to produce (or not produce) any psychotherapy notes or messages you have had with them. Many jurisdictions have strict rules governing Therapist/client relationships and the confidentiality requirements associated with that. We encourage you to discuss with your Therapist early on if you have concerns about their disclosure obligations.

You should also be aware that Therapists may be obliged to disclose information to authorities to meet professional and legal responsibilities. Specifically, some laws require mental health professionals to disclose information and/or take action for: (a) reported or suspected abuse; (b) serious suicidal potential; (c) threatened harm; and (d) court-ordered treatment. You should speak with your Therapist if you have concerns about this.

Do you sell my data?

We aren’t paid by anyone for any data. However, in California, the laws define “sale” broadly to include the sharing of personal information in exchange for anything of value. If you opt in to our use of Advertising cookies and web beacons, this use may be considered a “sale” of personal information under that specific California law. For specific information on your data rights as a resident of California, see the additional notice for California residents.

Are you using my data for advertising?

In order to reach people who may be looking for mental health support, we advertise on some web properties such as Third Party websites and apps. In order to minimize advertising costs related to this process and downstream costs to you, we strive to deliver ads that are relevant, interesting, and personal.

Therefore, if you opt in to Advertising cookies and web beacons, some Visitor Data, excluding activity when you’re logged in and have started therapy, may be shared for advertising purposes. As a result, you may see ads for our services on some Third Party websites.

To be clear, we don’t share any data or information you share with your Therapist with any Third Party advertisers. Even if you opt in to Advertising cookies and web beacons, we still don’t share information with Third Party advertisers like Member names, addresses, phone numbers, clinician diagnosis, questionnaires answers, sessions data, journal entries, messages, worksheets, or any other type of private communication you have with your Therapist.

How long do you retain my data and how do I request data erasure?

Whole Brother Mission is committed to ensuring that all applicable Member data is retained only for the amount of time required to provide relevant products and services and in accordance with relevant legal requirements.

Certain categories of data are retained for a period of time after you cancel your Membership or your Membership becomes inactive. These categories of data are retained to allow for a seamless reactivation in the event you begin using our services again and allow Therapists to reference historical information. Retaining this data is also needed to ensure our products and services function.

Exercising Your Data Protection Rights:

As stated, you have certain rights under data protection laws, including the right to request that we erase personal data we hold about you, and the right to request a copy of it. The following sections describe how you can exercise those rights.

Requesting Data Erasure:

To request data erasure, you can directly contact us at info@wholebrothermission.com and we will assist you with the process.

We will only comply with a request for the erasure of your data if we can verify your identity. There is usually no charge. In exceptional circumstances, we may charge a reasonable fee after discussing the fee with you.

We have specific requirements that must be met in order for us to process your data erasure request.

Requirements:

Only you or your authorized representative may make a request on your behalf. You may also make a request on behalf of your minor child depending on the applicable laws.
You must provide sufficient information that allows us to reasonably verify your identity or status as an authorized representative.
You must provide details that allow us to understand, evaluate, and respond to your request.

In some circumstances, legal or regulatory requirements limit our ability to honor erasure requests. As such, we may decline requests for erasure if the information is:

Subject to a litigation hold or legal request to preserve it.
Necessary to comply with laws and regulations and to maintain business integrity.
- Clinical Health Record (described above) falls under this exemption.

Additionally, compliance obligations require us to retain records documenting certain interactions you have with us related to your Membership. As such, we cannot honor erasure requests for information contained in records of:

Communications about complaints and erasure or access requests.
Disclosures of personal data to Third Parties.

If we don’t intend to comply with a request, then we will tell you why this is the case, and outline how we weighed your rights and freedoms against our legal obligations. In such instances, any information retained will only be used for purposes contemplated under the legally recognized exemption.

Requesting a copy of my data

To receive a summary copy of your data, you can directly contact us at info@wholebrothermission.com and we will assist you with the process. The data you will receive as part of this request includes the contact information that you input on the site, questionnaire answers, and other personal information.

Additional data which we maintain includes email interactions with our help desk, which is stored on your email system. You may also request this information by writing to info@wholebrothermission.com. As with data erasure, we are not always able to respect your request for data access. For more information on why this may be and how the situation will be handled, please reference the previous section.

What is a cookie or web beacon?

A “cookie“ is a small data file that is accessible within a folder on a computer, and it is used for record-keeping purposes. Cookies are used to enhance performance of the website, personalize your experience and can be used for Third Party tracking (as described above). For example, cookies may be used to help you quickly log into certain platforms and websites without having to enter your credentials every time.

A “web beacon“ or “pixel” is a tiny and sometimes invisible image or embedded code, placed on a web page or email that can report your visit or use to a Third Party (as described above). In general, these tools can be used to monitor the activity of users for the purpose of web analytics, advertising optimization, or page tagging.

What are you using cookies and web beacons for?

We use our own, and Third Party cookies and web beacons to deliver a faster and safer experience, to monitor and analyze usage, to comply with laws, and for advertising purposes.

How can I stop receiving direct marketing emails from you?

You can always opt out of receiving marketing emails. In order to opt out, you can select the unsubscribe link located at the bottom of the relevant email communication.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Additional privacy notices for California, UK, GDPR, and non-US/UK/EU residents

Additional Privacy Notice for California Residents

This Privacy Notice for California Residents supplements the Whole Brother Mission Privacy Policy to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act (“CPRA”) of 2020.

The CCPA and the CPRA are California laws that provide its residents with certain rights over information about them, including notice about the categories of personal information we have collected from them in the preceding twelve (12) months and the purposes for which the information is used or disclosed, and correction of personal information.

The following Sections outline the data that is by us, as well as the purpose for collection, and the categories of sources of such information:

What specific data are you Processing?
Do you Process location data?
Why do you collect and Process my data?
What are you using cookies and web beacons for?

The data referenced in those sections may fall in certain defined categories under the CCPA and CPRA. Accordingly, we may have collected:

Identifiers;
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e));
Protected classification characteristics under California or federal law;
Commercial information;
Biometric information;
Internet or other similar network activity;
Geolocation data;
Sensory data;
Sensitive Personal Information;
Professional or employment-related information; and
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

The information that we have disclosed in the past 12 months and the recipients of the information are described above, in the section titled “What are the purposes for sharing my data?” The information that we may have shared in the past 12 months falls into the following personal information categories under the CCPA and CPRA:

Identifiers;
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e));
Protected classification characteristics under California or federal law;
Commercial information;
Internet or other similar network activity;
Geolocation data;
Sensory data;
Sensitive Personal Information; and
Professional or employment-related information;
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).

As noted in the Section titled “Do you sell my data?”, our “sale” of information (including sale of information about consumers under the age of 16) consists of the disclosure of your information for targeted advertising purposes, and we aren’t paid by any external or Third Party for any data. The information that we may have “sold” (for purposes of the CCPA and CPRA) in the past 12 months falls into the following personal information categories under the CCPA and CPRA:

Identifiers;
Commercial information; and
Internet or other similar network activity.

Do I have the right to know what information you have about me?

Yes, as a California resident you can request certain information about what we have Processed over the past 12 months. Once we receive and verify your consumer request, we can provide:

The categories of personal information we collected about you.
The categories of sources for the personal information we collected about you.
Our business or commercial purpose for collecting that personal information.
The categories of Third Parties with whom we shared that personal information.
The specific pieces of personal information we collected about you.
Whether we disclosed your personal information for a business purpose and the personal information categories that each category of recipient obtained.

We will verify your identity by matching the information you provide with information that we maintain about you or via biometrics (specifically, FaceID via iOS). You also have the right to request that we correct personal information about you if it is found to be inaccurate. To make such a request, please send an email to info@wholebrothermission.com.

Can I “opt out” or request that you delete my information?

Yes, you can request that we delete your data as described in the section of this Policy called: “How long do you retain my data and how do I request data erasure?” Once your request is received and verified by matching the information you provide with information that we maintain about you or via biometrics, we’ll move forward with the Process of deleting your information in line with our legal requirements and Retention Policy. We cannot fulfill a deletion request and need to retain your information if the data is necessary to:

Provide you services, take actions reasonably anticipated within the context of our ongoing business relationship, or otherwise perform our contract with you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Comply with applicable laws, including but not limited to, the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.) and information covered by the California Confidentiality of Medical Information Act.
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

As noted above, you do not need to opt in to the “sale” of personal information about you by withdrawing your consent to accept cookies used for advertising. Our websites are also designed to implement a do-not-sell privacy preference.

Other California privacy rights

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits California residents to request certain information regarding our disclosure of personal information to Third Parties for direct marketing purposes. To make such a request, please send an email to info@wholebrothermission.com.

General Data Protection Regulation (GDPR) and UK General Data Protection Regulation Notice

This section provides additional information about our Policy relevant to you if you are from the European Economic Area (the EEA), United Kingdom, and Switzerland (together “European Area Countries”). It supplements and should be read in conjunction with the rest of the Policy. Under the European Area Countries’ privacy laws, we are the Controller with respect to your data.

When is my data used?

When it is in our legitimate interests or an external third party’s legitimate interests (“legitimate interest” is a term defined by the General Data Protection Regulation (GDPR) and UK General Data Protection Regulation Notice). Our legitimate interests in this instance include managing the website, safety and security of the infrastructure, prevention of fraud, research, and development, and management of contracts and legal claims.
When it is needed for the provision of the website. In particular, for product development and internal analytics purposes, and otherwise to improve the safety, security, and performance of the website. We only rely on our or an external third party’s legitimate interests to Process your data when these interests are not overridden by your rights and interests.
When it is necessary to do so to comply with any legal obligations imposed upon us under our contractual obligations or our contractual obligation or applicable law.
In rare instances, when it is a medical emergency, we may use your data to protect your or another’s vital interests if consent is not a reasonable option.
When you have consented to the use of your data, for marketing purposes or through the use of cookies and web beacons. Where consent is the legal basis, you have the right to withdraw your consent at any time.

What Lawful Basis for Sensitive Data is Used in the UK and EEA?

Whole Brother Mission may also collect and Process certain categories of personal information, which may be considered “sensitive personal information” in the UK and EEA. The lawful basis for this Processing are (1) health and social care, (2) our establishment, exercise, or defense of a right or legal obligation, (3) substantial public interest, and (4) consent. Where consent is the legal basis, you have the right to withdraw your consent at any time. Sensitive personal information that we Process includes your racial or ethnic origin, religious or philosophical beliefs, and data concerning your health or about your sex life or sexual orientation.

When you begin to use our services and register your account, we ask you to provide answers to a questionnaire to customize the service, to match you with a Therapist, and to provide therapy and related services to you. In providing your responses to the questionnaire you may provide us with “sensitive personal Information” as described above. You may also continue to share such data with us as you receive services. This data is necessary as it allows us to continue providing services to you and customize our services for you. It is also necessary to provide healthcare with a personalized and well-selected Therapist based on points of data which impact your therapy and health care needs. The Therapist also reviews this data and can choose to not work with you if they are not a good fit. We may also use this information to improve our service and understand how you interact with the services.

How we obtain your personal information

Whole Brother Mission obtains the categories of personal information listed above from the following sources:

Directly from you, such as information when you apply to be a counselor or that you submit during the Process of using and paying for our Services.
Indirectly from you, such as through your actions on our website.
From external business partners, such as social media sites, ad networks, and analytics providers.

What are my rights and choices under European Area Countries laws?

European Area Country residents have specific rights regarding their data. This section describes your rights if you are resident in the European Area Countries and explains how to exercise those rights.

Subject access request: You may be entitled to ask us for a copy of any data which we hold. We will normally send you a copy within one month of your request. However, that period may be extended by two additional months where necessary, taking into account the complexity of the request or the difficulty in accessing the data that you request. There is usually no charge. In exceptional circumstances, we may charge a reasonable fee after discussing the fee with you.
Right to rectification: If the data we hold about you is inaccurate, you may request rectification. The data will be checked, and, where appropriate, inaccuracies will be rectified.
Right to erasure: In certain circumstances, you may be entitled to ask us to erase your data.
Right to data portability: In certain circumstances, you may wish to move, copy, or transfer the electronic data that we hold about you to another organization.
Right to object: You may object to your data being used for direct marketing. You may object to the continued use of your data in any circumstances where we rely upon consent as the legal basis for Processing it. Where we rely upon legitimate interests as the legal basis for Processing your data, you may object to us continuing to Process your data, but you must give us specific reasons for objecting. We will consider the reasons you provide, but if we consider that there are compelling legitimate grounds for us to continue to Process your data, we may continue to do so. In that event, we will let you know the reasons for our decision. In some instances, objecting to certain Processing may impact our ability to provide you with services.
Rights related to automated decision-making including profiling: We use limited data to operate the Platform and to carry out certain profiling activities to support and grow our business. When doing so, we rely upon our legitimate interests as the lawful basis for Processing your data, and you may exercise the above rights if you do not wish us to Process your data in this way.

To exercise the rights in relation to your data set out in this section, please contact us at info@wholebrothermission.com.

Is my data transferred internationally?

As a part of our standard business practices, we may transfer your data to organizations based in countries that have not been granted an adequacy decision under the General Data Protection Regulation. Where data is transferred to such countries, we shall ensure that specific safeguards or derogations have been established.

These might include where the data transfer is necessary in order to fulfill a contract between us and yourself, where we have received your specific consent after having made you aware of any risks involved, or where contracts are in place between us and the Third-Parties involved that ensure the recipient organization has a suitable standard of data protection in place.

You can contact us with questions about this Policy or about your data by writing to:

Whole Brother Mission

PO Box 1423
Guasti, CA 91743

info@wholebrothermission.com

wholebrothermission.com

While we’ll always work with you to resolve any concerns you have about the use of your data, under GDPR you have the right to lodge a complaint with the supervisory authority in your country of residence if you have any concerns about our use of your personal information.

Additional Privacy Notice for non-US, non-UK, and non-EU residents

As a part of our standard business practices, data is transferred outside of many visitors’ countries of residence and predominantly used, accessed and processed within the U.S. Fortunately, given the robust and rigorous nature of privacy laws in the US, UK, and EU with which we comply, Whole Brother Mission considers that this has the effect of protecting user information in a way that, overall, is at least substantially similar or in many ways exceeds non-US data privacy legal requirements. To the extent we contract with vendors who are outside of the U.S, we ensure that specific safeguards have been established to protect that data.