Privacy Policy

At Resiliens, Inc. we respect your privacy and value the trust you have placed in us. We are committed to the responsible management, use, and protection of your information.

Who We Are

Resiliens Inc., San Carlos, California, USA, is the controller of the personal data described in this policy. You can reach us about anything in it at info@resiliens.com.

Health Privacy

Resiliens is committed to maintaining the privacy and security of your protected health information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA). Our platform is designed with privacy as a foundational principle.

We implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of all electronic PHI we create, receive, maintain, or transmit.

Information We Collect

Information You Provide

We collect information you provide directly to us when you create an account, use our services, or communicate with us.

Use of Services: When you use our services, we may collect health information, assessment responses, mood tracking data, journal entries, and other content you provide through the platform.

Communications: When you contact us, we collect information such as your name, email address, and the content of your message.

Information from Healthcare Professionals

If you are connected to a clinician or healthcare organization through our platform, they may provide us with information about you, including treatment plans, clinical notes, and other health-related information, subject to applicable laws and your authorization.

Information Automatically Collected

When you access or use our services, we automatically collect certain information, including device information, log data, usage information, and information collected through cookies, pixel tags, and similar technologies.

How We Use Your Information

We use the information we collect for various purposes, including to provide, maintain, and improve our services.

Internal Usage: We use your information to operate, maintain, and provide the features and functionality of our services, including to process transactions, provide customer support, and enforce our terms.

Communications: We may use your information to send you technical notices, updates, security alerts, and support and administrative messages.

Promotional: We may use your information to send you promotional communications, such as information about products, services, and events offered by us and others. You may opt out of receiving promotional messages at any time.

Aggregate Data: We may de-identify and aggregate information collected through the services for statistical analysis, research, and other lawful purposes.

Legal Bases for Processing (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Running the programs and apps you use and saving your progress (account details, program answers, logs, assessments): to perform our contract with you — and, because this includes health information, your explicit consent.
• Payments, receipts and tax (name, email address, billing address, amount): to perform our contract with you, and our legal obligation to keep tax records.
• Support (email address and your message): to perform our contract with you, and our legitimate interest in helping you.
• Website analytics (Vercel Web Analytics — page views only, no cookies and no identifiers): our legitimate interest in understanding how the site is used.
• The ad measurement cookie (rs_gclid, a Google Ads click ID): your consent, asked in the cookie banner.
• Telling Google Ads that an ad led to a purchase (the click ID, the time and the amount — never who you are or which program): your consent, as above.

How We Disclose Your Information

We do not sell your personal information. We may share information about you as follows or as otherwise described in this Privacy Policy.

We will not disclose your health information without your authorization except as permitted or required by law.

Linked Clinicians: If you link your account to a healthcare professional, we will share relevant health information with that clinician to facilitate your care.

Linked Organizations: If your account is linked to a healthcare organization, relevant information may be shared with authorized personnel within that organization.

Severing a Link: You may sever a link with a clinician or organization at any time through your account settings. Once severed, no further information will be shared, though previously shared information may be retained by the clinician or organization as required by law.

As Required by Law: We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to comply with applicable laws, respond to a court order, judicial or other government subpoena or warrant.

Merger or Acquisition: If we are involved in a merger, acquisition, financing, or sale of business or assets, your information may be transferred as part of that transaction, subject to standard confidentiality arrangements.

Cookies

If you arrive from one of our ads, we may keep the ad's click ID — a random reference from Google — for 90 days, so that we can tell Google Ads whether the ad led to a purchase. Google learns only that, not who you are or which program. Outside the United States we keep it only if you allow it in the cookie banner. In the United States we keep it unless your browser sends a Global Privacy Control signal.

You can change or withdraw your choice at any time with Cookie settings at the bottom of every page; withdrawing deletes the click ID. Our website analytics set no cookies and never record identifiers.

Data Security

We take reasonable measures to help protect your personal information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. We implement industry-standard encryption, access controls, and audit logging to safeguard your data.

How Long We Keep Data

Account and program data: for as long as your account exists, and deleted within 30 days after you delete your account. Payment and tax records: 10 years, where tax law requires us to keep them. Ad conversion records: 100 days. Support messages: 2 years.

Children's Privacy

Our services are not directed to children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete such information. If you believe a child under 13 has provided us with personal information, please contact us at info@resiliens.com. We will promptly investigate and take appropriate action.

International Transfers

We are based in the United States and our services are hosted there. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum for data from the United Kingdom. You can request a copy of these safeguards at info@resiliens.com.

Your Rights and Choices

You have certain rights and choices regarding the personal information we collect and maintain about you, including:

• Access your personal information and request a copy of the data we hold about you.
• Request correction of inaccurate or incomplete personal information.
• Request deletion of your personal information, subject to certain legal exceptions.
• Opt out of promotional communications at any time.
• Request restriction of processing of your personal information in certain circumstances.
• Receive the personal data you gave us in a structured, machine-readable format (portability).
• Object to processing based on our legitimate interests.
• Withdraw your consent at any time, without affecting processing before you withdrew it. Withdrawing consent for health information ends your use of the programs.
• Complain to your local data protection authority — for example, in Germany the authority of your federal state, in France the CNIL, in Spain the AEPD, and in the UK the ICO.

To exercise any of these rights, please contact us at info@resiliens.com.

California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, disclose, and sell, and the right to opt out of the sale of your personal information. We do not sell your personal information. To exercise your California privacy rights, please contact us using the information provided below.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

Posting Changes: Any changes to this Privacy Policy will be posted on this page and, where appropriate, notified to you by email.

New Uses of Data: If we wish to use your personal information for a new purpose not covered by this Privacy Policy, we will provide you with a new notice explaining the new use and, where required, seek your consent before starting the new processing.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

• Email: info@resiliens.com