Introduction
This policy covers the Cartha Recovery app, its program-support services, and the Recovery information website (the “Services”). It is specific to Recovery: the separate Cartha AI Wellness and Cartha Community products have their own features and privacy notices. Signing into a shared Cartha account does not merge their private content with Recovery.
You control whether to connect to a program and whether to send a check-in or help request. We do not sell Recovery personal information or use private Recovery content for targeted advertising. Recovery does not use private reflections to train AI models or generate program-facing scores.
Consumer Health Data Privacy Notice
A recovery check-in, selected concern, request for support, or membership in a recovery program can reveal sensitive health information. We collect this information directly from you when you choose program-connected features, and receive response and request-status information from the support team. We use it to provide the member-approved support workflow, not to diagnose you or infer a clinical risk score.
Reading this policy or opening the app is not, by itself, consent to send health information to a program. The app presents the program connection and the exact information and recipient for each send. You may decline, disconnect, or ask for access or deletion using the contact details below. Disconnecting does not erase information already received by a program.
Information we collect and why
When you use program-connected features, we process a pseudonymous member identifier, program membership, consent choices, and the check-ins or help requests you explicitly review and send. These may include health-related recovery information, your selected concern, a request for follow-up, and request status and timestamps. We use this information to route your request to the named support team and show its response.
If you choose to sign in with an existing Cartha account, we process the account identifier and optional name or email provided through that sign-in to verify your identity and link your Recovery session. Shared sign-in does not grant a program access to your separate Cartha or AI Wellness content.
Private reflections and device storage
Private reflection drafts and personal check-ins are not uploaded to a program or attached automatically to a request. Depending on your app version, drafts remain on the current screen or are saved locally on your device. Locally saved content stays until you remove it or clear the app's local data. You can use the private space without joining a program.
Who receives information
The program support recipient shown in the review step receives only the check-in or request you approve for that recipient, together with the identifiers and status information needed to respond. We do not give programs private reflections, AI Wellness conversations, inferred topics, or engagement scores.
Service providers process information needed to operate the service, including cloud hosting and, when you choose it, sign-in services. Network requests expose technical information such as an IP address and browser or device request information to the services delivering them. We use HTTPS to protect information in transit. No transmission or storage method can guarantee absolute security.
Data usage and protection
We use Recovery information to establish and authenticate your session, maintain the program connection and consent record, deliver the specific support request you approve, display replies and follow-up status, respond to privacy or support requests, and protect the service against misuse. We keep program access separate from private reflection content.
Where a version offers reminders or notifications, the operating system may ask permission. Device notification registration information is used to deliver notifications; private reflection or detailed health content should not be included in a notification. You can change notification permissions in device settings.
Legal disclosures and business changes
We may disclose information where required by applicable law or valid legal process, or as necessary to protect legal rights and the security of the Services. If information is transferred as part of a merger, acquisition, or other business transfer, it remains subject to applicable privacy protections. These provisions do not authorize routine program access to private reflections or automatic clinical monitoring.
Website analytics
The information website uses PostHog for page views, link interactions, and page engagement. Its analytics code stores a random visitor identifier in browser local storage and sends page paths, referring domain, language, and device category. It does not read form values or private Recovery reflections. The website analytics code respects the browser's Do Not Track setting. Hosting providers may use cookies and technical request information for security and delivery. Website analytics are distinct from the program check-ins you choose to send.
Retention and deletion requests
Leaving a program or revoking a connection stops future sharing; it is not the same as deleting requests already sent. A program may retain the check-ins and requests it already received under its own retention obligations. Ask the named program contact about those records.
To request access, correction, export, or deletion of Recovery information held by Cartha, email support@cartha.com with the subject “Cartha Recovery privacy request.” Include only the information needed to identify your account or membership; do not email private reflections or detailed health information. We may need to verify your identity and clarify which records and program are involved. We will explain any records that must be retained for applicable legal or security requirements. Deleting Recovery information does not delete a separate Cartha account or AI Wellness data.
Retention
Device-only drafts and saved entries follow the local-storage behavior described above. Server-side membership, consent, and sent-request records support the program connection and its response history; leaving a program changes access and future sharing but does not automatically purge those records. Contact us to request deletion and the applicable retention details for your records. We will identify any applicable legal or security reason that prevents immediate removal rather than promise that leaving a program deletes all history.
Your choices
Program membership, each reviewed send, continued alumni connection, and revocation are separate choices. Declining to send keeps the draft private. A previously sent request cannot be made private again simply by leaving the program. Review the named recipient and response expectations before sending.
U.S. state privacy rights and international users
Depending on your location and applicable law, you may have rights to access or obtain a copy of your personal and health information, correct it, request deletion, withdraw consent, or appeal a decision on your privacy request. Contact support@cartha.com and identify your request as relating to Cartha Recovery. We will handle requests under the law that applies to you and may verify your identity before releasing records.
Recovery uses cloud services in the United States. If you access the Services from another country, information you submit may be processed in the United States, where privacy laws may differ. Applicable legal protections and restrictions still apply.
Security incidents
If a security incident requires notification, we will notify affected people and authorities as required by applicable law. Do not send sensitive recovery content in ordinary support email; we can help identify an appropriate way to handle a records request.
Children and product limits
Recovery is not intended for anyone under 18. Contact us if you believe a child has provided information. Recovery is support-coordination and self-help software, not medical care, clinical monitoring, or an emergency service.
Changes and privacy contact
We will update this page and its date when this policy changes. Material changes will be communicated as required by applicable law. Privacy questions and requests should be sent to Cartha AI, Inc. at support@cartha.com, specifying “Cartha Recovery.” Mailing address: Cartha AI, Inc., 1820 S Bentley Ave, Los Angeles, CA 90025.
