Privacy Policy

1. Who we are

Hestia Mental Health LLC is a California limited liability company doing business as Hestia Family Wellness. You can reach us at privacy@hestiawellness.com for any questions about this policy or how your information is handled.

2. What this policy covers

This policy applies to our website, our iOS application, and all related services we provide. It does not apply to third-party websites, services, or applications that you may access through links in our Service, which have their own privacy practices.

3. Information we collect

3.1 Information you provide as a parent

When you create a parent account and use Hestia, we collect:

• Account information. Your email address, name, and a hashed version of your password. We never store your password in readable form.
• Family configuration. The names and roles of co-parents you invite, and the relationships between members of your family.
• AI coach conversations. The messages you send to and receive from our AI parenting coach, including any context you share about your family.
• Behavior plans and check-ins. The behavior plans you create for your children, daily progress entries, and your own parent check-ins.
• Subscription information. If you subscribe, our payment processor (RevenueCat) records your subscription status. We do not see or store your payment card details.

3.2 Information about your child

You provide information about your child when you set up their profile or assign surveys. This is done with your consent as their parent or legal guardian.

• Profile information. Your child's first name, date of birth, and optionally their gender.
• Survey responses. Your child's answers to mental health screenings and connection surveys you assign them. Surveys are designed by mental health professionals.
• Login credentials. If your child uses the app directly, a hashed password for their account.
• Notes you record. Observations or notes you save about your child, including survey trend summaries.

Children cannot create accounts independently. A parent or legal guardian must add them to a family.

3.3 Information collected automatically

• Device and usage information. When you use the app or visit our website, we collect basic device information such as your device type, operating system version, and approximate IP-based location, along with standard server logs.
• Product analytics. We record anonymized events about how features are used (for example, that a survey was completed) so we can improve the Service. We do not use third-party analytics services that profile users.
• Waitlist signups. If you join our waitlist before launch, we store your email address and which form you used to sign up (for example, the hero or the bottom of the home page).

3.4 Sensitive information

Some information you and your child share with Hestia relates to mental health and wellbeing. We treat this information with extra care. We do not use sensitive personal information for advertising, profiling, or any purpose other than providing the Service you signed up for.

4. How we use information

We use the information described above to:

• Provide and operate the Service, including authenticating you, syncing data across your devices, and routing surveys and behavior plans within your family.
• Generate AI coaching responses tailored to your family, using context such as your past conversations, your child's recent survey results, and active behavior plans. We explain this in more detail below.
• Send service-related emails, such as account confirmations, invites to co-parents, and important changes to the Service.
• Improve the Service by analyzing aggregated usage patterns, fixing bugs, and developing new features.
• Protect the Service and our users from abuse, fraud, and unauthorized access.
• Comply with legal obligations, respond to lawful requests, and enforce our terms.

We do not use your information, or share it with our service providers, for the purpose of training artificial intelligence models. We do not sell your personal information.

5. How we use AI

The AI parenting coach is a feature of the Service available to parents. When you send a message to the coach, we transmit your message along with relevant context to Anthropic, the provider of the underlying AI model. Context may include your previous messages with the coach, your child's recent survey results, active behavior plans, and a summary of trends in your family's data.

Anthropic processes this information solely to generate a response. Under Anthropic's commercial API terms, your information is not used to train Anthropic's models and is not retained beyond what is necessary to provide the response.

The AI coach is designed with clinical guardrails. It does not provide medical advice, does not diagnose conditions, and is not a substitute for a licensed mental health professional. Children do not interact with the AI coach. Only parents do.

6. Children's privacy

Hestia is designed for families with children between the ages of 4 and 17. We collect information about children only at the direction of a parent or legal guardian who has set up their family account and is paying for the Service.

We comply with the Children's Online Privacy Protection Act (COPPA). Where required, we obtain verifiable parental consent before collecting personal information from children under 13. By creating a child profile and subscribing to the Service, you provide that consent and confirm that you are the parent or legal guardian of the child.

As the parent, you have the right at any time to:

• Review the personal information we have collected about your child.
• Request that we delete your child's personal information.
• Refuse to permit further collection or use of your child's information.

You can do all of the above by emailing us at privacy@hestiawellness.com or, in most cases, directly from the app.

When a child reaches the age of majority in their jurisdiction, additional privacy controls may become available to them. These features are described in the Service and are subject to change.

7. How information is shared

We share information with a small number of service providers who help us operate the Service, and only as needed for them to perform their function.

• Supabase. Our database and authentication provider. They store your data on our behalf in the United States and are bound by their own privacy and security commitments.
• Anthropic. Our AI provider, used solely to generate AI coach responses as described above.
• Resend. Our transactional email provider, used to send account-related emails and invites.
• RevenueCat. Our subscription management provider, used to handle subscription state and receipts. Apple processes the actual payment when you subscribe through the App Store.

We may also disclose information if we are required to by law, if we believe disclosure is necessary to protect the safety of a person, or in connection with a merger, acquisition, or sale of all or part of our business. In the event of a business transfer, we will require the recipient to honor this Privacy Policy.

We do not sell or share your personal information with third parties for their own marketing, advertising, profiling, or AI training purposes.

8. How we protect information

We use reasonable technical and organizational measures to protect your information. These include encryption in transit using HTTPS and TLS, encryption at rest provided by our database provider, role-based access controls that limit who at Hestia can view family data, and regular review of who has access to our systems.

No security measures are perfect. We cannot guarantee that information will never be accessed by an unauthorized party, but we will work continuously to keep your family's information safe.

9. How long we keep information

We retain your information for as long as your account is active and for as long as needed to provide the Service to you. When you delete your account, or request deletion of specific information, we will permanently delete or de-identify that information within 30 days, except where we are required by law to retain it longer or where retention is necessary to resolve disputes or enforce our agreements.

10. Your rights

Regardless of where you live, you can request to:

• Access the information we hold about you and your family.
• Correct information that is inaccurate.
• Delete your account and the information associated with it.
• Receive a copy of your information in a portable format.
• Opt out of non-essential emails. We will continue to send service-related emails as long as you have an active account.

To exercise any of these rights, email us at privacy@hestiawellness.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

11. California residents

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), provides you with additional rights regarding your personal information. Many of these mirror the rights described in the previous section.

11.1 Categories of personal information we collect

In the 12 months prior to the date of this policy, we have collected the following categories of personal information from California residents:

• Identifiers. Name, email address, account identifiers.
• Customer records. Family configuration, profile information.
• Internet activity. Information about your interactions with the Service.
• Geolocation data. Approximate location derived from IP address.
• Sensitive personal information. Information related to mental health, used solely to provide the Service.
• Inferences. Aggregated trends drawn from survey responses, used to inform your AI coach experience.

11.2 Sources, purposes, and recipients

We collect this information directly from you, automatically through your use of the Service, and from our service providers acting on our behalf. We use it for the purposes described in Section 4. We disclose it only to the service providers described in Section 7.

11.3 Sale and sharing

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not done so in the past 12 months.

11.4 California rights

You have the right to request that we disclose what personal information we collect about you, request deletion of your information, request correction, and limit the use of sensitive personal information. You can exercise these rights by emailing privacy@hestiawellness.com. You can also designate an authorized agent to make requests on your behalf. We do not discriminate against you for exercising these rights.

12. Other state privacy laws

If you reside in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, you may have similar rights to those described above. Contact us at privacy@hestiawellness.com to exercise them.

13. International users

Hestia is operated from the United States and intended for users in the United States. Information you provide is stored and processed in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

14. Children outside the home

Hestia is not directed at the general public of children, and we do not knowingly collect information from any child unless a parent or legal guardian has set up the child's profile within a family account they control. If you believe a child has been added to Hestia without authorization from their parent or legal guardian, contact us immediately at privacy@hestiawellness.com and we will investigate.

15. Changes to this policy

We may update this Privacy Policy from time to time as the Service evolves or as the law requires. When we make material changes, we will notify you by email or through the Service, and we will update the “Last updated” date at the top of this page. Your continued use of the Service after a change becomes effective means you accept the updated policy.

This policy may be revised before Hestia launches publicly. Material changes made prior to launch will be reflected here.

16. Contact us

For privacy questions, requests, or concerns:

privacy@hestiawellness.com

Hestia Mental Health LLC
State of California, United States