Privacy policy

Pathway to Recovery is a free, self-directed brain injury recovery program built and run by a solo developer. This policy explains, in plain language, what the app collects, why, and what you can do about it. It covers the app and this website.

What we collect

Only what the app needs to work:

• Account information — your email address and a securely hashed version of your password. We never store your password itself.
• Your recovery profile— whatever you choose to tell us during onboarding or later: your name or nickname, age, what kind of injury you had and roughly when, the symptoms you’re experiencing and how severe they feel, your goals, and your timezone.
• Journal entries — your daily mood, symptoms, brain-health habits, and any notes you write.
• Coach conversations — the messages you send to the AI coach and the replies it sends back.
• Basic usage— which lessons and practices you’ve completed, and your check-in streak, so your plan and progress stay accurate.
• Your provider’s email — only if you enter one in order to send yourself a progress report.

We do not ask for your address, insurance details, government ID, or payment information, because the program is free. The app has no advertising SDKs and no analytics trackers. Our hosting provider (Vercel) keeps standard server logs, which can include your IP address and browser type, for security and reliability.

How your information is used

• To build and adjust your personalized recovery plan.
• To give the AI coach enough context to be genuinely useful — so it remembers what you’re dealing with instead of asking you to repeat yourself.
• To show your progress, streak, and history back to you.
• To send the emails you ask for: account verification, optional daily reminders, and progress reports you choose to send to your care team.
• To keep the service secure and working.

We do not sell your information. We do not share it with advertisers, data brokers, or insurers. We don’t use it for advertising of any kind. Your information is only sent to a third party in the specific, limited ways described in this policy, or if we were ever legally required to.

AI processing (please read)

The coach is powered by OpenAI’s API. When you send a message to the coach, that message is transmitted to OpenAI along with relevant context so the reply makes sense: typically your recovery profile (injury type, symptoms, goals), recent journal entries, your current plan, and the earlier messages in that conversation.

That means real details about your health leave our servers and are processed by OpenAI in order to generate a response. We use OpenAI’s API under terms in which submitted data is not used to train their models, and we never use your data to train any model ourselves. Even so, if there is something you would rather not have processed by an AI service, please don’t put it in the coach chat — and remember the coach is a support tool, not a clinician.

Storage and security

• Your data is stored in a Postgres database hosted by Neon.
• All traffic between your device and our servers is encrypted in transit (HTTPS).
• The app is hosted on Vercel. Neon and Vercel are our infrastructure providers and process data on our behalf.
• Passwords are stored only as bcrypt hashes. Sessions are kept in a signed, HTTP-only cookie — there is no readable copy of your identity sitting in your browser’s storage.
• Emails are delivered by Resend, which sees the recipient address and message.

No system is perfectly secure, and this one is maintained by one person. We take it seriously, but we won’t pretend otherwise.

Your choices

• Share only what you want. Nearly every field is optional. You can use the program with a bare-minimum profile.
• Edit anything. Your profile, symptoms, and goals can be changed from Settings at any time.
• Export or delete your data. Email us and we’ll send you a copy of everything we hold, or delete your account and its contents entirely. Deletion is permanent and removes your journal entries, chat history, and plan.
• Turn off reminders.One toggle in Settings; you’ll still get essential account emails.
• Sign out everywhere. Changing your password invalidates every existing session, on every device.
• Nothing is shared automatically. Progress reports go to your care team only when you enter an address and tap send.

Important limitations

This is not medical advice. Pathway to Recovery is educational and self-management support. It does not diagnose, treat, or replace care from a qualified clinician. The AI coach is not a doctor, therapist, or crisis service.

We are not a HIPAA covered entity. We are not a healthcare provider, health plan, or clearinghouse, so HIPAA does not apply to the information you enter here. It is protected by this policy and by the security practices described above — not by HIPAA. If you would rather your notes live inside your clinician’s medical record, share them with your clinician directly.

Children

The app is intended for adults. We don’t knowingly collect information from children under 13. If a child’s account was created, email us and we will delete it.

Changes to this policy

If this policy changes in a way that meaningfully affects you, we’ll update the date at the top and tell you in the app or by email before the change takes effect.

Contact

Questions, data export requests, deletion requests, or security concerns: support@pathwaytorecovery.app. A real person reads it and will get back to you.