3. How We Use Your Information

We use collected information to:

• Operate, maintain, and improve the Service.

• Train and improve AI models and related wellness features.

  • Thoughtful uses Inputs and Outputs to improve its AI models. This use is a core part of the Service, and by using Thoughtful you agree to this processing. If you do not agree, do not use Thoughtful.

• Monitor usage, ensure security, and detect misuse.

• Personalize recommendations and user experiences.

• Communicate with you about updates, features, and policy changes.

• Comply with legal, contractual, and regulatory obligations.

• Conduct de-identified or aggregated analytics, research, and product development. We will not attempt to re-identify such de-identified data.

AI and Machine Learning. The Service leverages machine learning, large language models, and other artificial intelligence technologies to provide personalized recommendations and other features. When you use AI-powered features, your inputs and interactions may be processed to generate responses and improve the Service. AI-generated content is for informational and educational purposes only and should not be relied upon as medical or mental health advice.

Monitoring. Thoughtful has the right, but not the obligation, to monitor use of the Service and electronic communications transmitted through the Service. We may share content, records, or communications if permitted by law, in response to government requests, to operate the Service, or to protect the rights, property, or safety of Thoughtful, Spring Care, Inc., our users, or others.

Cookies and Tracking Technologies. We may use cookies, pixels, and other tracking technologies, including third-party tracking technologies (collectively, “AdTech”) on our website and app. We use AdTech to collect and perform data analytics, to record how you interact with the Service and our content, and to serve you with targeted advertising. By visiting and using the Service, you consent to our use of AdTech and understand that we may share personal information about you that we collect from the use of AdTech with our AdTech partners.

Cookies. Cookies are pieces of information stored directly on your device. Cookies allow us to collect information such as browser type, time spent on our website or app, pages visited, language preferences, and other anonymous traffic data. We and our service providers use the information for security purposes, to facilitate navigation, to display information more effectively, and to personalize your experience while using the Service and to enhance user engagement. We also use cookies to gather statistical information about use of the Service to continually improve its design and functionality, to understand how it is used, and to answer questions regarding the Service. We may also use cookies for advertising purposes. Among other uses, these cookies limit the number of times you may see our advertisements and help us measure the effectiveness of our outreach campaigns.

Tracking Technologies. Advertising companies and analytics providers that we work with may also place cookies or tracking pixels on our behalf. They may track that you have visited our website or app, and we may share this information with advertising networks (this practice is sometimes referred to as “retargeting”). We, and our analytics and advertising partners, use these technologies in our websites, apps, and online services to collect personal information (such as the pages you visit, the links you click on, and similar usage information, identifiers, and device information) when you use our Services, including personal information about your online activities over time and across different websites or online services. We work with the following advertising networks, and more information about their policies, and how you can customize or opt out of certain types of ads, are available using the links provided:

• Google Ads (https://adssettings.google.com/)

• Meta Ads (https://www.facebook.com/ads/about/?entry_product=ad_preferences)

• Microsoft Ads (https://privacy.microsoft.com/en-us/privacystatement)

• Linkedin Ads (https://www.linkedin.com/help/linkedin/answer/62649/opt-out-of-sponsored-messaging?lang=en)

You can use the opt-out controls offered by the organizations our advertising partners may participate in, which you can access at:

• Network Advertising Initiative (NAI): http://optout.networkadvertising.org

• Digital Advertising Alliance (DAA): http://optout.aboutads.info/

Targeted Advertising. We may use information collected through the Service to deliver targeted advertising to you. You may opt out of targeted advertising by adjusting your settings with the advertising networks we use, using industry opt-out tools such as the Digital Advertising Alliance’s opt-out page at https://optout.aboutads.info, or exercising your state privacy rights as described in the “Privacy Rights” section below.

Do Not Track. Some web browsers may transmit “Do Not Track” signals to websites. We do not currently respond to “Do Not Track” signals or similar mechanisms. However, you may be able to opt out of certain tracking through your browser settings or through industry opt-out tools such as the Digital Advertising Alliance’s opt-out page at https://optout.aboutads.info.

Use of Sensitive Personal Information (SPI)

“Sensitive Personal Information” under California and other state laws may include things like health-related reflections, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, union membership, government ID numbers, or precise location.

• Not Required: You are not required to provide SPI to use Thoughtful. We ask that you avoid submitting such information unless you are comfortable doing so.

• Default Handling: If you provide SPI while using the Service, we will process it only as necessary to deliver the Service to you (for example, to generate responses back to you).

• Optional Consent for Model Training: We will only use SPI for AI model training or product improvement if you have given us separate, explicit consent through a clear opt-in prompt. If you do not consent, your SPI will not be used for model training.

• Withdrawal of Consent: You may withdraw your consent at any time by emailing careteam@thoughtful.com or updating your privacy settings. Withdrawal will apply going forward and will not affect models already trained.

4. Sharing of Information

We may share information:

• With Our Employees, Contractors, Affiliates, and Subsidiaries: Our related entities and subsidiaries in relation to the Service and in accordance with written agreements.

• With Licensed Health Care Providers (Clinical Services). If you choose to access clinical services through the Service, we may share your information with licensed mental health care providers (“Providers”) employed by or contracted with professional entities affiliated with Spring Care, Inc., including SH Medical Care of Kansas, P.A. (on behalf of itself and as agent for SH Medical Care of New Jersey, P.C.; SH Medical Care of California, P.C.; SH Medical Care of Michigan, P.C.; SH Medical Care of Florida, P.A.; and Spring Care of Delaware, Inc.) (collectively, the “Medical Group”). Providers are not employees of Thoughtful or Spring Care, Inc. and have their own privacy practices. If you access clinical services, you may be required to accept separate consent to treatment, privacy practices, and other documents maintained by the Provider. We encourage you to review the Provider’s Notice of Privacy Practices.

• With Service Providers and Vendors: Service Providers and vendors who help us facilitate the Service including providers such as email providers, cloud service providers, marketing analytics services, lawyers, consultants, and advisors on a need-to-know-basis.

• With Research Partners: Academic or industry collaborators, but only with aggregated or de-identified data.

• During Business Transfers: If Thoughtful is involved in activity related to a merger, sale of company assets, financing, acquisition or a similar corporate event. If any such change of ownership happens, we will ensure it is under terms that preserve the confidentiality of personal information, and we will notify you on our website or by email before any transfer of your personal information.

• For Vital Interests, Legal Compliance, and Public Safety:  If required to protect the vital interests of any person, to exercise or defend our legal rights, or to comply with court orders and similar legal or regulatory obligations, or in response to a valid subpoena, court order, warrant, or similar government order, or when we believe in good faith that disclosure is reasonably necessary to protect our property or rights, or those of third parties or the public at large. This may include exchanging personal information with other organizations for the purposes of fraud protection. This may include where we reasonably consider it is in our legitimate interests or the legitimate interests of others to comply, as well as where we are legally required to do so.

We do not sell your personal information.

5. Privacy Rights (U.S. State Laws)

Depending on your state of residence, you may have rights to:

• Confirm whether we collect, share, or sell your personal information.

• Access the personal information we hold about you.

• Request correction or deletion.

• Opt out of the “sale” or targeted advertising involving your personal information.

• Withdraw consent to the collection or sharing of your personal information.

• Limit the use of sensitive personal information (see the “Use of Sensitive Personal Information” section above).

• Be free from discrimination for exercising your privacy rights.

• Appeal a decision regarding your privacy request.

To exercise these rights, contact us at careteam@thoughtful.com or through our designated web form.

State-Specific Privacy Rights

California Residents. If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, use, disclose, and sell; the right to delete personal information; the right to correct inaccurate personal information; the right to limit the use and disclosure of sensitive personal information; and the right to opt out of the sale or sharing of personal information for cross-context behavioral advertising. To exercise these rights, please contact us at careteam@thoughtful.com. We do not discriminate against users who exercise their privacy rights.

California “Shine the Light” Law. Under California Civil Code Section 1798.83, California residents who have an established business relationship with us may request information about whether we have disclosed personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes without your consent.

Under California Civil Code Section 1789.3, California users are entitled to the following specific consumer rights notice: The Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs may be contacted in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (916) 445-1254 or (800) 952-5210.

Verification. To protect your privacy and security, we may take steps to verify your identity before responding to your request. Verification may include confirming your email address, account information, or other identifying information. If we cannot verify your identity, we may be unable to fulfill your request.

Response Timeframe. We will respond to verifiable requests within the timeframes required by applicable law. For California residents, we will respond within 45 days of receiving your request. If we need additional time (up to an additional 45 days), we will notify you of the reason and extension period in writing.

Authorized Agents. You may designate an authorized agent to submit a request on your behalf. To do so, you must provide the authorized agent with written permission to act on your behalf, and we may require you to verify your identity directly with us and confirm that you have authorized the agent to act on your behalf.

Important Notice Regarding HIPAA

THOUGHTFUL AND SPRING CARE, INC. ARE NOT HIPAA COVERED ENTITIES. HEALTH INFORMATION THAT YOU SHARE WITH THOUGHTFUL IS GENERALLY NOT PROTECTED UNDER THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (“HIPAA”). INFORMATION YOU SHARE WITH THOUGHTFUL IS NOT GOVERNED BY DOCTOR-PATIENT PRIVILEGE WHEN IN THOUGHTFUL’S POSSESSION.

If you access clinical services through the Medical Group, the Health Insurance Portability and Accountability Act (“HIPAA”) may apply to your protected health information. In such cases, the Medical Group is the covered entity responsible for compliance with HIPAA, and Spring Care, Inc. may process protected health information as a Business Associate of the Medical Group. Please review the Medical Group’s Notice of Privacy Practices for more information about how your clinical information is collected, used, and protected.

Recording of Clinical Sessions

Clinical sessions conducted through the Service may be recorded by the Provider using video conferencing technology (such as Zoom). You acknowledge and consent to the recording of your clinical sessions. These recordings are not anonymized and may contain your personal and health information. Currently, only the Provider can access recordings of your sessions. However, access to session recordings may expand in the future to include Spring Care, Inc., the Medical Group, or other authorized parties as the Service evolves. You will be notified of any material changes to recording access. By continuing to use clinical services through the Service, you consent to the recording practices described herein. The Provider may also request your verbal consent at the beginning of each recorded session.

6. Data Retention and Deletion

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When no longer needed, information is securely deleted or de-identified in accordance with applicable law.

7. Security

We implement technical and organizational safeguards consistent with industry standards and designed to protect your data including the safeguards listed below. However, no system is 100% secure.

In addition to the security safeguards we provide, we urge you to take precautionary measures in maintaining the integrity of your data. Please be responsible for making sure that no one can see or access your account or log-in/password information, or your mobile device. Please note that push notifications sent through the Service may be visible to anyone with access to your device.

• Encryption in transit and at rest;

• Role-based access controls;

• Secure data centers and monitoring; and

• Employee training on privacy and data handling.

8. Third-Party Services

Thoughtful may integrate or link to third-party services. Those services are governed by their own privacy policies and terms. We are not responsible for their data practices.

9. Children’s Privacy

The Service and its AI chat and wellness tools are intended for adults aged 18 and older. We do not knowingly collect information from children under 18. If you believe we have inadvertently collected such information, please contact us immediately so we can delete it. 

10. Financial Incentives and Loyalty Programs

Thoughtful does not offer a loyalty program or financial incentives in exchange for the collection, retention, or sale of personal information.

We may, from time to time, offer certain customers a Pilot Program to trial our services. The provision of the Pilot Program is not a payment, financial incentive, or price difference in exchange for the collection, retention, sale, or sharing of personal information beyond what is strictly necessary to provide the trial service itself. We collect and use personal information from participants in a Pilot Program as described in Sections 2 and 3 of this Policy.

11. Changes to this Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice on our website, through the Service, or by email. The “Last Updated” date indicates the latest version. Continued use of the Service constitutes acceptance of the revised policy.

12. Contact Us

For privacy questions or requests to exercise your privacy rights, contact us at:
careteam@thoughtful.com or submit a message to us via the Thoughtful app. 

Accessibility

We are committed to ensuring that our Privacy Policy is accessible to all users. If you have difficulty accessing any portion of this Privacy Policy or need this information in an alternative format, please contact us at careteam@thoughtful.com and we will work with you to provide the information in a format that meets your needs.

REMINDER: Thoughtful IS NOT A HEALTHCARE PROVIDER, MEDICAL DEVICE, OR SUBSTITUTE FOR PROFESSIONAL ADVICE. IF YOU NEED HELP, CONTACT A LICENSED PROFESSIONAL OR EMERGENCY SERVICES.