When does our Privacy Policy apply?

This Privacy Policy describes the types of information we may collect from you when:

• You visit or use our Platform, including our Website and/or Software;
• We communicate in e-mail, text message, and other electronic messages between you and us;
• You upload, record, or process therapy sessions through our Platform; and
• You interact with our bot or AI-powered features.

When does our Privacy Policy not apply?

This Privacy Policy does not apply to information collected by any other website operated either by us or by a third party, unless the website is listed above or links to this Privacy Policy. It also does not apply to any website that we may provide a link to or that is accessible from our Platform. Our Platform is powered and operated by Evolve Labs, Inc.

Our Privacy Policy and Terms of Use.

This Privacy Policy is incorporated into our Terms of Use, which also applies when you use our Platform.

What is Personal Information?

Personal information is information from and about you that may directly or indirectly identify you. We treat any information that may identify you as personal information. For example, your name and e-mail address are personal information.

Which types of Personal Information do we collect?

We may collect and use the following personal information (hereinafter referred to as "Personal Information"):

Specific Types of Personal Information Collected:

• Personal Identifiers

Categories of Personal Information

Information that identifies, relates to, describes, or is capable of being associated with a particular individual name, username or online identifier, physical characteristics or description, shipping address, telephone number, credit card number, debit card number, or any other financial information, health or medical information.

Characteristics of protected classifications under federal law:

1. Race, Color, Medical Conditions, Age, Gender/Sex, National origin, or Disability
2. Internet or other electronic network activity information
3. IP address, device mode, device ID, OS version, device language, operating system, browser type, browsing history, search history, and information regarding a consumer's interaction with an Internet Web site, application, or advertisement.
4. Geolocation data
5. Physical location or movements, local time, and local time zone.

Session Recordings and Transcripts

We collect and process audio recordings and transcripts of therapy sessions that you provide to us when using our Platform. This includes sessions recorded through our recorder when invited to a calendar event, or sessions directly uploaded to our Platform. These recordings and transcripts may contain sensitive personal and health information.

How we handle session recordings and transcripts:

• All recordings and transcripts are encrypted both at rest and in transit.
• Recordings and transcripts are kept for as long as your account is active, unless you delete them sooner. When you delete a session or your account, the recording, transcript, notes, and everything derived from them are removed from our live systems immediately, and copies in our backups expire within 30 days. Our sub-processors delete their transient copies within the periods listed on our sub-processor page.
• Recordings and transcripts are analyzed using our AI processing pipeline to generate reports and insights. Every partner that handles this information is bound by a written contract, including a HIPAA Business Associate Agreement where applicable, and none of them may use it to train artificial intelligence or machine learning models.
• Access to recordings and transcripts within our company is restricted and monitored.
• Your recordings and transcripts may be accessed where necessary to provide Services or when you explicitly authorize the use of session data for research and development purposes.
• We may create de-identified data from recordings, transcripts, and notes by removing the identifiers listed in the HIPAA safe harbor standard (45 C.F.R. § 164.514(b)(2)) and any other information that could reasonably identify you or your clients, and use that de-identified data for research, evaluation, and improvement of the Platform. We do not attempt to re-identify it, and identifiable session content is never used to train AI models unless you donate the session.

Health Information

When combined with health information, some Personal Information we collect may constitute protected health information under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Evolve Labs operates under HIPAA regulations and strictly enforces HIPAA requirements with partnerships through Business Associate Agreements (BAAs).

For Practitioner-Users who are covered entities under HIPAA, we offer a Business Associate Agreement that can be accessed at https://app.partscompanion.org/onboarding/practitioner/baa. For Practitioner-Users in the United Kingdom, the European Economic Area, Switzerland, or Australia, we offer a Data Processing Addendum that can be read at app.partscompanion.org/legal/dpa and signed at app.partscompanion.org/practitioner/dpa.

We collect, use, and disclose protected health information for the purposes of providing the Services and we only collect the minimum amount necessary to fully perform and provide the Services on our Platform. Protected health information will not be used for any other purpose without your consent.

How do we collect your Personal Information?

We collect most of this Personal Information directly from you. For example, when we speak to you by phone, text message, and e-mail. Additionally, we will collect information from you when you visit our Website, submit forms, contact us, use our Software, or purchase our Services.

We may also collect Personal Information:

• Through recordings of therapy sessions when you invite our recorder or through direct uploads.
• When you make payments through the Platform. We do not collect or store financial account information, though we may receive transaction identifiers and summary information that does not include credit card or bank account numbers.
• When You Contact Us. When you contact Evolve Labs directly, such as when you contact our Customer Support team, we will receive the contents of your message or any attachments you may send to us, as well as any additional information you choose to provide.
• When you use our Platform anonymously (without creating an account), we collect identifiable information, such as IP address, through the use of cookies and for the purpose of maintaining your session for up to 30 days.

We will also collect information automatically as you navigate through our Platform. We use the following technologies and third-party services to automatically collect data:

• Cookies.

  We and our service providers may use cookies, web beacons, and other technologies to receive and store certain types of information whenever you interact with our Platform or Services through your computer or mobile device. A "cookie" is a small file or piece of data sent from a website and stored on the hard drive of your computer or mobile device. Some of the cookies we use are "session" cookies, meaning that they are automatically deleted from your hard drive after you close your browser at the end of your session. Session cookies are used to optimize performance of the Website and to limit the amount of redundant data that is downloaded during a single session. We also may use "persistent" cookies, which remain on your computer or device unless deleted by you (or by your browser settings). We may use persistent cookies for various purposes, such as statistical analysis of performance to ensure the ongoing quality of our Platform and/or the Services. We and third parties may use session and persistent cookies for analytics and advertising purposes, as described herein. On your computer, you may refuse to accept browser cookies by activating the appropriate setting on your browser, and you may have similar capabilities on your mobile device in the preferences for your operating system or browser. However, if you select this setting you may be unable to access or use certain parts of our Platform or the Services. Unless you have adjusted your browser or operating system setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Platform.

• Facebook Pixel and Instagram.

  We use Facebook Pixel and Meta's Conversions API, provided by Meta Platforms, Inc. ("Meta"), to measure the effectiveness of advertisements we run for Parts Companion on Facebook, Instagram, and other Meta platforms. We do not display third-party advertisements within our Platform. When you interact with our Platform, Meta may receive limited conversion data (such as that a signup or registration occurred) along with a hashed (anonymized) identifier. No session content, therapy data, or protected health information is ever shared with Meta. This data is processed in accordance with Meta's Data Policy, which can be found at https://www.facebook.com/about/privacy/. You can manage your ad preferences on Facebook by visiting your Facebook ad settings.

• Recall.ai.

  We use Recall.ai, a meeting recording and transcription service provided by Recall.ai, Inc. ("Recall.ai") to record, transcribe, and analyze audio data from user sessions when permission is granted. Recall.ai processes audio recordings and may extract text, metadata, and other information from these recordings. This information is used to provide our services and improve user experience. For more information on how Recall.ai handles your data, please visit their Privacy Policy at https://www.recall.ai/legal/privacy-policy.

• Typeform.

  We use Typeform, a form-building and survey platform provided by Typeform S.L. ("Typeform") to collect information and feedback from users. When you complete a form or survey created with Typeform, the information you provide is collected and processed by both us and Typeform. This may include your responses, metadata about how you interacted with the form, and technical information such as IP address and browser type. For more information about how Typeform handles your data, please visit their Privacy Policy at https://admin.typeform.com/to/dwk6gt.

• Anthropic.

  We use Anthropic's AI services to process therapy transcripts, analyze sessions for IFS concepts and create content forms for the report. When you use our Platform, your session transcripts may be processed by Anthropic's AI models to identify patterns, extract insights, and generate content for your reports. For more information about how Anthropic handles your data, please visit their Privacy Policy at https://www.anthropic.com/privacy.

• OpenAI.

  We use OpenAI's services to process therapy transcripts, analyze sessions for IFS concepts and create content forms for the report. Your session data may be processed by OpenAI's models to generate insights and structured content for your therapy reports. For more information about how OpenAI handles your data, please visit their Privacy Policy at https://openai.com/policies/privacy-policy.

• Supabase.

  We use Supabase, a database service provider, to store and manage data on our Platform. Your account information, session data, and other content you create on our Platform may be stored in Supabase's secure databases. For more information about how Supabase handles your data, please visit their Privacy Policy at https://supabase.com/privacy.

• Azure.

  We use Microsoft Azure for cloud hosting services. Your data may be stored and processed on Azure's cloud infrastructure. Microsoft implements comprehensive security measures to protect your data. For more information about how Microsoft Azure handles your data, please visit their Privacy Policy at https://privacy.microsoft.com/en-us/privacystatement.

• Datadog.

  We use Datadog for database monitoring and performance analytics. Datadog helps us ensure the reliability and security of our database systems. While Datadog may process metadata about database operations, it does not have direct access to your personal information. For more information about how Datadog handles data, please visit their Privacy Policy at https://www.datadoghq.com/legal/privacy/.

• Google.

  We use Google services including Google Workspace, Gmail, and Google Drive for business operations, email communications, and document storage. When you communicate with us or share documents with us, this information may be processed and stored using Google's services. For more information about how Google handles your data, please visit their Privacy Policy at https://policies.google.com/privacy.

• Google Gemini.

  We use Google Gemini, an artificial intelligence platform, to process and analyze data. This may include generating insights from session transcripts and other content you create on our Platform. Google Gemini implements robust security measures to protect your data. For more information about how Google handles your data, please visit their Privacy Policy at https://policies.google.com/privacy.

• Other third party tools.

  We use other third party tools which allow us to track the performance of our Platform. These tools provide us with information about errors, app and website performance, and other technical details we may use to improve our Platform and/or the Services.

How do we use your Personal Information?

We may use your Personal Information for the following purposes:

• Operate, maintain, supervise, administer, and enhance our Platform or the Services, including monitoring and analyzing the effectiveness of content on the Platform, aggregate site usage data, and other usage of the Platform and/or the Services such as assisting you in completing the registration process,
• Process and transcribe audio recordings of therapy sessions,
• Generate analysis and reports,
• Promote and market our Platform and/or the Services to you,
• To provide notices, updates, or important information about your account,
• To fulfill legal or contractual obligations related to, or through enforcement of, any contracts entered into between you and Evolve, including for billing and collection.
• To respond to law enforcement requests, court orders, and subpoenas and to carry out our legal and contractual obligations.
• Authenticate your use of our Platform and Services, detect fraudulent use, and otherwise maintain the security of the Platform,
• Improve our Platform, Services, and AI models when you have explicitly donated your sessions for research and development purposes,
• Any other purpose for which your explicit consent has been obtained.

How do we share your Personal Information?

We may share Personal Information with third parties in certain circumstances or for certain purposes, including:

• Our business purposes. We may share your Personal Information with our affiliates, vendors, service providers, and business partners, including our data hosting and data storage partners, analytics providers, technology services and support, and data security advisors. We may also share your Personal Information with professional advisors, such as auditors, law firms, and accounting firms. We do not share protected health information with advertising platforms.
• Service providers. We share recordings and transcripts with our business associates who are necessary to provide Services, including Assembly AI for transcription and OpenAI, Anthropic, and Google for analysis. All such providers are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.
• With your consent. We may share your Personal Information if you request or direct us to do so.
• Compliance with law. We may share your Personal Information to comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries.
• Business Transfer. We may share your Personal Information to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our users are among the assets transferred.
• To enforce our rights. We may share your Personal Information to enforce any applicable terms and conditions, and to ensure the safety and security of our Services and our users.
• De-identified information. We may also disclose de-identified information, so that it cannot be reasonably used to identify any individual, with third parties for marketing, advertising, research, or similar purposes.
• To improve our Platform. We may use your Personal Information for internal testing, research, analysis, and product development, including to develop and improve our website/application, and to develop, improve, or demonstrate our products and services.
• To market our products and services. We may advertise Parts Companion on external platforms such as Facebook, Google, and YouTube. These platforms may receive limited, non-health conversion data (such as that a signup occurred) to measure ad effectiveness. We do not display third-party advertisements within our Platform.
• To share relevant professional development opportunities. We may occasionally include information about IFS training programs, workshops, retreats, or other professional development resources from affiliated organizations in our communications to Practitioner-Users. You can opt out of these communications at any time via the unsubscribe link in any email or through your account settings. We do not sell your Personal Information, and we do not share protected health information for marketing purposes.
• Third Party Analytics. We use analytics tools to understand and evaluate how visitors interact with our Platform and/or the Services. These tools help us improve our Platform and/or the Services, performance, and your experience.

Your choices about how we share your Personal Information.

This section of our Privacy Policy provides details and explains how to exercise your choices.

Cookie Consent: When you first visit our Platform, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies, including analytics cookies. If you reject non-essential cookies, we will only use cookies that are strictly necessary for the Platform to function. You can change your cookie preferences at any time in your account settings.

We offer you choices on how you can opt out of our use of tracking technology, disclosure of your Personal Information for advertising our services to you, and other targeted advertising. We do not control the collection and use of your information collected by third parties. These third parties may aggregate the information they collect with information from their other customers for their own purposes. You can opt out of third parties collecting your Personal Information for targeted advertising purposes in the United States by visiting the National Advertising Initiative's (NAI) opt-out page and the Digital Advertising Alliance's (DAA) opt-out page.

Each type of web browser provides ways to restrict and delete cookies. Browser manufacturers provide resources to help you with managing cookies. Please see below for more information.

• Google Chrome
• Internet Explorer
• Mozilla Firefox
• Microsoft Edge
• Safari (Desktop)
• Safari (Mobile)
• Android Browser
• Opera
• Opera Mobile

For other browsers, please consult the documentation that your browser manufacturer provides. If you do not wish to have your e-mail address used by Evolve Labs to promote our own Products and Services, you can opt-out at any time by clicking the unsubscribe link at the bottom of any e-mail or other marketing communications you receive from us or logging onto your Account Preferences page. This opt out does not apply to information provided to Evolve Labs as a result of a product purchase, or your use of our Platform and/or the Services. You may have other options with respect to marketing and communication preferences through our Platform.

You may see advertisements for Parts Companion on external platforms such as Facebook, Google, and YouTube. We use tools provided by these platforms (such as Meta's Conversions API) to measure whether our advertisements are effective. These tools may receive limited conversion data (for example, that a signup occurred) along with hashed identifiers, but they never receive session content, therapy data, or protected health information. We do not display third-party advertisements within our Platform.

Session Donation Choices: You may choose to donate your sessions to Parts Companion for research and development purposes. This can be done at a global level for your entire account or on an individual session basis. When you donate your sessions, our team may access your full transcript to understand feedback and improve our AI models. You can change your donation preferences at any time in your account settings.

GDPR and UK GDPR Rights: If you are in the United Kingdom or the European Economic Area, you have additional rights, described in Section IX below. You can export your data in a machine-readable format, delete your data, and control your cookie settings from your account settings. To object to or restrict processing, write to hello@partscompanion.org.

How do I access and correct my Personal Information?

You can review and change your Personal Information by logging into our Services and visiting your account settings. You may also contact us via email athello@partscompanion.org to inform us of any changes or errors in any Personal Information we have about you to ensure that it is complete, accurate, and as current as possible or to delete your account. We will respond to access or correction requests within 30 days of receipt. We cannot delete your personal information except by also deleting your account with us. We may also not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect.