RecoveryAI | Adaptive AI for Addiction Recovery

Privacy Policy for Recovery AI, Inc.

Effective Date: May 26, 2026

Last Updated: May 26, 2026

1. Who We Are

RecoveryAI, Inc. is a Delaware corporation with offices at 1501 South Indiana Avenue, Unit B, Chicago, IL 60605. RecoveryAI develops Ebby, an AI-based recovery support companion designed to provide informational, motivational, and adaptive support for individuals working to change their relationship with substances.

Ebby is not a medical device, treatment, or substitute for professional clinical care. Ebby does not provide medical advice, diagnosis, or treatment. If you are experiencing a medical or mental health emergency, contact 911, 988 (Suicide and Crisis Lifeline), or your local emergency services immediately.

2. Information We Collect

We collect the following categories of information.

2.1 Information You Provide Directly

Account information: name, email address, phone number, password, date of birth, and other registration details.
Profile and recovery context: recovery goals, recovery stage, communication preferences, substance preferences, and any demographic information you choose to share.
User-generated content: journal entries, check-in responses, conversations with Ebby (text and voice), foundation intervention responses, mood and craving self-reports, wellness ratings, and other content you create or share through the Services.
Support network information: names and contact information for emergency contacts, sponsor, or designated support people, which you provide and manage in your account.
Communications with us: correspondence with our support, research, or business teams.
Payment information: if you subscribe to a paid tier, payment information is collected and processed by our payment processor; we do not store full payment card numbers.

2.2 Information Collected Automatically

Device and technical information: device type, operating system, app version, language settings, time zone, and unique device identifiers.
Usage information: features used, interaction frequency, time spent, completion of routines and interventions, and similar engagement signals.
Location information: approximate or precise location, if you enable location services and grant permission.
Log data: IP address, access times, and error logs.

2.3 Information From Connected Services

If you choose to connect third-party services (for example, health and fitness platforms, calendar applications, or other tools), we collect the data those services share with us based on the permissions you grant.

2.4 Sensitive Information

Some information you provide is sensitive, including information related to substance use, recovery, mental health, mood, cravings, and personal relationships. We treat this information with care, limit access on a need-to-know basis, and do not sell sensitive personal information or use it for advertising.

3. How We Use Your Information

We use the information we collect to:

Provide and operate the Services, including interpreting and responding to your messages.
Personalize and adapt support based on your context, recovery stage, and patterns over time.
Compute and present wellness signals, risk indicators, and recommended actions designed to support your recovery.
Surface safety resources and, with your prior setup and consent, facilitate contact with your support network, sponsor, or emergency contacts.
Send transactional and service-related communications, including reminders, check-ins, and account messages.
Improve the Services, including the underlying AI models, in de-identified or aggregated form.
Conduct research, with appropriate consent and review, including in collaboration with academic and clinical partners.
Maintain the security of the Services, prevent fraud and abuse, and enforce our terms.
Comply with legal obligations and respond to lawful requests.

4. How Information Is Processed by AI

Ebby uses artificial intelligence, including large language models, to interpret your messages and generate responses. To deliver these capabilities, your messages and certain related content are processed by our AI service providers under contractual terms that restrict their use of your data.

We work with reputable AI providers that meet our security and privacy standards. We instruct our AI providers not to use your content to train their general-purpose AI models. We may change AI providers from time to time as the underlying technology evolves, and when we do, we apply equivalent or stronger contractual protections.

Aggregated and de-identified data derived from Service usage may be used to develop, evaluate, and improve our own models and product features. We do not include directly identifying information in this work.

5. How We Share Information

We share information in the following circumstances.

Service providers. We share information with vendors that perform services on our behalf, including cloud infrastructure and hosting, AI inference, authentication, analytics, communications and messaging, customer support, payment processing, transcription, and similar functions. These providers are contractually limited to using your information to provide services to us.
With your direction. When you choose to use a feature that contacts your support network, sponsor, or emergency contact, we share the information needed to do so.
Safety. If we reasonably believe you are at imminent risk of serious harm to yourself or others, we may share information with emergency services, designated emergency contacts, or relevant authorities. Ebby is not a substitute for emergency services.
Research. With appropriate consent, ethical review, and contractual protections, we may share de-identified or coded data with academic, clinical, or research partners for the purpose of advancing recovery science and improving the Services.
Business transactions. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to standard privacy commitments.
Legal. We may disclose information when required by law, subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of RecoveryAI, our users, or others.

We do not sell your personal information, and we do not share it for advertising purposes, including cross-context behavioral advertising.

6. Data Security

We maintain administrative, technical, and physical safeguards designed to protect your information. These include encryption in transit and at rest, multi-factor authentication on administrator and general user accounts, role-based access control with least-privilege defaults, ongoing vendor diligence, and a documented incident response process. Our security practices are aligned with the HIPAA Security Rule technical safeguards, although the consumer-facing Ebby application is not, in itself, a HIPAA-covered service.

No system can be guaranteed to be completely secure. If we become aware of a security incident affecting your information, we will notify you in accordance with applicable law.

7. HIPAA, BAAs, and Clinical Partnerships

The consumer-facing Ebby application is not a HIPAA-covered service. When RecoveryAI provides services to a treatment provider, payer, research site, or other entity in a context that involves Protected Health Information ("PHI"), we enter into a Business Associate Agreement and operate under HIPAA-aligned controls appropriate to that relationship.

8. Data Retention

We retain your information for as long as your account is active and for a reasonable period afterward to operate the Services, satisfy our legal obligations, resolve disputes, enforce our agreements, and support research and product improvement. You may request deletion of your account at any time as described in Section 9. After account deletion, we may retain certain information in archived, de-identified, or aggregated form, or where retention is required by law.

9. Your Rights and Choices

Depending on where you live, you may have specific rights regarding your personal information, including the right to access, correct, delete, port, or restrict the use of your information, and the right to withdraw consent.

To exercise these rights, contact us at privacy@wearerecoveryai.com or use the in-app account settings. You may delete your account at any time from within the app, which will initiate deletion of associated account data on a defined schedule.

You can also:

Adjust notification, location, and connected-service permissions in your device or in-app settings.
Opt out of non-essential marketing communications.
Decline to provide optional information, with the understanding that some features may not be available without it.

9.1 California Residents

If you are a California resident, the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA") provides you with additional rights, including the right to know what categories of personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of personal information. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. To exercise CCPA rights, contact us at privacy@wearerecoveryai.com.

9.2 Other US State Rights

Residents of other states may have similar rights under applicable state privacy laws. We honor verifiable consumer requests under those laws.

10. Children

The Services are intended for adults age 18 and older. We do not knowingly collect personal information from children under 18. If we learn we have collected personal information from someone under 18, we will delete that information.

11. International Users

The Services are currently offered in the United States and are intended for users located in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States.

12. Crisis Support and Safety

Ebby is not a crisis service. If you are in crisis or experiencing thoughts of harming yourself or others, contact 988 (Suicide and Crisis Lifeline), 911, or your local emergency services. Ebby may surface these resources, and may help you contact your designated emergency contact or sponsor based on your account setup, but Ebby itself is not a substitute for professional crisis support.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, technology, legal requirements, vendor relationships, or business practices. When we make material changes, we will notify you through the Services or by other reasonable means and will update the "Last Updated" date above. Your continued use of the Services after the updated policy takes effect constitutes acceptance of the updated terms.