Privacy Policy

1. Introduction

MoodTrace is committed to protecting the privacy of patients, healthcare providers, and research participants who use our Service. This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have about how your data is handled.

2. Information We Collect

We collect the following categories of information:

• Self-reported behavioral health data: check-ins, voice journals, sleep quality, medication adherence, and other symptoms you choose to log.
• Device-sourced data: with your explicit permission, MoodTrace integrates with consumer health applications and wearable devices, including Apple Health (HealthKit), Google Health Connect, and compatible third-party wearables to collect objective behavioral health signals such as sleep duration, heart rate variability, and activity levels. Device data integration is opt-in, scoped per permission, and can be disconnected at any time in app settings.
• Account information: name, email address, and provider credentials where applicable.
• Usage data: how you interact with the Service, including log-in times and feature usage, used to improve reliability and performance.

3. Your Control Over Data Sharing

You decide when, how, and with whom your data is shared. MoodTrace operates on a patient-initiated and patient-controlled sharing model. No health data is shared with a healthcare provider, research partner, or any third party without your explicit and revocable consent.

• Sharing with providers: you choose whether to share with a healthcare provider and whether that sharing is limited to summaries or includes full check-in history. You may revoke provider access at any time.
• Research participation: a separate opt-in toggle allows you to contribute your data, in anonymized and de-identified form, to behavioral health research including pharmaceutical research. You may opt out at any time without affecting your ability to use the Service.
• Device data scope: you control which types of device-sourced data (sleep, heart rate variability, activity, etc.) are integrated and can disconnect device integrations at any time in app settings.

4. How We Use Your Information

• To provide and improve the Service.
• To generate insights and summaries that help you and your healthcare provider understand your behavioral health patterns.
• With your explicit consent, to contribute anonymized and de-identified data to behavioral health research.
• With your explicit consent, to match your documented behavioral health data against eligibility criteria for clinical research studies and pharmaceutical clinical trials, facilitating patient identification and recruitment for research you choose to participate in.
• To communicate with you about the Service.
• To comply with legal obligations.

5. Anonymization and De-identification

Data contributed to research is anonymized and de-identified in accordance with HIPAA de-identification standards before being aggregated or shared with research partners, including pharmaceutical companies, biotechnology companies, contract research organizations, research institutions, healthcare payers, and health systems. No individual patient or research participant is ever identifiable in any dataset shared externally.

6. Consent

Consent in MoodTrace applies separately to both patients and research participants:

• Patients who are not research participants have their data used only for their own care and insights, and any sharing they explicitly authorize with healthcare providers.
• Research participants opt in explicitly via clearly worded consent language at the time of opt-in, and may withdraw consent at any time without affecting their ability to use the Service.

7. Security

MoodTrace employs industry-standard security practices including encryption at rest and in transit, access controls, and audit logging. Healthcare providers accessing patient data do so under HIPAA Business Associate Agreements. No security system is perfect; we encourage users to practice good security hygiene including strong, unique passwords and device protections.

8. Your Rights

You have the right to access, correct, export, or delete your personal data at any time. To exercise these rights, contact us at privacy@moodtracehealth.com.

HIPAA rights for patients in clinical care: If you are a patient receiving care through a healthcare provider that uses MoodTrace, you also have rights under the Health Insurance Portability and Accountability Act (HIPAA), including the right to access, amend, and receive an accounting of disclosures of your protected health information. Please see our HIPAA Notice of Privacy Practices for a full description of those rights and how to exercise them.

9. Cookies and Tracking Technologies

MoodTrace does not use advertising cookies, tracking pixels, or third-party behavioral tracking technologies.

• Essential cookies: we use session cookies required for authentication and platform security. These cookies are necessary for the Service to function and cannot be disabled.
• Analytics: we may use privacy-preserving analytics to understand aggregate usage patterns and improve Service reliability. No individual behavioral profiles are created or sold.
• No advertising or data sale: we do not sell, lease, or share your data with advertisers or ad networks. MoodTrace products are ad-free by design.

A full Cookie Policy will be published separately. For questions about our use of cookies, contact us at privacy@moodtracehealth.com.

10. SMS / Text Messaging

By providing a mobile phone number — or, for an invited caregiver, by being invited by a MoodTrace patient who confirms they have permission to contact you — you consent to receive transactional SMS text messages from MoodTrace, such as invitation links. Message frequency varies (typically a one-time invitation). Message and data rates may apply. You can opt out at any time by replying STOP, and reply HELP for help. MoodTrace does not sell, rent, or share mobile opt-in information or phone numbers with third parties or affiliates for marketing or promotional purposes. Mobile information is used solely to deliver the messages you have consented to receive.

11. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

• Right to know: the right to know what personal information we collect, use, disclose, and sell. MoodTrace does not sell your personal information.
• Right to delete: the right to request deletion of your personal information, subject to certain exceptions including legal obligations and HIPAA retention requirements for protected health information.
• Right to correct: the right to request correction of inaccurate personal information we hold about you.
• Right to opt out of sale or sharing: MoodTrace does not sell or share personal information for cross-context behavioral advertising.
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights.

To exercise your California privacy rights, contact us at privacy@moodtracehealth.com. We will respond within 45 days as required by applicable law.

Note: Protected health information (PHI) processed under HIPAA is exempt from certain CCPA requirements. HIPAA rights govern PHI; CCPA rights govern non-PHI personal information we hold.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated in advance. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact

Questions about this Privacy Policy? Contact us at privacy@moodtracehealth.com.