Privacy Policy

1. Who We Are

elev8 LLC (“Company,” “we,” “us,” or “our”) operates One Way, a peer-recovery community platform available on iOS (the “App”). The App allows treatment facility alumni and their support networks to maintain recovery connections, track wellness data, and access peer support after completing treatment.

You can reach our Privacy Officer at [email protected]

2. Who This Policy Covers

This Privacy Policy applies to all users of the One Way App, including alumni users, family members, sponsors, and facility staff. It applies to Personal Information we collect through the App, our backend services, and associated websites.

Age Requirement. The App is intended for users 18 years of age and older. We do not knowingly collect Personal Information from anyone under 18.

3. The Information We Collect

3.1 Information You Provide

3.2 Information Collected Automatically

Device identifiers (IDFV — not IDFA), usage data (screens visited, session duration), crash and performance logs, push notification tokens, and IP address.

What we do NOT collect: Advertising identifier (IDFA). We do not serve ads and do not request App Tracking Transparency permission.

3.3 Wearable and Health Data (Optional)

Connecting a wearable is optional and off until you connect one. We support Whoop and Oura (connected with your authorization through their own login), Apple Health (read-only, with the permissions you grant on your device), and a directly paired Bluetooth heart-rate monitor.

Depending on the source, this can include heart-rate variability, resting and live heart rate, sleep, recovery or readiness scores, respiratory rate, activity and SpO2. Raw readings are retained for 90 days and then deleted. Data read from Apple Health and Health Connect stays on your device except for the summary described below. We do not sell biometric data, and we never use it for advertising.

3.4 Voice Data

When you use voice input, audio is transmitted to our backend and processed by AWS Transcribe (covered under our AWS BAA). Audio files are deleted immediately after transcription. We retain the text transcript as part of the journal entry you recorded.

3.5 Identity Verification (Optional)

If you join the One Way community without a program code, you can choose to verify your identity instead. This is optional and only applies if you choose it. You must be 18 or older.

Verification is run by Stripe (Stripe Identity). Stripe collects a photo of your government ID and a live selfie and compares them. Stripe processes and stores those images under its own privacy policy.

We receive only three things: whether the check passed, a Stripe verification reference, and a one-way fingerprint (a keyed hash) made from your name and date of birth. We use the fingerprint only to prevent duplicate accounts and to keep removed members from rejoining. We never receive or store your ID images or any facial or biometric data, and we do not store your date of birth. The check confirms you are 18 or older; nothing about your age is kept beyond pass or fail.

Facial comparison is performed by Stripe, with your consent at the time of verification. One Way does not collect, store or use biometric identifiers, including under biometric privacy laws such as those in Illinois, Texas and Washington.

When you delete your account, we delete your verification record and ask Stripe to redact the verification session. The one exception: if your account was removed from the community for breaking its rules, we keep the fingerprint alone, which cannot be turned back into a name or birthday, so the same person cannot rejoin.

4. Substance Use Disorder Records — 42 CFR Part 2

Part 2 provides stricter protections than standard HIPAA. We may not disclose Part 2-protected records to anyone — including law enforcement — without your prior written consent, except in limited circumstances.

Crisis exception: If you send a message our AI classifies as indicating immediate risk of harm, we route you to the 988 Suicide and Crisis Lifeline. This referral does not include your name, treatment history, or account information.

5. How We Use Your Information

We use your information to provide the App's core features, authenticate your account, send push notifications you've opted into, compute your Recovery Context score, route crisis support, classify community posts for safety, and comply with legal obligations.

We do NOT use your information for: targeted advertising, sale to data brokers, or training any external AI model.

6. Synthetic Users — Early Access Disclosure

During early access and beta periods, the One Way community may include synthetic user accounts (“bots”) operated by elev8 LLC. These accounts simulate peer-recovery participants to seed community activity. They do not respond to direct messages, do not remember conversations, and do not collect your Personal Information. We will notify users when synthetic accounts are removed.

7. Sharing With Your Care Team

When you turn it on, your facility's alumni coordinator can see:

• Your name, your recovery milestones, and how recently you have been active in the app.
• A wellness summary from any wearable you connect — a general readiness level, not your raw heart rate, sleep or other readings.
• Messages you send to your care team through the app.
• A recovery-risk level (low, medium or high) and what contributed to it — for example a run of hard days, missed daily logs, or how many of your recent journal entries mention cravings. That is a count; the words themselves are never shown.

Your coordinator does NOT see the text of your journal entries, your voice recordings, your individual craving and mood logs, or your raw biometric data.

Your facility is a separate organization and handles what it receives under its own privacy obligations, including HIPAA and 42 CFR Part 2 where they apply.

8. Information Sharing

We do not sell your Personal Information. We share it only with:

9. Crisis Detection and 988 Routing

Journal entries and community posts are screened for a fixed list of phrases that indicate immediate risk — a keyword check, not a clinical assessment and not an AI judgement about you. When one matches, you get an immediate in-app prompt to call or text 988. We do NOT automatically contact 988 on your behalf and do NOT disclose your identity, location, or treatment history to 988.

The crisis detection system is not a substitute for emergency services. If you are in immediate danger, call 911.

10. Data Retention

11. Security

TLS 1.2+ in transit, AES-256 at rest via AWS RDS, JWT authentication with bcrypt password hashing, role-based access controls, and audit logging on all data access events. All AWS services handling PHI are covered under our BAA.

12. If There Is a Breach

If your Personal Information is exposed in a security incident, we will tell you without unreasonable delay and no later than 60 days after we discover it, as HIPAA's Breach Notification Rule requires, and sooner where a state law requires sooner. The notice will say what happened, what information was involved, what we have done about it, and what you can do.

Records protected by 42 CFR Part 2 carry the same commitment. Where the law requires us to notify the U.S. Department of Health and Human Services, or your facility as the covered entity, we do that too.

13. Your Rights

You have the right to access, correct, delete, and export your Personal Information. California residents have additional rights under CCPA/CPRA including the right to know, delete, correct, and opt out of sale (we do not sell PI). Virginia, Colorado, Connecticut, Utah, and Texas residents have similar rights.

You can delete your account and everything in it yourself, at any time, in the app: You → Delete my account. Deletion removes your journal, check-ins, community posts, wearable data and account record; we keep only what the law requires us to keep, such as audit logs.

For anything else — access, correction, a copy of your data, or a question about this policy — email [email protected]

14. Children's Privacy

The App is not directed to children under 18. We do not knowingly collect Personal Information from anyone under 18. Contact [email protected] immediately if you believe a minor has registered.

15. Changes to This Policy

We will post changes at this URL and, for material changes, send an in-app notification at least 30 days in advance. Continued use after the effective date constitutes acceptance.

16. Contact Us

Privacy Officer: elev8 LLC
Email: [email protected]
HIPAA complaints may also be filed with the HHS Office for Civil Rights at hhs.gov/ocr

17. Apple Privacy Nutrition Label

Data Used to Track You: None

Data Linked to You: Contact Info, Health & Fitness, User Content, Identifiers, Usage Data, Diagnostics

No data is sold. No data is used for advertising or tracking.