Privacy Policy

• Who we are:Ophie is operated by Inyeon LLC, a New York limited liability company doing business as “Ophie.” If we transfer the Ophie business to an affiliated corporation in the future, that successor entity will assume all rights and obligations under this Policy.
• Who we serve: US residents only, 18+.
• What we are not: not a healthcare provider, therapist, or licensed mental health professional; not a HIPAA covered entity or business associate; not a medical device. We do not diagnose or treat any condition.
• Crisis: we are not a crisis service. Call/text 988, text HOME to 741741, or call 911.
• No sale, no ads: we do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• No AI training on your conversations: we do not use your sessions or transcripts to train foundation models or any third-party model, and our subprocessors are contractually prohibited from doing so.

This Privacy Policy describes how Ophie collects, uses, discloses, retains, and protects personal information about users of the Ophie webapp and related services (collectively, the Service).

It applies to information we collect through the Service, in communications with us, and through our marketing, waitlist, and community pages. It does not apply to information collected by third parties through services that link to or from the Service.

We operate the Service only in the United States. If you are located outside the United States, please do not use the Service.

By using the Service, you acknowledge that you have read and understood this Policy.

We may update this Policy. Material changes will be communicated by email and/or in-product notice at least 30 days before taking effect. We will never retroactively apply a change that allows new training uses of past conversations without your specific, affirmative, opt-in consent. Prior versions are archived and available on request at team@ophie.app.

We collect the following categories. For each: what it includes; why we collect it; sources; retention; and whether it is sensitive under applicable state law.

We collect from three sources:

1. directly from you;
2. automatically from your use of the Service;
3. from service providers we engage on your behalf (authentication provider, payment processor, voice processors).

We do not buy personal information from data brokers and do not enrich your profile with broker data.

We use personal information to:

1. Provide the Service (authenticate, respond, persist sessions, operate RAG memory);
2. Protect users and the public (detect crisis language, surface resources, enforce safety, respond to abuse);
3. Operate the Service (monitor performance, fix bugs, plan capacity);
4. Bill paid tiers;
5. Communicate transactional and optional wellness messages;
6. Satisfy legal obligations;
7. Improve the Service through aggregate measurement and UI experiments on non-sensitive variants.

We do not use Your Content to train our models or any third-party model. Our subprocessors are contractually prohibited from training their models on inputs we send them on your behalf. If we ever wish to use Your Content for training, we will obtain separate, specific, affirmative, opt-in consent.

We do not use personal information for cross-context behavioral advertising, targeted advertising, consequential profiling, or sale to data brokers.

Per-session override: you may mark a specific session as anonymous, or disable transcript/summary/memory storage for that session, regardless of your default mode.

Changes apply prospectively. To delete previously stored content, use the Memory or Journey screens.

We share personal information with the following service providers, each bound by a written data-processing agreement requiring them to process data only on our documented instructions, to maintain appropriate security, to notify us promptly of any breach, and (where the provider trains models) to refrain from training on data we send. Named disclosure is required by Washington MHMDA for recipients of consumer health data.

A current version of this list is maintained at /privacy/subprocessors. We provide at least 30 days' advance notice before adding a subprocessor that handles consumer health data.

We do not transfer personal information outside the United States.

• TLS 1.2+ for all network connections.
• AES-256-GCM at-rest encryption for mental health content (transcripts, summaries, memories) using per-user envelope keys via AWS KMS — distinct from the baseline Transparent Data Encryption (TDE) that protects all Supabase storage-layer data. Engineering trust details →
• Postgres row-level security; anonymous roles revoked from user tables.
• Least-privilege service-role credentials; privileged access is logged.
• Supabase-backed auth with industry-standard password hashing; MFA available; short-lived JWTs.
• Written DPAs with every subprocessor, including security, breach-notification, and subprocessor flow-downs.
• Secrets stored in Doppler and injected at deploy time; no secrets in source control.
• Error telemetry is PII- and content-scrubbed before being sent to our error tracker.
• No third-party advertising pixels on any authenticated or session page.
• Documented incident-response plan consistent with FTC and state expectations for non-HIPAA health apps.

We comply with the FTC Health Breach Notification Rule (16 C.F.R. Part 318, as amended in 2024) and every applicable state breach-notification statute (including N.Y. SHIELD Act, Cal. Civ. Code § 1798.82, and Mass. 201 C.M.R. 17.00).

• We investigate any suspected breach promptly.
• We notify affected users without unreasonable delay and in no event later than 60 calendar days after discovery of a breach of unsecured personally identifiable health information.
• We notify the FTC contemporaneously when a breach affects 500+ individuals, and notify prominent media in any state where 500+ residents are affected.
• We notify state attorneys general and other regulators as required by law.

We extend the following rights to every US user, regardless of state:

• Know what categories we collect, purposes, sources, and recipients.
• Access a copy of the specific personal information we hold (portable JSON).
• Correct inaccurate personal information.
• Delete your personal information, subject to narrow legal exceptions.
• Portability of personal information you provided or generated.
• Opt out of sale, sharing, and processing for targeted advertising (we do none of these).
• Limit the use of sensitive personal information to what is necessary to provide the Service.
• Opt out of profiling with legal or similarly significant effects (we do not engage in such profiling).
• Withdraw consent at any time, prospectively.
• Appeal a denied request to a different reviewer.
• Non-discrimination for exercising a right.

We honor the Global Privacy Control signal where state law requires (CA, CO, CT, TX, and additional states as of 2026). When we detect Sec-GPC: 1, we treat it as a request to opt out of sale, sharing, and processing for targeted advertising. Because we do not engage in any of those, honoring GPC is a formality for us.

The full Consumer Health Data Privacy Notice is maintained separately at /consumer-health-data-notice.

• Washington MHMDA (RCW 19.373). We treat the data in Sections 3.3–3.7 as consumer health data. We collect such data only with your opt-in consent (separate from Terms acceptance); we do not sell it; we do not geofence any health facility; you have rights to confirm, access, delete, and withdraw consent. MHMDA carries a private right of action under Washington's Consumer Protection Act.
• Nevada SB 370 / NRS 603A.400 et seq. Similar protections apply. We do not sell consumer health data.
• Connecticut SB 1295 (effective July 1, 2026). We will comply with the amended CTDPA's consumer health data rules as of its effective date.

• You are talking to an AI. Disclosed at the start of every session and throughout, per CA SB 243, NY AI Companion Law, and UT HB 452.
• Provider stack (current): DigitalOcean (Qwen 3.5-397B) as the primary conversational LLM; Groq (GPT-OSS-20B background tasks, Llama-3.1-8B RAG summarization, GPT-OSS Safeguard-20B safety classifier); OpenAI as a fallback / sentiment / embedding helper; Anthropic and Google AI (via OpenRouter) for image and PDF reading tools; Deepgram for speech-to-text; Cartesia (default) with Inworld and ElevenLabs as alternates for text-to-speech; Voyage AI for embeddings. The full subprocessor list is at /privacy/subprocessors.
• No training on your data. We do not train or fine-tune any model on user content; our subprocessors are contractually prohibited from training on API inputs we send.
• No consequential decisions. We do not use AI to decide credit, housing, employment, insurance, education, or healthcare access.
• Accuracy limits. AI output is probabilistic; it may be wrong. Do not rely on Ophie for medical, mental-health, legal, or financial advice.

• Authentication cookies (Supabase): HttpOnly, Secure, SameSite=Lax.
• Local storage ophie-user-preferences for non-sensitive UI prefs; sensitive content never persisted client-side.
• In-session stores cleared on sign-out.
• Analytics cookies (PostHog) only if you opt in; default is opt-out.
• hCaptcha cookies on waitlist/signup for bot prevention.
• No third-party advertising pixels, tag managers, or remarketing tools anywhere on the Service.

Manage cookies via the "Cookie Settings" control in the footer or your browser settings.

We do not knowingly collect personal information from children under 18. If we learn that we have, we will terminate the account and delete the data. Notify us at team@ophie.app.

We do not currently respond to DNT because there is no industry standard. We do honor the Global Privacy Control signal (see Section 13).

In a merger, acquisition, financing diligence, reorganization, bankruptcy, or asset sale, your information may be transferred subject to commitments consistent with this Policy. You will receive notice and, where applicable, a reasonable opportunity to delete your data before transfer.

We do not voluntarily provide government authorities with access to user personal information. We will respond to valid legal process consistent with our obligations and users' rights, and we will notify affected users unless legally prohibited. We will challenge overbroad or unlawful requests. We intend to publish aggregate transparency statistics annually.

For each processing activity that involves sensitive data, targeted advertising (none), sale (none), or profiling with significant effects (none), we conduct and maintain an internal data-protection assessment as required by applicable state law.

If any provision is held unenforceable, the remainder stays in force. Section headings are for convenience and do not affect interpretation. Examples are non-exhaustive.