Privacy Policy

Last updated: October 12, 2026

1. Introduction

ADHD Harmony B.V. ("ADHD Harmony," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use ADHD Harmony, accessible at app.adhdharmony.com, our companion mobile application, our website at adhdharmony.com, and related services (collectively, the "Service").

This Privacy Policy applies to all users of our Service, including those in the European Union/European Economic Area (EU/EEA), United Kingdom, United States, and worldwide. By using our Service, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller Information

For the purposes of the EU General Data Protection Regulation (GDPR) and other applicable data protection laws, the data controller responsible for your personal data is:

For any privacy-related inquiries, data access requests, or complaints, please contact us at info@adhdharmony.com.

3. Personal Data We Collect

We collect personal data that you provide directly, data generated through your use of our Service, and data from third-party integrations you authorize.

3.1 Data You Provide Directly

3.2 Google User Data

This section explains exactly which Google user data ADHD Harmony accesses, how we use it, how we store and protect it, who we share it with, and how you can delete it. ADHD Harmony only receives Google user data when you choose to sign in with Google or choose to connect your Google Calendar and Google Tasks.

Data we access

• Sign in with Google (scopes: openid, email, profile): your Google account ID, name, email address, whether that email address is verified, and your profile picture. We use these only to create your ADHD Harmony account, sign you in, show your name and picture in the app, and match the sign-in to an existing account with the same verified email address.
• Google Calendar (scopes: calendar.events and calendar.calendarlist.readonly): the list of your calendars, and the events on them (title, description, location, start and end time, and whether an event repeats). We read events to show your day in the app and to plan around them, and we create, update or delete events only when you ask for it. Older connections may also use calendar.app.created to keep a dedicated ADHD Harmony calendar.
• Google Tasks (scope: tasks): your task lists and the tasks in them (title, notes, due date and completion status). We read them to show your tasks in the app, and we create, update, complete or delete tasks only when you ask for it.

We do not access your Gmail, Google Drive, Google Contacts, Google Photos or any other Google service. Files you upload to ADHD Harmony yourself are covered by section 3.1, not by this section.

How we use Google user data

Google user data is used only to provide and improve the user-facing features you can see in ADHD Harmony: signing in, showing and planning your calendar and tasks, and carrying out the changes you ask for. When you ask Jim's AI Twin about your plans, the relevant calendar names, event details and task details are sent to our AI providers (Anthropic and OpenAI) only to answer that request and carry out the action you asked for. Our connection screen explains this before you connect Google.

We do not sell Google user data. We do not use it for advertising, retargeting or interest-based ads, for credit or lending decisions, or to build user profiles for anyone else. We do not use Google user data to train or improve general AI or machine learning models, and our AI providers process it under agreements that do not allow them to train their models on it.

How we store and protect Google user data

Google access tokens and refresh tokens are encrypted in our database (hosted by Supabase in the EU), are never shown in your browser and are never sent to AI providers. All data travels over encrypted connections (TLS). Calendar events and tasks are read from Google when you need them; we keep a short-lived cache of your calendar list, and the plans and chats you save in ADHD Harmony may include event or task details you discussed. Our staff do not read your Google user data, except with your explicit permission for specific data (for example when you ask for support), when needed for security investigations, or to comply with the law.

Who we share Google user data with

We share Google user data only with the service providers that run ADHD Harmony for us, and only as described above: Supabase (database and sign-in), Vercel (hosting) and Anthropic and OpenAI (answering your requests). We do not transfer it to anyone else, except when required by law or as part of a merger or acquisition, in which case this policy keeps applying to it.

Keeping and deleting Google user data

You can disconnect Google Calendar and Google Tasks at any time in your account settings. Disconnecting deletes your Google tokens and cached calendar list and asks Google to revoke our access (if Google is unreachable we keep the disabled, encrypted connection only to retry the revocation). It does not delete events or tasks in your Google account, and the chats and plans you saved in ADHD Harmony stay until you delete them. You can also remove ADHD Harmony's access directly at Google Account Permissions. When you delete your ADHD Harmony account, all Google user data we hold, including the name, email and picture from Sign in with Google, is deleted within 30 days (encrypted backups follow their normal rotation, see section 11). You can also ask us to delete it at any time by emailing info@adhdharmony.com. Our AI providers may keep request data for a short time for security and abuse monitoring under their API terms.

Limited Use

ADHD Harmony's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy.

Other optional integrations

• Human Design / birth data (optional): If you use our optional Human Design feature, you may provide your birth date, time, and location, which is sent to a specialized third-party chart service (BodyGraph) to generate your chart

3.3 Automatically Collected Data

When you use our Service, we automatically collect:

• Technical Data: IP address, browser type and version, device type, operating system, time zone, and language preferences
• Usage Data: Pages visited, features used, click patterns, session duration, and interaction data
• Location Data: Approximate location derived from IP address (city/country level only)
• Technical Logs: Application logs used for security, debugging, and reliability, which may contain identifiers such as your user ID or email address

3.4 Sensitive Personal Data (GDPR Article 9)

Our Service is designed for individuals with ADHD. By creating an account and using our wellness features, you share health-related data that qualifies as "special category data" under GDPR Article 9. This includes:

• ADHD-related information: Your experiences, challenges, coping strategies, diagnoses you choose to share, and goals shared in your profile and conversations
• Daily check-in scores: Mood, energy, focus, happiness, calmness, and motivation ratings
• Personal reflections: Notes about your mental and emotional state
• AI-derived insights and memories: Patterns, trends, and facts our AI identifies from your wellness data and conversations to personalize your coaching

We process this data based on your explicit consent, which you provide during account registration through a dedicated, affirmative consent action that is separate from your acceptance of our Terms of Service. This consent is required to use the Service, as processing health-related data is integral to providing the personalized AI coaching that is the core purpose of ADHD Harmony.

This data is processed with the highest care and security, and solely to provide you with personalized coaching and wellness support. We never sell this data or share it with third parties for advertising purposes. You may withdraw your consent at any time by deleting your account, which will result in the deletion of your personal data as described in Section 11. Health details you choose to share with other members in the community are covered in Section 7.3.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we must have a valid legal basis for processing your personal data. We rely on the following legal bases:

You may withdraw your consent at any time for processing activities based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. How We Use Your Data

We use your personal data for the following purposes:

5.1 Service Delivery

• Provide, maintain, and operate the ADHD Harmony platform
• Personalize your AI coaching experience using your profile, conversation history, memories, and check-ins
• Generate insights and patterns from your check-ins and worksheets
• Enable AI agents to reference your knowledge base for context
• Display and manage your Google Tasks and Calendar events
• Provide voice conversations, transcription, and body doubling features with voice/video capabilities
• Run the community: show your profile, posts and messages to the people they are meant for, send the notifications you choose, and run events, the classroom, leaderboards and weekly prizes

5.2 Communication

• Send essential service notifications and updates
• Respond to your support requests and inquiries
• Send marketing communications (only with your explicit consent, and you can unsubscribe at any time)

5.3 Improvement and Analytics

• Analyze usage patterns to improve features and user experience
• Identify and fix technical issues
• Develop new features based on aggregate usage insights

5.4 Security, Safety, and Legal

• Protect against unauthorized access, fraud, and abuse
• Review and respond to safety reports, including reports of concerning AI output
• Keep the community safe: review reports, take down what breaks the rules, and notice when a member may need support (Section 7)
• Enforce our Terms of Service and Community Rules
• Comply with legal obligations

6. AI and Automated Processing

ADHD Harmony uses artificial intelligence to provide personalized coaching and support. This section explains how AI processes your data.

6.1 AI Transparency (EU AI Act)

6.2 How AI Is Used

We use AI models from Anthropic (Claude) as our primary provider and OpenAI for specific features, to:

• Analyze your messages and provide contextual, helpful responses
• Reference your knowledge base documents to give informed answers
• Read the text and content of files you upload to your library, including photos, screenshots and scanned pages, so they can be searched and referenced
• Read the photos, screenshots and documents you add to a chat message, so the answer can take them into account. These files are stored privately, only you can open them, and they are deleted together with the chat
• Generate insights based on your check-ins and worksheets
• Personalize coaching based on your profile information and memories the AI keeps about your preferences, goals, and patterns (which you can review and manage)
• Create conversation titles and summaries
• Give a second read to a community post or comment that our safety check flagged, to tell a real worry from a figure of speech (Section 7.5)
• Write the summary and chapters of a recorded live call for the classroom, from the call's transcript, without naming members (Section 7.8)
• Turn voice recordings and dictation into text (using OpenAI)
• Run voice calls with Jim's AI Twin, including AI body doubling: ElevenLabs turns what you say into text and speaks the replies in a synthetic voice based on Jim's. ElevenLabs is set to keep no audio and to delete its copy of the transcript after 7 days; the call itself is saved in your chat

6.3 No Training on Your Data

6.4 Human Oversight and Safety

While AI processes your requests, all coaching frameworks, system prompts, and safety guidelines are designed and maintained by humans. The AI operates within defined boundaries, is instructed never to diagnose conditions or give medication advice, and includes safety protocols that refer users to crisis resources (such as findahelpline.com and local emergency services) when a conversation indicates crisis, self-harm, or suicidal ideation. You can report concerning AI output at any time via Help in the app (the Help button at the top right, then "Tell us").

6.5 No Automated Legal Decisions

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects concerning you. The AI provides coaching and suggestions only. All decisions remain yours.

Some community safeguards work by themselves: posting limits, hiding a post or comment once three different members have reported it (until our team looks at it), and the safety check for crisis language, which never blocks or changes what you share. None of these has legal or similarly significant effects. A person on our team makes every decision to take something down, pause someone's posting or lock an account.

6.6 Your Rights Regarding AI Processing

Under GDPR Article 22 and related provisions, you have the right to:

• Request information about the logic involved in AI processing
• Request human review of AI-generated insights
• Object to certain forms of automated processing

7. The Community

ADHD Harmony has its own community: a feed with posts, comments, likes and polls, member profiles and a member map, direct messages between members, a classroom, live events, body doubling rooms, leaderboards and weekly prizes. This section explains what other members can see, what stays private, and what we do with community data and why. The rest of this policy applies to the community too.

The community is for people with a ADHD Harmony account, free or paid. It is not open to the public and not shown to search engines. But everyone with an account who opens the community can see what is shared there. Think of it as a large room full of fellow members, not as a private chat.

7.1 What Other Members Can See, and What Stays Private

Your email address is never shown to other members. Your community name and photo come from the public part of your profile (Edit profile, Profile). If you have not set a name there, we use the name from your sign-in (for example your Google account) or, if there is none, simply "Member". We never build a name from your email address. You can change your name, photo, the line about you and your city at any time.

7.2 What We Collect, Why, and Our Legal Basis

7.3 Health Details You Share

When you choose to share health details with other members, we host and show them on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give at sign-up and each time you choose to post, and, to the extent you make them public yourself, Art. 9(2)(e) GDPR. You can take them back at any time by deleting the post or comment. Some screens offer to share something with the community, such as how your check-in went or a few words about your report. Nothing is posted until you see the words and choose to post them.

7.4 Direct Messages

• Private between the two of you. Direct messages are not shown in the feed, on profiles or in search.
• Not end-to-end encrypted. They are encrypted on the way and where they are stored, but our systems can read them: that is how we deliver them, show them on your devices and send notifications. Do not send passwords, bank details or anything you would not want a company to store.
• When our team can read them. Our team does not read your direct messages, except:
  • When you or the other member reports the conversation. The team then sees the most recent messages of that conversation (today the last 12) to decide what to do. Whoever reports a conversation shares it with the team.
  • When you write to Jim or the team yourself. Those messages are read by Jim and the team.
  • When we need to look into a serious security problem or abuse of the Service (such as spam, fraud or threats), or when the law requires it.
• Notifications. A push notification can show the sender's name and the start of the message on your lock screen. To hide the words, switch off "Show the words of a message on my lock screen" in Notification settings. If a message is still unread after 15 minutes, we email it to you, unless you turned that email off.
• Messages from Jim. Some messages from Jim in your Messages are sent automatically, for example a welcome. Your replies reach Jim and the team.
• Deleting. You cannot delete single messages yet. When either of you deletes their account, the whole conversation is deleted for both of you. Blocking someone stops messages both ways.

7.5 The Safety Check for Crisis Language

Many members carry a lot. So that nobody in crisis goes unseen, every new post and comment is checked automatically for words that can point to a crisis, such as thoughts of suicide or self-harm.

• It never blocks, changes or hides what you share. Your words always go through.
• If it finds such words, you see a card right away with crisis lines (such as 988 in the US and Canada, Samaritans on 116 123 in the UK and Ireland, Lifeline on 13 11 14 in Australia, 113 in the Netherlands, and findahelpline.com) and ways to reach Jim's AI Twin or Jim. The card tells you the team will see it.
• We keep a short note for the team: up to 280 characters around the words that matched, and how serious it looks.
• Claude (Anthropic) then reads that post or comment once, to tell a real worry from a figure of speech such as "this deadline is killing me". It only adjusts how serious it looks. Anthropic does not train its models on it.
• If it looks serious, Jim and our admins get an alert, so a person can reach out to you. Alerts on a phone screen never show your name or your words.
• Direct messages are not checked. If we ever start checking them, we will update this policy and tell you in the app first.

The check only shows help and alerts a person. It never takes anything down, never pauses or locks an account, and has no legal or similarly significant effect on you. It is not a monitoring or emergency service: nobody watches the community around the clock. In an emergency, call your local emergency number. Our legal bases are our legitimate interest in keeping members safe, your explicit consent to the use of health information (given at sign-up), and, where a life may be at risk, vital interests. You can object (Section 12).

7.6 Reports, Moderation and Blocking

• Before you can post, comment or send a message, you agree to our Community Rules once. We keep the date you agreed.
• Any member can report a post, a comment, a conversation or a member. Only our team sees reports, and the person reported is not told who reported them. When three different members report the same post or comment, it is hidden until our team looks at it.
• Our team (Jim and the admins and moderators he appoints) can take posts and comments down and restore them, pause someone's posting, commenting and messaging for a while, and ban an account. Something taken down stays visible only to its author (with the reason) and to the team. A ban locks the whole account (the app, the chat with Jim's AI Twin and the community) and hides what that person posted while it lasts. How we decide and how to appeal is in our Terms of Service, Section 9.
• Posting limits apply automatically to everyone except the team, to stop spam (for example 4 posts in 10 minutes, and lower limits on an account's first day).
• When you block a member, you no longer see each other's posts, comments, messages or notifications, and you cannot message each other. They are not told. Every block reaches our team as a note on that member, so we can see if someone is causing trouble. Jim and the team cannot be blocked, because they moderate.

7.7 Online Status

While ADHD Harmony is open and in front on one of your devices, that device sends a small "I am here" signal to our server about once a minute, and says so when you leave. The signal carries a random id for that device and whether you are available or in a body doubling call. Other members see a green dot or "Online now" while you are here, "In a call" while you are body doubling, and "Active 5m ago" afterwards.

We keep one line per open device, replaced with each signal and deleted after about a day without one, and on your profile only the time you were last active, which is overwritten each time. We do not keep a history of when you were online. (We do count which days you were active in the community and when you joined body doubling rooms, for streaks and badges.) There is no switch to hide your online status yet. If you object to it, email us (Section 12).

7.8 Live Events, Replays and Body Doubling Rooms

• Events. When you tap "I'm going", other members see you under "Who's going". We send reminders with the join link the day before and 15 minutes before, by push and email, which you can switch off.
• Zoom. Our live calls and webinars run on Zoom. You do not need a Zoom account. When you join, Zoom processes your display name, voice, video, chat messages and device details. The Zoom app itself is also covered by Zoom's privacy statement.
• Recordings and replays. Community calls are usually recorded in Zoom, and Zoom shows when a recording is on. The recording can become a replay in the classroom, so members who missed the call can watch it. A replay can show your display name, face and voice if you speak or have your camera on, and members can watch it. We make captions without speaker names, and the written summary (made by Claude from the transcript) calls members "Member A", "Member B" and never names them. To stay out of a replay, keep your camera off, stay muted, and use a first name or nickname as your Zoom name. If you are in a replay and want out, email us: we will cut that part, blur it or take the replay down where we reasonably can. We record calls on the basis of our legitimate interest in sharing what was taught with members who could not be there.
• Body doubling rooms. Video and sound in body doubling rooms and calls between members go live through LiveKit and are not recorded or stored. Others in the room see and hear you while your camera or microphone is on, and see the step you said you would start with. We note when you join a room and how your session went, if you tell us, for the body doubling badge and your own history.
• With Jim's AI Twin. AI body doubling and voice calls with Jim's AI Twin happen in your private chat, not in the community. Section 6 explains how they work.

7.9 Leaderboards and Weekly Prizes

You get a point each time another member likes your post or comment. Your points, level and place on the leaderboards are visible to members. Every Friday the five members with the most points over the past 7 days win community credit. Their names appear on the leaderboards and in a News post. Our team is never on the leaderboards. We keep a record of the credit you win and use. When you use credit at checkout, our payment provider Stripe receives the amount as a discount. The rules are in our Terms of Service, Section 9.9.

7.10 Your History From Our Skool Community

In October 2026 we moved the community into ADHD Harmony, so the conversations members built together stay in one place. What moved: the member list (name, profile photo, join date, time zone and the city-level spot each member chose on Skool's member map, for everyone still in our Skool community), the posts and comments shared there with their like counts, how far each member got in the classroom, and how many things each member did on Skool per day (a count, so streaks carry over). What did not move: private messages, payment details, and anything posted in other Skool communities. To let you take your posts over, we keep the email addresses Skool holds for our members in a protected table that only our systems can read.

• The community is members only and not shown to search engines: the same circle you shared your posts with on Skool.
• Once you confirm the email address you use on Skool (with a one-time code we send to that address, or by signing in with it through a code or Google), your Skool posts appear on your profile. You can remove any of them, or all of them at once, from your profile.
• People who left our Skool community before the move are shown as"Former member", without a name or photo.
• Do not want your Skool posts here, with or without an account? Email info@adhdharmony.com. We remove them within 30 days and they are not brought over again.

We rely on our legitimate interest in keeping the community and its history together for the members who built it (GDPR Art. 6(1)(f)), and you can object at any time as described above.

7.11 Notifications

We tell you about direct messages, mentions, replies, likes, people and posts you follow, events and news from Jim, by push and email. You choose which, per kind and per channel, in Notification settings (the bell, then the gear). Every email has a one-click unsubscribe link. A daily summary of what you missed is on unless you turn it off; a weekly best-of is off unless you turn it on. Some notices always reach you in the app: when the team took something of yours down, and when you won a prize.

Push notifications reach your browser through its push service (for example Apple, Google or Mozilla) and the phone app through Expo and Apple or Google. To send them, we keep a push address for each device you allowed. It is removed when the device stops accepting pushes, or with your account. Emails go out through Resend.

7.12 Services That Help Run the Community

The service providers in Section 8.1 run the community too. For the community, these matter most:

• Supabase stores everything in this section, including the photos and videos you add to posts, comments and your profile. Those files are stored so that anyone with the exact web address of a file can open it, even without an account. The addresses are long and random and are not listed anywhere public, but please keep this in mind before you post a photo.
• Vercel hosts the app and turns classroom videos and replays into a format that streams well.
• LiveKit carries the live video and sound of body doubling rooms (not recorded).
• Zoom runs live calls and webinars and records them (Section 7.8).
• Anthropic (Claude) gives flagged posts and comments a second read (Section 7.5) and summarises replays.
• GIPHY answers GIF searches. Our server sends the words you search for, not who you are.
• Resend sends emails, and Expo and the push services of Apple, Google and Mozilla deliver push notifications.
• OpenStreetMap (its Nominatim service) turns the city you type into a point on the map. Our server sends only the city name.
• Cloudflare Turnstile checks for bots when people sign up and sign in, which keeps fake accounts out of the community.
• Stripe handles payments, including community credit used at checkout.

Content from other services. When a post contains a YouTube, Loom, Vimeo or Wistia video, a GIF from GIPHY, or a preview of a link, your browser loads it straight from that service or website. That service then receives your IP address and browser details and may set its own cookies, under its own privacy policy. We use YouTube's privacy-enhanced mode. When someone adds a link, our server visits that page once to fetch its title and picture. See our Cookie Policy.

International transfers. Several of these providers are in the United States (for example Zoom, LiveKit, GIPHY, Expo, Resend and Anthropic). We protect these transfers as described in Section 9.

7.13 How Long We Keep Community Data

7.14 Your Choices and Rights in the Community

• Change or remove your name, photo, the line about you and your city in Edit profile, Profile. Without a city you are not on the map.
• Delete your own posts and comments at any time (the ... menu).
• Remove your Skool history from your profile ("Remove mine").
• Block a member, and turn notifications off per kind and channel.
• Something another member posted is about you and you want it gone? Report it, or email us.
• Delete your account in Edit profile, Delete Account. This deletes your community profile, posts, comments, likes and direct messages (whole conversations, for both people).
• Ask for a copy of your community data, or object to online status, the safety check or anything else based on legitimate interests, by emailing info@adhdharmony.com. We stop unless we have compelling reasons to continue, such as someone's safety.

All your other rights are in Section 12.

8. Data Sharing and Third Parties

We share your personal data only as necessary to provide our Service and as described below. We never sell your data.

8.1 Service Providers (Processors)

We work with trusted third-party service providers who process data on our behalf:

All service providers are bound by data processing agreements (DPAs) and are required to process data only as instructed and implement appropriate security measures.

Advertising Measurement (Meta)

We advertise on Facebook and Instagram. On our public sign-up pages (never inside your account) we use Meta's pixel and Conversions API to learn which ads bring people to Harmony. Meta Platforms receives the page you visit, that you signed up or bought something, your IP address and browser details, and cookie ids (_fbp, _fbc). Your email address (as a scrambled hash) and account id are only sent if you ticked the optional box at sign-up. We never send Meta anything you tell Harmony or anything about your health, and the product names we send do not mention ADHD. Meta uses this data under its own privacy policy.

Legal basis and your choice: in the EU, EEA, UK and Switzerland this only happens after you say yes (your consent, Art. 6(1)(a) GDPR). Elsewhere it is on unless you say no. You can change your answer at any time under Your choice on our Cookie Policy page, and we honour Global Privacy Control. Saying no also stops our server from sending Meta events about your account.

8.2 Skool

Our community started on Skool, a separate platform with its own terms and privacy policy. If you join our community on Skool, we receive your name and email address from Skool to set up your ADHD Harmony account. We do not share your ADHD Harmony conversations, check-ins, or health-related data with Skool. How the community and its history moved from Skool into ADHD Harmony is explained in Section 7.10.

8.3 Legal Requirements

We may disclose your data if required by law or when we believe:

• It's necessary to comply with a legal obligation
• It's necessary to protect our rights, property, or safety, or the rights, property, or safety of others
• It's necessary to investigate potential violations of our Terms

8.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

8.5 Aggregated Data

We may share aggregated, anonymized data that cannot identify you for research or statistical purposes.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the EU/EEA, including the United States. When we transfer data internationally, we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework (DPF): Several of our US-based service providers are certified under the EU-US Data Privacy Framework, recognized by the European Commission as providing an adequate level of data protection (Adequacy Decision of July 10, 2023)
• Standard Contractual Clauses (SCCs): We use EU-approved SCCs with our service providers as supplementary safeguards
• Data Processing Agreements: All providers have binding DPAs with GDPR-compliant terms
• Supplementary Measures: Including encryption in transit and at rest

For transfers to the US, our AI providers (Anthropic, OpenAI) have committed to not using your data for training and to deleting processed data within their retention windows.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest
• Password Security: Passwords are hashed using industry-standard algorithms (bcrypt)
• Access Controls: Strict access controls and authentication for all systems, including row-level security in our database so users can only access their own data and what other members share with them in the community
• Secure Infrastructure: We use enterprise-grade cloud providers with SOC 2 certification
• Regular Updates: Systems are regularly updated and patched
• Monitoring: Continuous security monitoring and logging

While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify you and the relevant supervisory authority of any personal data breach as required by law (including GDPR Articles 33 and 34).

11. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

Account Deletion: When you delete your account, we will delete your personal data within 30 days, except where we are legally required to retain it (e.g., for tax or legal compliance purposes) or where limited residual copies persist temporarily in encrypted backups and logs, which are deleted on their normal rotation schedule.

12. Your Privacy Rights

Under the GDPR, UK GDPR, and other applicable laws, you have comprehensive rights regarding your personal data:

12.1 Rights for All Users

12.2 How to Exercise Your Rights

You can exercise your rights by:

• In-App: Use account settings to update profile, delete chats, disconnect integrations, or delete your account. In the community you can also delete your posts and comments, remove your Skool history, block members and change your notifications (Section 7.14)
• Email: Contact us at info@adhdharmony.com (including for data access and portability requests)

We will respond to your request within 30 days (extendable by 60 days for complex requests). We may ask you to verify your identity before processing your request. Exercising your rights is free of charge.

12.3 Right to Lodge a Complaint

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

You may also lodge a complaint with the supervisory authority in your own EU/EEA country of residence, or, if you are in the UK, with the Information Commissioner's Office (ICO) at ico.org.uk.

13. United States Privacy Rights

If you are a resident of a US state with a comprehensive privacy law (including California, Colorado, Connecticut, Texas, Utah, Virginia, and Washington), you may have the following rights, which we honor for all US users:

• Right to Know/Access: Request the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Portability: Receive a copy of your data in a portable format
• Right to Opt Out of Sale/Sharing: We do not sell your personal information for money. On our public sign-up pages we share limited data with Meta to measure our ads (Section 8), which some state laws treat as "sharing" for cross-context behavioral advertising. You can opt out at any time under Your choice on our Cookie Policy page, and we honour Global Privacy Control
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Health and chatbot-specific protections: We do not sell or share with third parties the individually identifiable health information you provide to the Service or your inputs to our AI, consistent with US state laws governing mental health chatbots and consumer health data (including Washington's My Health My Data Act and Utah's and California's chatbot laws). Our AI clearly discloses that it is not human, and it is designed to refer users expressing thoughts of self-harm or suicide to crisis resources such as the 988 Suicide & Crisis Lifeline (US) and findahelpline.com. Health details you choose to post in the community are seen by other members because you share them there (Section 7.3); we do not sell them or share them with anyone else for advertising.

To exercise any of these rights, email us at info@adhdharmony.com. You may use an authorized agent where permitted by your state's law; we will verify the request as required.

14. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. For detailed information, please see our Cookie Policy.

In summary, we use:

• Essential Cookies: Required for authentication, security, and core functionality (cannot be disabled)
• Analytics: Privacy-friendly, anonymized analytics (Vercel Analytics); in the EU, EEA, UK and Switzerland we ask for your consent before enabling it on our public pages
• Meta pixel: on our public sign-up pages only, to measure our ads (Section 8); you can say no at any time
• Content from other services in the community: videos (YouTube, Loom, Vimeo, Wistia), GIFs (GIPHY) and link previews load from those services, which may set their own cookies (Section 7.12)

Inside your account we use no advertising cookies. For full details and to change your choice, please see our Cookie Policy.

15. Age Requirement

Our Service is intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18, and we will terminate accounts we discover belong to minors. If you are a parent or guardian and become aware that your child has provided us with personal data, please contact us immediately at info@adhdharmony.com. We will take steps to delete such information.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Notification of Changes: For significant changes, we will:

• Post a prominent notice on our website
• Send you an email notification (if you have an account)
• Request your consent if required for new processing activities

We encourage you to review this Privacy Policy periodically. The"Last updated" date at the top indicates when the policy was last revised.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We have conducted a Data Protection Impact Assessment (DPIA) for our processing of health-related data through AI systems, as required by GDPR Article 35. This assessment is available to the Dutch Data Protection Authority upon request.

By using ADHD Harmony, you acknowledge that you have read and understood this Privacy Policy.