Privacy Policy

Last updated: July 6, 2026

1. Introduction

ADHD Harmony B.V. ("ADHD Harmony," "we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Harmony AI, accessible at app.adhdharmony.com, our companion mobile application, our website at adhdharmony.com, and related services (collectively, the "Service").

This Privacy Policy applies to all users of our Service, including those in the European Union/European Economic Area (EU/EEA), United Kingdom, United States, and worldwide. By using our Service, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller Information

For the purposes of the EU General Data Protection Regulation (GDPR) and other applicable data protection laws, the data controller responsible for your personal data is:

For any privacy-related inquiries, data access requests, or complaints, please contact us at info@adhdharmony.com.

3. Personal Data We Collect

We collect personal data that you provide directly, data generated through your use of our Service, and data from third-party integrations you authorize.

3.1 Data You Provide Directly

3.2 Data from Optional Third-Party Integrations

If you choose to connect third-party services, we access and store the following data with your explicit consent:

• Google Tasks: Your task lists and individual tasks (read and write access to display and manage within the app)
• Google Calendar: Calendar events to help you manage your schedule (read access and ability to create events)
• Human Design / birth data (optional): If you use our optional Human Design feature, you may provide your birth date, time, and location, which is sent to a specialized third-party chart service (BodyGraph) to generate your chart

Important: We only access the specific services you authorize. We do not access your Gmail, Google Drive (except documents you explicitly upload), contacts, or other Google services. You can revoke Google access at any time through your account settings or at Google Account Permissions.

3.3 Automatically Collected Data

When you use our Service, we automatically collect:

• Technical Data: IP address, browser type and version, device type, operating system, time zone, and language preferences
• Usage Data: Pages visited, features used, click patterns, session duration, and interaction data
• Location Data: Approximate location derived from IP address (city/country level only)
• Technical Logs: Application logs used for security, debugging, and reliability, which may contain identifiers such as your user ID or email address

3.4 Sensitive Personal Data (GDPR Article 9)

Our Service is designed for individuals with ADHD. By creating an account and using our wellness features, you share health-related data that qualifies as "special category data" under GDPR Article 9. This includes:

• ADHD-related information: Your experiences, challenges, coping strategies, diagnoses you choose to share, and goals shared in your profile and conversations
• Daily check-in scores: Mood, energy, focus, happiness, calmness, and motivation ratings
• Personal reflections: Notes about your mental and emotional state
• AI-derived insights and memories: Patterns, trends, and facts our AI identifies from your wellness data and conversations to personalize your coaching

We process this data based on your explicit consent, which you provide during account registration through a dedicated, affirmative consent action that is separate from your acceptance of our Terms of Service. This consent is required to use the Service, as processing health-related data is integral to providing the personalized AI coaching that is the core purpose of ADHD Harmony.

This data is processed with the highest care and security, and solely to provide you with personalized coaching and wellness support. We never sell this data or share it with third parties for advertising purposes. You may withdraw your consent at any time by deleting your account, which will result in the deletion of your personal data as described in Section 10.

4. Legal Basis for Processing (GDPR)

Under the GDPR, we must have a valid legal basis for processing your personal data. We rely on the following legal bases:

You may withdraw your consent at any time for processing activities based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. How We Use Your Data

We use your personal data for the following purposes:

5.1 Service Delivery

• Provide, maintain, and operate the Harmony AI platform
• Personalize your AI coaching experience using your profile, conversation history, memories, and check-ins
• Generate insights and patterns from your check-ins and worksheets
• Enable AI agents to reference your knowledge base for context
• Display and manage your Google Tasks and Calendar events
• Provide voice conversations, transcription, and body doubling features with voice/video capabilities

5.2 Communication

• Send essential service notifications and updates
• Respond to your support requests and inquiries
• Send marketing communications (only with your explicit consent, and you can unsubscribe at any time)

5.3 Improvement and Analytics

• Analyze usage patterns to improve features and user experience
• Identify and fix technical issues
• Develop new features based on aggregate usage insights

5.4 Security, Safety, and Legal

• Protect against unauthorized access, fraud, and abuse
• Review and respond to safety reports, including reports of concerning AI output
• Enforce our Terms of Service
• Comply with legal obligations

6. AI and Automated Processing

Harmony AI uses artificial intelligence to provide personalized coaching and support. This section explains how AI processes your data.

6.1 AI Transparency (EU AI Act)

6.2 How AI Is Used

We use AI models from Anthropic (Claude) as our primary provider and OpenAI for specific features, to:

• Analyze your messages and provide contextual, helpful responses
• Reference your knowledge base documents to give informed answers
• Generate insights based on your check-ins and worksheets
• Personalize coaching based on your profile information and memories the AI keeps about your preferences, goals, and patterns (which you can review and manage)
• Create conversation titles and summaries
• Transcribe voice recordings to text (using OpenAI Whisper) and power real-time voice conversations
• Generate spoken audio of AI responses (using ElevenLabs text-to-speech)

6.3 No Training on Your Data

6.4 Human Oversight and Safety

While AI processes your requests, all coaching frameworks, system prompts, and safety guidelines are designed and maintained by humans. The AI operates within defined boundaries, is instructed never to diagnose conditions or give medication advice, and includes safety protocols that refer users to crisis resources (such as findahelpline.com and local emergency services) when a conversation indicates crisis, self-harm, or suicidal ideation. You can report concerning AI output at any time via the in-app feedback option.

6.5 No Automated Legal Decisions

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects concerning you. The AI provides coaching and suggestions only. All decisions remain yours.

6.6 Your Rights Regarding AI Processing

Under GDPR Article 22 and related provisions, you have the right to:

• Request information about the logic involved in AI processing
• Request human review of AI-generated insights
• Object to certain forms of automated processing

7. Data Sharing and Third Parties

We share your personal data only as necessary to provide our Service and as described below. We never sell your data.

7.1 Service Providers (Processors)

We work with trusted third-party service providers who process data on our behalf:

All service providers are bound by data processing agreements (DPAs) and are required to process data only as instructed and implement appropriate security measures.

7.2 Community Platform (Skool)

Our educational program and community are hosted on Skool, a separate platform with its own terms and privacy policy. If you join our community on Skool, we receive your name and email address from Skool to set up your Harmony AI account. We do not share your Harmony AI conversations, check-ins, or health-related data with Skool.

7.3 Legal Requirements

We may disclose your data if required by law or when we believe:

• It's necessary to comply with a legal obligation
• It's necessary to protect our rights, property, or safety, or the rights, property, or safety of others
• It's necessary to investigate potential violations of our Terms

7.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

7.5 Aggregated Data

We may share aggregated, anonymized data that cannot identify you for research or statistical purposes.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the EU/EEA, including the United States. When we transfer data internationally, we ensure appropriate safeguards are in place:

• EU-US Data Privacy Framework (DPF): Several of our US-based service providers are certified under the EU-US Data Privacy Framework, recognized by the European Commission as providing an adequate level of data protection (Adequacy Decision of July 10, 2023)
• Standard Contractual Clauses (SCCs): We use EU-approved SCCs with our service providers as supplementary safeguards
• Data Processing Agreements: All providers have binding DPAs with GDPR-compliant terms
• Supplementary Measures: Including encryption in transit and at rest

For transfers to the US, our AI providers (Anthropic, OpenAI) have committed to not using your data for training and to deleting processed data within their retention windows.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest
• Password Security: Passwords are hashed using industry-standard algorithms (bcrypt)
• Access Controls: Strict access controls and authentication for all systems, including row-level security in our database so users can only access their own data
• Secure Infrastructure: We use enterprise-grade cloud providers with SOC 2 certification
• Regular Updates: Systems are regularly updated and patched
• Monitoring: Continuous security monitoring and logging

While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but will notify you and the relevant supervisory authority of any personal data breach as required by law (including GDPR Articles 33 and 34).

10. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

Account Deletion: When you delete your account, we will delete your personal data within 30 days, except where we are legally required to retain it (e.g., for tax or legal compliance purposes) or where limited residual copies persist temporarily in encrypted backups and logs, which are deleted on their normal rotation schedule.

11. Your Privacy Rights

Under the GDPR, UK GDPR, and other applicable laws, you have comprehensive rights regarding your personal data:

11.1 Rights for All Users

11.2 How to Exercise Your Rights

You can exercise your rights by:

• In-App: Use account settings to update profile, delete chats, disconnect integrations, or delete your account
• Email: Contact us at info@adhdharmony.com (including for data access and portability requests)

We will respond to your request within 30 days (extendable by 60 days for complex requests). We may ask you to verify your identity before processing your request. Exercising your rights is free of charge.

11.3 Right to Lodge a Complaint

If you believe we have not adequately addressed your concerns, you have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is:

You may also lodge a complaint with the supervisory authority in your own EU/EEA country of residence, or, if you are in the UK, with the Information Commissioner's Office (ICO) at ico.org.uk.

12. United States Privacy Rights

If you are a resident of a US state with a comprehensive privacy law (including California, Colorado, Connecticut, Texas, Utah, Virginia, and Washington), you may have the following rights, which we honor for all US users:

• Right to Know/Access: Request the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Portability: Receive a copy of your data in a portable format
• Right to Opt Out of Sale/Sharing: We do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Health and chatbot-specific protections: We do not sell or share with third parties the individually identifiable health information you provide to the Service or your inputs to our AI, consistent with US state laws governing mental health chatbots and consumer health data (including Washington's My Health My Data Act and Utah's and California's chatbot laws). Our AI clearly discloses that it is not human, and it is designed to refer users expressing thoughts of self-harm or suicide to crisis resources such as the 988 Suicide & Crisis Lifeline (US) and findahelpline.com.

To exercise any of these rights, email us at info@adhdharmony.com. You may use an authorized agent where permitted by your state's law; we will verify the request as required.

13. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. For detailed information, please see our Cookie Policy.

In summary, we use:

• Essential Cookies: Required for authentication, security, and core functionality (cannot be disabled)
• Analytics: Privacy-friendly, anonymized analytics (Vercel Analytics); on our public pages we ask for your consent before enabling analytics

We do not use advertising or cross-site tracking cookies. For full details, please see our Cookie Policy.

14. Age Requirement

Our Service is intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18, and we will terminate accounts we discover belong to minors. If you are a parent or guardian and become aware that your child has provided us with personal data, please contact us immediately at info@adhdharmony.com. We will take steps to delete such information.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Notification of Changes: For significant changes, we will:

• Post a prominent notice on our website
• Send you an email notification (if you have an account)
• Request your consent if required for new processing activities

We encourage you to review this Privacy Policy periodically. The"Last updated" date at the top indicates when the policy was last revised.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We have conducted a Data Protection Impact Assessment (DPIA) for our processing of health-related data through AI systems, as required by GDPR Article 35. This assessment is available to the Dutch Data Protection Authority upon request.

By using Harmony AI, you acknowledge that you have read and understood this Privacy Policy.