This Privacy Policy explains how The Recalibrate Program, LLC collects, uses, discloses, retains, and protects personal information when you use Brea. The Recalibrate Program, LLC is the controller or business responsible for information you provide directly to Brea, unless a specific notice says otherwise.

This Policy applies to Brea’s application, website, Capacity Intelligence features, Talk to Brea, reports, support, and related services. It does not govern an employer’s independent handling of eligibility or employment information.

Brea is not generally a healthcare provider, health plan, healthcare clearinghouse, or business associate merely because the Service handles health related information. Information in Brea may therefore not be protected by the US Health Insurance Portability and Accountability Act. It is protected as described in this Policy and by other applicable consumer health and privacy laws.

The information collected depends on the features you use and permissions you grant.

Brea collects information directly from you, automatically from your device and use of the Service, and from your employer solely to establish programme eligibility or access. Brea may receive information from service providers that help with account authentication, security, support, infrastructure, analytics, and communications.

Provide the Service.

Create and manage your account, verify programme eligibility, conduct conversations, generate Capacity Intelligence, produce reports, remember your history, and provide requested features.

Personalise and improve.

Understand patterns, improve relevance and accessibility, test and develop features, and evaluate performance using appropriately protected information.

Safety response.

Recognise the meaning of a voluntary safety disclosure, ask limited clarification where genuinely ambiguous, pause ordinary engagement, and display appropriate human, crisis, or emergency options.

Security and support.

Authenticate users, prevent misuse, troubleshoot problems, respond to requests, protect the Service, and investigate security events.

Anonymous programme reporting.

Create employer reports only in anonymous, aggregated groups of at least 10 users, with additional suppression where needed.

Legal and organisational needs.

Comply with law, establish or defend legal claims, enforce terms, complete audits, and manage a corporate transaction subject to applicable protections.

Where data protection law requires a legal basis, Brea relies on one or more of the following:

• your explicit consent to process health information and other special category or sensitive information where required;
• performance of the agreement with you, including providing requested Brea features;
• Brea's legitimate interests in securing, supporting, evaluating, and improving the Service, provided those interests do not override your rights;
• compliance with legal obligations and protection of legal rights; and
• protection of vital interests where applicable law permits and the circumstances require it.

You may withdraw consent at any time through available settings, by deleting information or your account, or by contacting Brea. Withdrawal does not affect processing already lawfully completed, but may prevent Brea from providing features that require the information.

Brea uses AI and rules based systems to conduct conversations and generate personalised insights. External AI providers may process information only under Brea’s instructions to provide the Service. They are not permitted to use Brea information to train their general purpose models.

Brea does not use your personal information, health information, private conversations, or Capacity information to train general purpose AI models. Brea may evaluate and improve its own Service using deidentified or aggregated information that is not reasonably capable of being linked to you, and may use limited personal information for testing or correction where permitted, necessary, access controlled, and consistent with your rights.

Brea’s outputs may influence the information and suggestions displayed to you, but Brea does not use automated decision making to make employment, insurance, credit, healthcare eligibility, or similarly significant decisions about you.

Your employer cannot see your individual Brea experience.

Brea does not disclose your identifiable health information, conversations, Capacity Profile, Capacity State, safety disclosures, or individual use history to your employer, manager, or human resources.

Brea may provide anonymous, aggregated programme reporting only when at least 10 users are included. Brea may combine categories, delay reporting, or suppress a result where a smaller subgroup or unusual response could permit identification. Employers may receive administrative information needed to confirm aggregate programme uptake, but not a named record of sensitive feature use.

Brea does not sell personal information or consumer health data. Brea does not share personal information for cross context behavioural advertising and does not use health information for targeted advertising. Brea may disclose information only as follows:

• Service providers. Vendors that provide hosting, security, authentication, customer support, communications, analytics, and AI processing under contracts restricting their use, access, retention, and disclosure.
• Employer programme administration. Limited eligibility or programme administration information and anonymous aggregate reporting as described above, never identifiable health or conversation information.
• At your direction. A person or service you affirmatively choose, such as when you download and share a report.
• Legal and safety requirements. Authorities or other parties when Brea reasonably believes disclosure is legally required, necessary to protect legal rights, or permitted to address fraud, security, or unlawful activity. The Safety Protocol does not automatically notify any person or authority.
• Corporate transaction. A prospective or actual buyer, investor, lender, or successor under confidentiality and privacy protections in connection with financing, restructuring, merger, acquisition, or sale. Brea will provide notice where law requires.
• Deidentified information. Information that has been processed so it cannot reasonably identify or be linked to you, subject to commitments not to attempt reidentification.

Brea does not permit personnel to routinely read confidential conversations. A limited number of authorised personnel may access identifiable information only when necessary for user requested support, security and fraud investigation, technical troubleshooting, or legal compliance. Access is limited according to role and subject to confidentiality and security obligations.

Brea does not monitor Talk to Brea in real time and does not automatically notify the Brea team, emergency services, a trusted contact, a healthcare professional, an employer, a manager, or human resources when a user makes a safety disclosure. Brea may pause ordinary interaction and display human support, crisis, or emergency options.

Safety disclosures are never included in identifiable employer reports. If disclosure is separately required by binding law or legal process, Brea will assess the request and disclose only what is legally required, where permitted providing notice to the user.

Brea is based in the United States and may process information in the United States and other countries where Brea or its service providers operate. Those countries may have different data protection laws from your country.

Where required, Brea uses recognised transfer safeguards, such as adequacy decisions, contractual clauses, contractual addenda, or another lawful transfer mechanism. Mandatory privacy and consumer rights in your country continue to apply.

Brea retains personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining security, complying with law, and resolving disputes.

• Account, health, conversation, and Capacity information is retained while your account is active unless you delete particular information sooner.
• When you delete your account, Brea begins deletion promptly and deletes or deidentifies active personal and health information within 30 days, subject to limited legal and security exceptions.
• Residual information in encrypted backups is deleted or overwritten within 90 days and is not returned to ordinary use.
• Limited records may be retained longer where reasonably necessary to comply with law, document consent or deletion, protect security, or establish or defend legal claims.
• Brea may retain properly deidentified aggregate information that is not reasonably capable of identifying you.

Deleting the application does not delete your account. You may delete your account in the application or contact Brea. Deletion may be irreversible and may remove the history required for personalised features.

Brea uses reasonable administrative, technical, and organisational safeguards appropriate to the sensitivity of the information. These include access controls, confidentiality obligations, secure transmission, vendor controls, monitoring, and processes for responding to security events. No method of storage or transmission is completely secure.

If a breach affects information protected by an applicable breach notification law, including the FTC Health Breach Notification Rule where applicable, Brea will investigate and provide notices to affected users, regulators, and others as required.

Brea extends the following rights to users, subject to identity verification, legal exceptions, and technical feasibility:

• access and obtain a copy of personal information associated with you;
• correct inaccurate account or personal information;
• delete particular information or your account;
• withdraw consent for processing based on consent;
• object to or request restriction of certain processing;
• receive portable information where applicable;
• appeal a denial of a privacy request where applicable; and
• not be discriminated against for exercising a privacy right.

You may exercise available controls in the Service or email info@therecalibrateprogram.com. Brea may verify your identity and authority before completing a request. Brea aims to respond within 30 days or the period required by applicable law and will explain any lawful extension or denial.

Depending on where you live, you may have additional rights under laws including the European Union General Data Protection Regulation, United Kingdom GDPR, Swiss data protection law, Canadian privacy laws, the California Consumer Privacy Act, other US state privacy and consumer health laws, Australia’s Privacy Act, New Zealand’s Privacy Act, and South Africa’s Protection of Personal Information Act.

These may include rights to complain to a supervisory authority, limit use of sensitive information, confirm whether data is processed, obtain information about recipients, opt out of sale or targeted advertising, revoke consent, and appeal a decision. Brea does not sell information or share it for targeted advertising, so an opt out does not change those practices.

If you are in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction requiring a local representative or privacy contact, Brea will publish the applicable representative details before making the Service available where required.

Consumer health data means personal information that identifies or can reasonably be linked to you and relates to your past, present, or future physical or mental health, reproductive or sexual health, healthcare, or an inference about health. This includes the health, menopause, symptom, Capacity, reflection, conversation, pattern, correlation, trend, and other inferred information described in this Policy.

Sources and purposes.

Brea collects consumer health data directly from you, from your use of the Service, and from information generated or inferred by Brea from those sources. Employers do not provide Brea with your health information. Brea processes consumer health data to provide and personalise the Service; create Capacity Profiles, Capacity States, patterns, trends, reflections, reports, and suggestions; conduct Talk to Brea conversations; recognise voluntary safety disclosures and display support options; secure, troubleshoot, evaluate, and improve the Service; create anonymous aggregate programme reporting for groups of at least 10 users; comply with law; and establish or defend legal rights.

Consent.

Where required by law, Brea requests your consent before collecting or processing consumer health data. You may withdraw consent at any time through available settings, by deleting information or your account, or by contacting Brea. Withdrawal does not affect processing already lawfully completed, but may prevent Brea from providing features that rely on the information.

Recipients.

Brea may disclose consumer health data only to service providers operating under contractual restrictions; a person or service you direct; a successor in a financing, restructuring, merger, acquisition, or sale subject to legally required confidentiality, notice, consent, and other protections; or authorities and other parties when disclosure is required by binding law or valid legal process or otherwise expressly permitted by applicable law. Brea does not disclose identifiable consumer health data to employers, managers, or human resources.

No sale or advertising use.

Brea does not sell consumer health data, use it for advertising, share it for cross-context behavioral advertising, or permit advertising trackers inside authenticated health and conversation areas.

Consumer health data rights.

Subject to applicable law and verification, you may confirm whether Brea collects, shares, or sells consumer health data concerning you; access that data and obtain a copy; obtain the categories of third parties and, where required, the specific third parties that received it; withdraw consent for collection or sharing; correct inaccurate information; request deletion, including from applicable processors; and appeal a refusal to act on a request. Brea will notify relevant processors and other recipients of a valid deletion request where required by law. Use available account controls or email info@therecalibrateprogram.com. If Brea denies a request, its response will explain the reason and any available appeal process.

Brea is for adults aged 18 and older. Brea does not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided information, contact Brea so it can investigate and delete the information as appropriate.

Brea may update this Policy to reflect changes in law, technology, features, or practices. If a change materially affects how Brea uses sensitive information, Brea will provide reasonable notice and obtain renewed consent where required. The effective date identifies the current version.

For privacy questions, requests, appeals, or complaints, contact: