PRIVACY POLICY
Last updated: October 15, 2026
This Privacy Policy explains what information Apollonian, Inc. ("Apollonian," "we," or "us") collects, how we use and share it, and the choices you have.
THE SHORT VERSION
- We do not sell your information, and we do not use it for advertising.
- We do not use advertising or analytics trackers.
- Your therapist sees the monitoring information you share with them. If you are connected with a therapist, they can also see your activity use and that you journaled (how often and when), but never what you wrote in your journal. Our emails never include your health details.
- You can delete your account from your Profile page.
1. HOW HIPAA APPLIES
- If your therapist uses Apollonian: your therapist is a "covered entity" under HIPAA and Apollonian is their "business associate." We handle your health information under HIPAA and our Business Associate Agreement with your therapist. Your therapist's Notice of Privacy Practices also applies, and HIPAA requests (such as access, amendment, or an accounting of disclosures) generally go to your therapist; we help them respond.
- If you sign up on your own, without a therapist: HIPAA may not apply to the information you give us directly. We still protect it with the same safeguards described in this policy, and this policy governs how we use it.
- If you are a therapist: this policy also covers your account and professional information.
2. INFORMATION WE COLLECT
Account information: your email address, name, and login details. Sign-in is handled by Google Firebase Authentication (including "Continue with Google"). Your password is held by Firebase, not by Apollonian.
Therapist information: professional details such as license, credentials, NPI, practice information, and tax ID.
Health information you or your therapist enter, such as:
- Daily check-ins (for example mood, anxiety, low mood, sleep, energy, whether you feel safe, medication taken, and optional notes);
- Questionnaire answers and scores, such as the PHQ-9 and GAD-7;
- Journal entries, mood ratings, and activity use (Premium);
- Answers you give when you look for a therapist (for example, the "Check My Fit" screener);
- Notes and records your therapist keeps about your care.
Insurance and billing information: insurance company, member and group numbers, date of birth, address, diagnosis and procedure codes, dates of service, superbills, documents and insurance card images you upload, and claim status and payment details.
Payment information: payments are processed by Stripe. We do not store full card numbers.
Technical information: IP address, browser and device type, pages visited, and timestamps. We keep logs of access to health information for security and compliance.
Cookies: we use only cookies needed to run the Service, such as keeping you signed in and protecting forms. We do not use advertising or analytics cookies.
3. HOW WE USE INFORMATION
We use information to:
- Provide the Service, including check-ins, questionnaires, activities, journal, superbills, and claims;
- Share monitoring information and your activity use, and the fact that you journaled (not what you wrote), with the therapist you are connected to, and alert them by email (without details) if you report not feeling safe;
- Submit insurance claims and check eligibility, claim status, and payments;
- Process payments and manage subscriptions;
- Send account, safety, reminder, and support emails;
- Keep the Service secure, prevent fraud, and meet legal obligations;
- Improve the Service, using de-identified or aggregated information where possible.
We do not use your health information for advertising or marketing, and we do not use your information to train AI models.
4. AI FEATURES (GOOGLE CLOUD VERTEX AI)
Some features send information to Google's Gemini models, through Google Cloud Vertex AI, to process it and return a result:
- Reading an uploaded superbill or insurance card: the document or image is sent, which may include your name, date of birth, address, insurance numbers, diagnosis and procedure codes, and provider details;
- Journal reflections and weekly insights (Premium): your journal entries and mood ratings are sent, along with any conversations from earlier in-app chat features;
- Suggested messages for therapists: when a therapist uses this tool, only engagement information is sent (for example how often the client journaled and which activities they completed), never journal text.
Check-ins and questionnaires (PHQ-9, GAD-7) are not sent to AI. AI output can be wrong; please review it.
5. HOW WE SHARE INFORMATION
We share information only:
- With the therapist or practice you connect with, and with Apollonian staff who need it to support you;
- With your insurance company, through our clearinghouse, when a claim is submitted or eligibility is checked;
- With the service providers listed below, who work for us under contracts that limit their use of the information;
- When required by law, or when needed to protect someone's safety;
- As part of a merger, acquisition, or sale of assets, subject to this policy; or
- With your permission.
We do not sell personal information or health information.
6. SERVICE PROVIDERS (SUBPROCESSORS)
- Google Cloud (Google LLC): hosting, database, file storage, scheduled jobs, Firebase Authentication (sign-in: email, name, and login tokens), and Vertex AI for the AI features described in Section 4 (Google's Gemini models). Stores all Service data.
- Stedi, Inc.: insurance clearinghouse. Claim, eligibility, claim status, and remittance information.
- Stripe, Inc.: payments and subscriptions. Payment details and billing contact information.
- Twilio SendGrid: email delivery. Email address and email content, which we design not to include health details.
- Content delivery networks (such as Google Fonts, jsDelivr, cdnjs, and Stripe.js): load fonts and scripts in your browser and receive your IP address and browser information.
7. SECURITY
We protect information with encryption in transit (TLS), encryption at rest by our hosting provider, additional encryption for tax IDs, role-based access controls, append-only audit logs of access to health information, automatic sign-out after one hour of inactivity, and rate limiting. No system is perfectly secure. If a breach affects your information, we will notify you and others as required by law, including HIPAA and the FTC Health Breach Notification Rule where they apply.
8. HOW LONG WE KEEP INFORMATION
We keep information while your account is open and as long as needed to provide the Service. After that, we keep information only as long as needed for legal, tax, billing, security, or dispute purposes. Audit logs of access to health information are kept for at least six years. Therapists are responsible for keeping their own clinical records for the period their state requires.
9. YOUR CHOICES AND RIGHTS
- See and update: you can see and update your profile and much of your information in the app.
- Download: you can download your superbills at any time. To ask for a copy of other information, email
privacy@apollonian.health.
- Delete: clients can permanently delete their account from their Profile page ("Delete Account"). This deletes your account and the information linked to it, including check-ins, journal entries, and superbills, and cannot be undone. Download any superbills you need first. Audit logs are kept as described above, and your therapist may keep information in their own records as the law requires. Therapists can ask us to close their account at
support@apollonian.health.
- Stop monitoring: tell your therapist if you want to stop remote therapeutic monitoring.
- Emails: you will receive account, safety, and billing emails while your account is open.
- Depending on where you live, you may have other rights, such as to access, correct, or delete information or to appeal our decision. To use them, email
privacy@apollonian.health. We will verify your request and respond within the time the law requires.
10. CHILDREN
The Service is for people 18 and older. We do not knowingly collect information from children under 18. If you believe a child has created an account, contact
privacy@apollonian.health and we will delete it.
11. WHERE INFORMATION IS STORED
We store information in the United States. Some service providers may process information in other locations under their own security commitments.
12. CHANGES TO THIS POLICY
If we make a material change, we will tell you by email or in the app before it takes effect, and we may ask you to accept the new version.
13. CONTACT
Privacy questions or requests:
privacy@apollonian.healthGeneral support:
support@apollonian.health