1. Introduction

Brother's Keeper ("we," "us," "our," or "Service") is committed to protecting the privacy and confidentiality of all users. This Privacy Policy explains how we collect, use, store, share, and protect your information.

By using this Service, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Information You Provide

• Account Registration: Email address, full name, role designation (peer specialist or responder)
• Profile Information: For peer specialists - agency type, years of service, biography, areas of expertise, experience highlights, certifications, specializations, availability schedule, profile images
• Credential Documents: For peer specialists - training certificates, licenses, certifications uploaded for verification
• Session Messages: All text communications exchanged during peer support sessions
• Feedback and Ratings: Star ratings, written comments, testimonials, and issue reports submitted after sessions
• Training Responses: Quiz answers, module completion data, time spent on training materials
• Phone Numbers: For administrators who opt in to receive SMS safety alerts. By checking the SMS consent checkbox during account setup or in Account Settings, administrators consent to receive urgent SMS notifications when Duty to Act protocols are activated. Opt-in is always voluntary and explicit. Administrators may opt out at any time by replying STOP to any message or by removing their phone number in Account Settings. Message and data rates may apply.

2.2 Information We Collect Automatically

• Usage Data: Session duration, number of messages, time on duty, session frequency, connection timestamps
• Device Information: IP address, browser type, operating system, device identifiers
• Performance Data: Error logs, crash reports, response times, system diagnostics
• Behavioral Analytics: Feature usage patterns, page views, click-through rates, navigation paths

2.3 Sensitive Personal Information

The Service may process sensitive personal information including:

• Mental health and emotional well-being discussions
• Workplace stress and trauma experiences
• Personal crises and challenging life events
• Occupational health information

You should not share protected health information (PHI) such as medical diagnoses, prescribed medications, or treatment details through this Service.

3. Responder Privacy

Your privacy is important, but it is not absolute. Please understand:

• Your account is linked to your records. Sessions are associated with your user account, and your identifying information is retained by the platform.
• Peer specialists do not see your name or contact details during a session; they see only what you choose to share.
• Access to your session content (messages, identity, situation details) is limited to authorized session participants. The platform owner can access session content only under an active, verified Duty to Act protocol for your exact session — initiated by the assigned peer specialist, logged in a permanent audit trail, and re-verified on every request. Resolution denies further requests; an already-open emergency view clears on close or expiry of its 60-second display lease. These restrictions apply only within the app UI and API; they are not cryptographic protection, and a person with Base44 workspace, database, or service-role access (including the workspace owner) can technically bypass them. Hosting administrators (Base44) can access data as needed for operations and support.
• Conversations are not end-to-end encrypted. Data in transit is protected with standard SSL/TLS, but the platform can read stored content.
• Automatic message cleanup is currently paused. Messages may remain stored, and no 24-hour deletion is guaranteed. Do not assume messages will be automatically removed.

4. How We Use Your Information

• Facilitate peer support connections
• Verify peer specialist credentials and qualifications
• Improve service quality through feedback analysis
• Send notifications about training, invitations, and system updates
• Generate anonymized usage statistics
• SMS Safety Alerts: Send urgent text message notifications to administrators who have explicitly opted in, when peer specialists flag critical safety situations requiring immediate intervention. Administrators may opt out at any time by replying STOP or updating their Account Settings.

5. Data Retention and Deletion

• Session Messages: Automatic cleanup is currently paused. Messages may remain stored until cleanup is re-enabled or an administrator manually removes them. No 24-hour deletion is guaranteed.
• Session Metadata: Duration, timestamps, participant roles (without message content) - retained indefinitely for quality improvement, analytics, and regulatory compliance
• Account Information: Retained as long as your account remains active, and thereafter as long as necessary for the purposes described, and no longer than 7 years for legally required records; message content deleted per the retention schedule, to comply with legal obligations
• Feedback and Testimonials: Retained anonymously indefinitely for service improvement and marketing purposes
• Training Records: Retained for the duration of peer specialist service, plus as long as necessary for the purposes described, and no longer than 7 years for legally required records; message content deleted per the retention schedule, for compliance and credentialing purposes
• Credentials and Certifications: Retained for the duration of peer specialist service, plus as long as necessary for the purposes described, and no longer than 7 years for legally required records; message content deleted per the retention schedule
• Backup Data: May persist in backup systems for up to as long as necessary for the purposes described, and no longer than 7 years for legally required records; message content deleted per the retention schedule, after deletion from active systems

We retain information for as long as necessary to fulfill the purposes outlined in this policy unless a longer retention period is required or permitted by law.

6. Who Can Access Your Information

• Platform Owner: Shawn Woods (workspace owner) handles administration and safety. Session content (messages, responder identity, situation details) is accessed only under an active, verified Duty to Act protocol for the exact session — audited per request, not blanket access. This is an application-level restriction enforced within the app UI and API only; it is not a cryptographic guarantee, and a person with Base44 workspace, database, or service-role access (including the workspace owner) can technically bypass it. Operational metadata (e.g., aggregate metrics, alert status) is available without content.
• Session Participants: The peer specialist in your session and you can see the messages exchanged in that session.
• Administrators: Can view peer profiles, credentials, and aggregate metrics.
• Hosting Staff (Base44): As the hosting provider, Base44 administrators can access data as needed for platform operations, maintenance, and support.
• Not end-to-end encrypted: Because the platform and hosting staff can access stored data, your conversations are not end-to-end encrypted.
• Responders: Your name and contact details are not shown to peer specialists during a session, but your records are linked to your account and are accessible to the parties above.
• Third Parties: We do not sell or share your information with third parties.

7. Employer Access

Your employer does NOT have access to:

• Whether you've used the service
• Session content or frequency
• Any personally identifiable usage data

8. Data Security Measures

We implement reasonable security measures to protect your information, including:

• Encryption: Data transmitted over the internet is encrypted using industry-standard SSL/TLS protocols. Messages are not end-to-end encrypted — the platform and hosting staff can read stored content
• Access Controls: Role-based access restrictions limiting who can view what information
• Authentication: Secure login procedures and session management
• Automatic Logout: Sessions expire after periods of inactivity
• Monitoring: System monitoring for unauthorized access attempts
• Regular Backups: Automated backup procedures to prevent data loss

8A. Data Breach Notification

In the event of a data breach that compromises your personal information, we will:

• Notify affected users via email within 72 hours of confirming a breach
• Describe the nature of the breach and what information was compromised
• Provide steps you can take to protect yourself
• Report the breach to relevant authorities as required by applicable law

However, we cannot guarantee that we will detect all breaches or that notification will occur within any specific timeframe.

9. Your Rights

You have the right to:

• Access your personal information
• Request correction of inaccurate data
• Request deletion of your account and data
• Opt-out of non-essential communications

Administrators who have opted in to SMS safety alerts may opt out at any time by replying STOP to any message, removing their phone number in Account Settings, or contacting us at brotherskeeper2026@outlook.com. Opting out means you will no longer receive SMS alerts; you may still receive alerts through the platform dashboard.

10. Mandatory Reporting and Legal Disclosures

• Imminent Harm: When there is a reasonable belief that you or another person is at imminent risk of serious bodily harm or death
• Suicide Risk: When you express suicidal thoughts, plans, or intent
• Homicide Risk: When you express intent to harm or kill another person
• Child Abuse: When we have reasonable suspicion of child abuse, neglect, or endangerment
• Elder/Dependent Adult Abuse: When we have reasonable suspicion of abuse or neglect of vulnerable adults
• Court Orders: In response to subpoenas, court orders, or other legal processes
• Law Enforcement Requests: When required by valid legal process or when we believe disclosure is necessary to prevent criminal activity
• Public Safety Threats: When we believe disclosure is necessary to prevent serious threats to public safety
• Regulatory Compliance: To comply with applicable laws, regulations, or governmental requests

BY USING THIS SERVICE, YOU EXPRESSLY CONSENT TO THESE DISCLOSURES.

10A. Information Sharing with Third Parties

We may share your information with:

• Service Providers: Third-party vendors who assist with hosting, data storage, analytics, SMS messaging (Twilio), and platform infrastructure
• Legal Advisors: Attorneys and consultants for legal advice and regulatory compliance
• Insurance Providers: If we maintain liability insurance, insurers may require access to incident reports and claims data
• Business Transfers: In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the acquiring entity
• Professional Supervisors: For peer specialist supervision, training, and quality assurance purposes (with identifiable information redacted where possible)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

10B. SMS Text Alerts (Administrators)

For administrators and the senior admin who opt in, Brother's Keeper sends transactional text alerts only about administrative approval requests and Duty to Act safety-protocol alerts. The following applies to SMS text alerts:

• Mobile numbers and SMS opt-in data are never sold or shared with third parties or affiliates for marketing or promotional purposes.
• Text consent (your opt-in) is not shared with any third party.
• STOP: Reply STOP to any message to opt out at any time.
• HELP: Reply HELP for support information.
• Message frequency varies. You may receive multiple alerts during active situations.
• Message and data rates may apply.
• Carriers are not liable for delayed or undelivered messages.
• Messages never contain conversation content or personal health details — only the request type, a non-sensitive summary, and secure single-use action links.

See our SMS Alerts page for full details.

11. State-Specific Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and sell
• Request deletion of your personal information
• Opt-out of the sale of your personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

Other State Rights

Residents of Virginia, Colorado, Connecticut, Utah, and other states with privacy laws may have additional rights. Contact us to exercise your rights under applicable state laws.

12. Children's Privacy

This Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we discover that we have inadvertently collected information from someone under 18, we will delete it immediately. If you believe we have collected information from a minor, please contact us immediately.

13. International Data Transfers

Your information may be transferred to, stored, and processed in countries other than your country of residence. These countries may have data protection laws that differ from your country. By using this Service, you consent to the transfer of your information to any country where we operate.

14. Do Not Track Signals

Our Service does not currently respond to "Do Not Track" signals from web browsers. We may track your activity on our Service to improve functionality and user experience.

15. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Changes will be effective immediately upon posting to the Service. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

For material changes that significantly affect your privacy rights, we will:

• Notify users via email at least 30 days before the changes take effect
• Display a prominent notice on the Service
• Update the "Last Updated" date at the top of this policy

You are responsible for reviewing this Privacy Policy periodically.

16. Your Responsibilities

You are responsible for:

• Maintaining the confidentiality of your login credentials
• Not sharing sensitive personal information beyond what is necessary for peer support
• Not sharing protected health information (PHI) such as diagnoses or medications
• Immediately notifying us of any unauthorized access to your account
• Understanding that communications over the internet are not completely secure

17. Contact Us

For privacy-related questions, to exercise your privacy rights, or to report privacy concerns, please contact:

Email: senioradmin@brothers-keeper.app

Admin Dashboard: Available to registered administrators

We will respond to privacy requests within 30 days of receipt.