VibeCheck Privacy Notice

1. Who We Are

Mental Wealth Solutions, Inc. ("we," "us," or "our"), a New York corporation, operates VibeCheck, a software platform that licensed providers use to support care. Under HIPAA, we are a Business Associate of those providers; the provider is the Covered Entity. We handle protected health information ("PHI") on the provider's behalf under a written Business Associate Agreement ("BAA"). This notice is not a Notice of Privacy Practices — your provider issues that.

Public Website Analytics

Our corporate and VibeCheck public marketing websites use first-party, cookieless analytics that we operate ourselves. We collect the page path, visit and rotating visitor pseudonyms, referring site and campaign labels, coarse country/region/city, browser, operating system, device and viewport class, page-performance measurements, and anonymous interaction events such as active viewing time, scroll milestones, outbound-link host, and whether a form was started or submitted. We do not collect form contents, typed text, names, email addresses, clinical information, or full outbound URLs through these analytics events, and we do not use advertising pixels, cross-site tracking, analytics cookies, persistent visitor identifiers in browser storage, or fingerprinting.

VibeCheck's separate marketing funnel records anonymous event attempts such as page views, pricing views, form starts/submits, and checkout-link clicks. These attempts are not treated as verified purchases or linked to clinical records. Ordinary analytics reports do not contain raw IP addresses. Network-level IP evidence, when generated for security and diagnostics, is kept in a separate owner-restricted system with automatic deletion after no more than 30 days and is not used to identify marketing visitors.

During a measured migration, the separate Matthew Sexton LCSW PLLC marketing site also runs a legacy first-party security and traffic collector alongside the replacement. That legacy collector may receive the current page URL including its query string, page title, referrer, browser language, screen size, and viewport size; it does not receive form contents. Do not place clinical or other sensitive information in a website URL. The legacy collector will remain only until replacement coverage, comparison, rollback, privacy disclosure, and event preservation are verified.

2. Information We Process

On behalf of your provider, we may collect and maintain:

• Registration data: Name, email address, date of birth, role (client/provider).
• Clinical data: Session notes, check-in responses, mood and wellness scores, assessments (PHQ-9, GAD-7, etc.), safety plans, and homework submissions.
• AI interaction data: Messages sent to and received from AI-assisted features.
• Usage data: Log data, session identifiers, IP addresses, and device information collected for security and operational purposes.

3. How We Use & Disclose Information

As a Business Associate, we use and disclose PHI only as permitted by our BAA and HIPAA — principally to provide VibeCheck to your provider and at your provider's direction. Your provider's Notice of Privacy Practices governs how your PHI is used for your treatment, payment, and the provider's health care operations.

• To operate the platform for your provider: Hosting, processing, and supporting the clinical workflow your provider uses within VibeCheck.
• Service providers under BAAs: We share PHI only with subcontractors that have signed Business Associate Agreements (see Section 6).
• As required by law: Responding to a valid court order, subpoena, or other legally required disclosure, and notifying your provider as the BAA requires.
• Safety: Supporting your provider's response when there is a serious and imminent threat to safety, consistent with HIPAA and the provider's instructions.

We do not sell PHI, and we do not use or disclose PHI for marketing except as your BAA and HIPAA permit.

4. AI-Assisted Features

VibeCheck uses AI features to support your provider's care (for example, draft summaries, supportive psychoeducational content, and safety-related classification). PHI is processed inside Mental Wealth Solutions, Inc.'s AWS environment and is sent only to an AI inference service that is covered by a Business Associate Agreement — currently Amazon Bedrock, running within AWS under the AWS HIPAA BAA. PHI is never sent to a consumer, non-BAA AI endpoint, and is not used to train general-purpose AI models. AI output is not a clinical judgment, diagnosis, or treatment decision; your provider reviews and remains responsible for your care. The AI is not a licensed clinician and is not a crisis service.

5. Your HIPAA Rights — Exercised Through Your Provider

HIPAA gives you rights over your PHI, but you exercise those rights through your provider, who is the Covered Entity and issues its own Notice of Privacy Practices. Through your provider you may:

• Access and copy your PHI (45 C.F.R. § 164.524).
• Request an amendment of your PHI (§ 164.526).
• Request an accounting of certain disclosures (§ 164.528).
• Request restrictions on certain uses and disclosures.
• Request confidential communications by alternative means or locations.
• Receive your provider's Notice of Privacy Practices.
• Be notified of a breach of your unsecured PHI.

Direct these requests to your provider — not to VibeCheck or Mental Wealth Solutions, Inc.. As Business Associate, we support your provider in fulfilling them, but your provider is responsible for responding.

6. Service Providers Under Business Associate Agreements

Where we use subcontractors that handle PHI, each has signed a Business Associate Agreement that flows down the same protections. Our primary subcontractor is Amazon Web Services, which provides our cloud infrastructure and the AI inference service (Amazon Bedrock) under the AWS HIPAA BAA. We do not send PHI to any vendor that has not executed a BAA.

7. How Long We Keep Information

We process and retain PHI on behalf of, and according to the instructions of, your provider under our Business Associate Agreement. HIPAA requires a Business Associate to retain HIPAA compliance documentation for at least six (6) years (45 C.F.R. §§ 164.316(b)(2), 164.530(j)(2)). Retention of the clinical record itself is governed by your provider's policies and applicable state law (for example, New York record-retention requirements), not by a fixed HIPAA period. Audit logs are retained consistent with our security program. De-identified data (45 C.F.R. § 164.514) may be retained.

On termination of a provider's BAA, we return or destroy the provider's PHI as the BAA directs. To delete an account or records, contact your provider; we act on your provider's instructions and applicable law.

8. How We Protect Information

• PHI is encrypted at rest using AES-256 (pgcrypto).
• All data in transit is encrypted via TLS 1.2+.
• Access is controlled by role-based permissions (RBAC).
• Multi-factor authentication (MFA) is enforced, and sessions time out after 15 minutes of inactivity.
• Infrastructure is hosted on AWS under a HIPAA Business Associate Agreement.
• Append-only, tamper-resistant audit logs record access to records.

9. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with your provider, with us, or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

• Contact us: [email protected]
• HHS OCR: https://www.hhs.gov/hipaa/filing-a-complaint/

10. Contact

11. Changes to This Notice

We may update this notice. We will post the revised notice on this page with a new effective date. Changes to how PHI is handled remain subject to our Business Associate Agreements with providers.

Effective May 21, 2026 · Mental Wealth Solutions, Inc., a New York corporation · Patent Pending — U.S. Provisional Application No. 64/059,214 (filed May 6, 2026).