CONSUMER HEALTH DATA PRIVACY POLICY
LAST UPDATED: JULY 8, 2026
This Consumer Health Data Privacy Policy (this “CHD Policy”) supplements the FirstThen, Inc. (“FirstThen,” “we,” “us,” or “our”) Privacy Policy (the “Privacy Policy”) and applies to personal data defined as “consumer health data” (“CHD”) by: (i) the Washington State My Health My Data Act (“MHMDA”); (ii) Nevada’s Consumer Health Data Privacy Law (“Nevada CHD Law”); (iii) Connecticut’s Data Privacy Act (“CTDPA”); (iv) the Colorado Privacy Act, including its sensitive data provisions (“CPA”); (v) other applicable state comprehensive data privacy laws and consumer health data statutes across the United States (collectively, the “CHD Laws”); and (vi) applicable provisions of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CPRA”). We refer to the FirstThen mobile application (the “Application”) and all related services provided by FirstThen — a self-guided application featuring training modules, practice tools, tracking tools, and digital coaching designed to support parents and caregivers of children with behavioral disorders — together in this CHD Policy as the “Services.” This CHD Policy is incorporated into our Terms of Use and Privacy Policy. Undefined capitalized terms shall have the meaning set forth in the Privacy Policy and the Terms of Use. This CHD Policy is also designed to be consistent with applicable federal law.
Categories of CHD Collected
As described further in our Privacy Policy, and depending on how you interact with the Services and applicable law, we may collect the following categories of CHD, as broadly defined under the applicable CHD Laws:
Identifiers: e.g., name, email address, phone number, zip code, and other account information that is linked or reasonably linkable to you.
Child behavioral health and wellness information: e.g., information about a child’s behavioral condition (including, without limitation, ADHD or other behavioral disorders), symptoms, behaviors, responses to coaching techniques, and progress that you voluntarily provide in connection with your use of the Application. This information constitutes Consumer Health Data to the extent it identifies the past, present, or future mental or behavioral health status of an identified or identifiable individual, including a minor child about whom you provide information.
Training progress and engagement data: e.g., training module completions, practice tool usage, tracking tool entries, and engagement patterns with the Application that may reflect or be used to infer information about a child’s behavioral condition or a caregiver’s wellness journey.
AI coaching interaction data: e.g., the content of questions asked, inputs provided, and responses received through the Application’s digital coaching and AI-powered features, which may reflect information about a child’s behavioral condition or a caregiver’s needs.
Child demographic information: e.g., the child’s age, grade level, and other demographic details about the child in your care that you choose to provide in connection with the Application.
Data that identifies a consumer seeking health care or wellness services: e.g., information that, in context, identifies you as a person using a behavioral health and wellness coaching service for families, including your account registration information.
Algorithmic outputs and derived insights: e.g., personalized training recommendations, coaching outputs, and content suggestions derived or inferred from your engagement data and inputs, which may constitute derived or inferred CHD under applicable CHD Laws.
Other information that may be used to infer, derive, or extrapolate data related to the above or other health or wellness information.
Sources of CHD
As described further in our Privacy Policy, we collect information which may include CHD from the following sources: (1) directly from you (e.g., account registration information, behavioral health and wellness information you input about your child, coaching interaction content, and feedback you provide through the Application); (2) automatically and passively through your use of the Application and your device (e.g., session data, usage patterns, and engagement data); (3) third-party platforms or services you choose to connect to the Application; and (4) the algorithmic processing and AI-powered analysis performed by our Services on the data you authorize us to collect.
Purposes for Collection of CHD
We describe the purposes for collection and use of CHD in our Privacy Policy. As further described there and subject to applicable law and your consent where required, we collect and use CHD: (1) to provide and operate the Services, including to deliver personalized training modules, practice tools, tracking tools, and digital coaching based on your inputs and engagement; (2) to analyze and improve the accuracy of our coaching algorithms, application functionality, and educational content, using de-identified and aggregated data; (3) to personalize your experience within the Application using AI features, as described in our Privacy Policy; (4) to respond to your support requests and technical inquiries; (5) for safety and fraud prevention purposes; and (6) for legal purposes, such as to comply with applicable laws or to establish, exercise, or defend our legal rights. We do not use your CHD for targeted advertising or cross-context behavioral advertising. We do not sell your CHD.
How and Why We Share CHD
We may share categories of CHD described above only as set forth below and as further described in our Privacy Policy. We share CHD only: (1) at your direction and with your separate, affirmative, opt-in consent; (2) to the extent necessary to provide the Services you have requested; or (3) as required or permitted by applicable law.
We may share CHD for the following purposes:
1. to deliver the Services to you, including to deliver personalized coaching, training modules, and tracking features;
2. to maintain and improve the Services and the accuracy of pattern-detection algorithms, using de-identified and aggregated data only;
3. to protect FirstThen and others, including to enforce our Terms of Use or other agreements, and for fraud prevention; and
4. to comply with our legal obligations or in response to valid legal process.
We do not use CHD for advertising, marketing, or cross-context behavioral advertising, and we do not sell CHD.
Subject to applicable law and your consent where required, we may share CHD with the following categories of third parties:
1. Service Providers: We use third-party service providers that support the operation of the Application, which may include database and authentication infrastructure providers, push notification delivery services, payment processors, and AI technology providers, that process data on our behalf subject to binding data protection agreements. These providers may not use your CHD for their own purposes.
2. For Legal Purposes: We may disclose CHD to governmental or regulatory authorities in response to valid legal process or to protect safety in emergency situations.
3. For Business Transfers: In connection with a merger, acquisition, or sale of business assets, CHD may be transferred subject to continued protections consistent with this CHD Policy.
We reserve the right to create and use de-identified or aggregated data derived from CHD, and such data is not subject to this CHD Policy. We may use de-identified and aggregated population trends for research, product improvement, and algorithm refinement.
How To Exercise Your MHMDA, Nevada CHD Law, CTDPA, CPA, and Other State Rights
Subject to exceptions, the applicable CHD Laws extend certain rights with respect to CHD. Depending on your jurisdiction, these rights may include requests: (1) to confirm whether FirstThen is collecting, sharing, or selling your CHD; (2) to access your CHD and receive a list of all third parties and affiliates with whom FirstThen has shared or sold your CHD; (3) to delete your CHD; (4) to withdraw your consent to the collection or sharing of your CHD; and (5) to correct inaccuracies in your CHD.
You can seek to exercise these rights by emailing support@firstthen.com or by using the in-app data controls available in the Application. Depending on the nature of your request, we may contact you for further information to authenticate your identity. FirstThen will never ask you for sensitive financial information when authenticating your identity.
Sensitive Data and Biometric Information
Health, biometric, activity, behavioral pattern, and precise location information collected by FirstThen may constitute ’sensitive personal information,’ ’sensitive data,’ or ’consumer health data’ under applicable state privacy laws, including the MHMDA, Nevada CHD Law, CTDPA, CPA, and comprehensive state privacy laws in Virginia, Texas, Oregon, Montana, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Rhode Island, Tennessee, Utah, Arkansas, and Florida. We process such information only for the purposes you have authorized and consistent with your consent. Where required by applicable law, we obtain your separate, affirmative, opt-in consent before collecting or sharing such sensitive data. You may limit our use of sensitive data through in-app Settings controls.
If we deny your request in whole or in part, you may appeal that decision by contacting us at support@firstthen.com. If your appeal is denied, you may contact your applicable state attorney general:
1. Washington residents: Washington State Attorney General at www.atg.wa.gov/file-complaint
2. Nevada residents: Nevada Attorney General at https://ag.nv.gov/Complaints/File_Complaint/
3. Connecticut residents: Connecticut Attorney General at https://www.dir.ct.gov/ag/complaint/e-complaint.aspx
4. Colorado residents: Colorado Attorney General at https://coag.gov/file-complaint/
5. Indiana residents: Indiana Attorney General at https://www.in.gov/attorneygeneral/file-a-complaint/
6. Kentucky residents: Kentucky Attorney General at https://ag.ky.gov/attorney-generals-office/complaints
7. Rhode Island residents: Rhode Island Attorney General at https://riag.ri.gov/consumer-protection
8. Arkansas residents: Arkansas Attorney General at https://arkansasag.gov/file-a-complaint/
We will respond to verifiable consumer requests within 45 days of receipt. Where permitted by law, we may extend this period by an additional 45 days when reasonably necessary, with notice to you.
Geofencing Notice: In compliance with the Washington My Health My Data Act, Nevada Consumer Health Data Privacy Law, and California AB 45 (effective January 1, 2026), FirstThen does not engage in geofencing for advertising, tracking, or marketing purposes around any in-person health care facility or family planning center. FirstThen does not use geofencing technology in the Application.
Minor Children’s Data
FirstThen’s Services are designed for use by adults — specifically, parents and caregivers of minor children. You must be at least 18 years of age to create an account and use the Application. The Application is not directed to children, and children under 18 are not authorized to use the Application directly.
However, in the ordinary course of using the Application, you may provide information about your minor child, including information relating to your child’s behavioral condition or health status (such as an ADHD diagnosis, behavioral patterns, or responses to coaching techniques). Such information about your minor child constitutes Consumer Health Data under applicable CHD Laws. While the federal Children’s Online Privacy Protection Act (“COPPA”) does not apply to information about children that is collected from adults on a service not directed to children, many state comprehensive privacy laws do not contain an equivalent exception — meaning state law protections extend to a child’s data regardless of whether it is collected from the child or from a parent or caregiver. Accordingly, we treat all information about minor children with heightened care, consistent with the requirements of applicable state CHD Laws and comprehensive data privacy laws.
We collect and use information about your minor child only as necessary to provide the Services you have requested. We do not use information about minor children for targeted advertising, profiling, or any purpose beyond delivering the Application’s educational and wellness Services. We do not sell information about minor children. If you wish to access, correct, or delete information about your minor child that you have provided through the Application, please contact us at support@firstthen.com.
Data Retention
We retain CHD for no longer than reasonably necessary to fulfill the purposes described in this CHD Policy and our Privacy Policy, or as required by applicable law. When CHD is no longer needed, we will delete or de-identify it in accordance with our data retention practices. If you submit a deletion request, we will delete your CHD consistent with applicable CHD Law requirements, including directing our processors to delete the applicable data.
Universal Opt-Out
Where required by applicable state law (including California, Colorado, Connecticut, Oregon, Minnesota, New Hampshire, New Jersey, Texas, Montana, Delaware, Maryland, and other states that have enacted universal opt-out requirements), FirstThen will honor opt-out preference signals transmitted through recognized universal opt-out mechanisms, such as the Global Privacy Control (“GPC”), to the extent required by such laws. A verified opt-out signal will be treated as a request to opt out of the sale and sharing of your CHD and personal data for targeted advertising.
Updates to this CHD Policy
We reserve the right to change this CHD Policy at any time to reflect changes in the law, our data collection and use practices, the features of our Application, or advances in technology. We will make the revised CHD Policy accessible through the Services, so you should review it periodically. The date this CHD Policy was last revised is identified at the top of the document. You are responsible for periodically monitoring and reviewing any updates to the CHD Policy. If we make a material change to the CHD Policy, we will provide you with appropriate notice in accordance with legal requirements. Your continued use of our Services after such amendments (and notice, where applicable) will be deemed your acknowledgment of these changes to this CHD Policy.
Automated Decision-Making and Profiling
FirstThen may use automated processing and artificial intelligence technologies as part of its AI Features — including to personalize training content, recommend coaching modules, and provide digital coaching — based on your engagement data and inputs. These outputs are informational coaching suggestions designed to support parents and caregivers and are not clinical diagnoses, medical advice, or treatment recommendations. As required by applicable law (including the Colorado Privacy Act and other state laws requiring automated decision-making transparency), we disclose that no solely automated processing by FirstThen produces decisions with legal or similarly significant effects on you. You may contact us at support@firstthen.com with questions about AI Features at any time.
Contact Us
If you have any questions about this CHD Policy or FirstThen’s privacy practices, please contact us at: support@firstthen.com or FirstThen, Inc., 5338 Emerson Avenue, Dallas, Texas.