Privacy Policy

Operated by: Rosasco Solutions LLC (Maine)

Effective date: August 11, 2026

Version: 1.0

1. Who We Are and What This Policy Covers

Simple Recovery (the "Service") is operated by Rosasco Solutions LLC, a Maine limited liability company ("we," "us," or "our"), with a mailing address of PO Box 312, Dixfield, ME 04224. This Privacy Policy describes how we handle personal information in connection with the Simple Recovery application and related services available at simplerecovery.app: information from people who contact us, and from the account-holders who sign in to use the Service.

Our public marketing website at getsimplerecovery.com is covered by its own privacy notice, published on that site. This Policy covers the Service itself.

Important: resident health information is handled differently

Recovery residence organizations use the Service to maintain records about the residents they serve. That resident information — including health-related records such as substance-use testing, medications, incidents, and notes — is processed by Rosasco Solutions as a service provider on behalf of the organization, under our agreement with that organization and, where applicable, a business associate agreement.

This consumer Privacy Policy does not govern that resident health information. The organization that operates within the Service controls that data and is responsible for it under applicable laws, including HIPAA and 42 CFR Part 2 where they apply, and under that organization's own privacy notices. If you are a resident or other individual with questions about records an organization maintains about you, please contact that organization directly.

A note on resident portal accounts: where a resident is given access to a resident portal, the resident's own login credentials and basic account-usage information are handled as described in this Policy; the substantive resident records remain controlled by the organization as described above.

2. Information We Collect

Information you provide to us

• When you contact us (for example, by email with a question or support request): your name, email address, organization, and the contents of your message.
• When you hold an account: your name, email address, role, organization affiliation, and the login credentials used to access the Service. Passwords are stored in hashed form; we do not store them in readable text.

Information collected automatically

When account-holders sign in and use the Service, we and our service providers collect certain technical information needed to operate and secure the Service:

• Authentication and session information necessary to sign you in and keep your session active. This is strictly necessary for the Service to function.
• Log and device information, which may include IP address, browser and device type, and access timestamps, used for security, troubleshooting, and operating the Service.
• Activity within the Service needed to provide features and to maintain audit records of actions taken in the Service.

Cookies and similar technologies

The Service uses only strictly-necessary browser storage — for signing you in, keeping your session active, and remembering basic interface preferences such as whether a navigation panel is expanded. We do not use advertising cookies or third-party analytics in the signed-in application. Our public marketing website uses standard website analytics, which are described in that site's own privacy notice. If we add non-essential technologies to the Service in the future, we will update this Policy and provide any notice or choices required by law.

3. How We Use Information

We use the personal information described above to:

• Provide, operate, maintain, and secure the Service;
• Authenticate users and manage accounts and access;
• Communicate with you, including service and security notices, support, and billing;
• Respond to inquiries and requests;
• Detect, prevent, and address security incidents, fraud, and misuse; and
• Comply with legal obligations and enforce our agreements.

We do not sell personal information. We do not use resident health information processed on behalf of an organization for our own purposes; that information is used only to provide the Service to the organization, as permitted by our agreement with it.

4. How We Share Information

We share personal information only as described here.

Service providers (subprocessors)

We use trusted service providers to help us operate the Service. They process information on our behalf, under contract, and are not permitted to use it for their own purposes. Our current providers are:

• Supabase Pte. Ltd. — hosting of the application database, authentication, and backend services.
• Vercel — hosting and delivery of the application.
• Amazon Web Services (Amazon SES) — sending of transactional and service email.
• Cloudflare — domain, DNS, and network security.
• Airtable — support ticket management and internal business records, including AI-assisted drafting of support replies.

We maintain executed business associate agreements with the providers that process protected health information on our behalf, including Supabase Pte. Ltd., Vercel, and Amazon Web Services.

Other sharing

• With your organization, where you access the Service through an organization, consistent with that organization's configuration and agreement;
• To comply with law, legal process, or lawful government requests, and to protect the rights, property, and safety of users and others; and
• In connection with a business transfer (such as a merger, financing, or sale of assets), subject to appropriate confidentiality protections.

Sharing of resident health information is governed by the applicable organization agreement and business associate agreement, not this Policy.

5. How We Protect Information

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, multi-factor authentication for administrative accounts, audit logging, and contractual protections with our service providers. For resident health information, additional safeguards apply under the applicable organization agreement and business associate agreement, and identifiable production resident data is processed only under executed business associate agreements with the providers involved and the safeguards described above. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention

We retain personal information for as long as needed to provide the Service, to operate our business, and to meet our legal obligations. Account information is retained while an account is active and for a reasonable period afterward. Information processed on behalf of an organization is retained, returned, or deleted in accordance with our agreement with that organization.

7. Your Choices and Rights

• Account information: you can review and update your account details through the Service or by contacting your organization's administrator or us.
• Communications: you can opt out of non-essential messages by following the instructions in those messages or contacting us; we may still send necessary service and security notices.
• Residents: rights regarding health records an organization maintains about you are exercised through that organization, which controls the data.

Depending on where you live, you may have additional rights regarding your personal information. To make a request, contact us using the details below, and we will respond as required by applicable law.

8. Children's Privacy

The Service is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children through our accounts or the Service. If you believe a child has provided us personal information, please contact us so we can address it.

9. Email and Communications

We send transactional and service email (for example, account, security, and notification messages) through our email provider. You can manage certain notification preferences within the Service where that option is available. Some messages are necessary to provide the Service and cannot be turned off while you hold an account.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and, where appropriate, provide additional notice. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

11. Contact Us

Questions or requests regarding this Privacy Policy may be directed to:

Rosasco Solutions LLC

PO Box 312, Dixfield, ME 04224

Email: peter@rosascosolutions.com

If your question concerns records an organization maintains about a resident, please contact that organization directly, as it controls that information.