Privacy Policy

1. About Blue Phoenix

Blue Phoenix ("we," "us," or "our") is a clinical wellness platform designed specifically for incarcerated individuals and the correctional facilities that serve them. The platform was created by a board-certified Psychiatric Mental Health Nurse Practitioner with over two decades of experience treating mental illness and addiction in correctional and outpatient settings.

Blue Phoenix provides evidence-based tools including mood tracking, journaling, gratitude practice, daily habit building, DBT and CBT skill practice, mindfulness and meditation, coloring and word search activities, goal setting, vision boards, restorative justice planning, reentry checklists, a curated resource library, and crisis support. These tools are designed to reduce suicide risk, decrease violence, and support successful reintegration into the community.

This Privacy Policy describes how we collect, use, store, share, and protect information about you when you use Blue Phoenix. By using the platform, you agree to the practices described in this Policy.

2. Who This Policy Applies To

This Policy applies to all users of Blue Phoenix, including:

• Incarcerated Individuals (Wellness Members) — persons using the platform for personal mental wellness, skill-building, and reentry preparation while incarcerated or post-release
• Correctional Facility Administrators (Institution Admins) — administrators and staff at jails, prisons, and correctional facilities who manage inmate access, monitor engagement metrics, and respond to crisis alerts
• Platform Administrators — Blue Phoenix staff who operate and maintain the platform

3. Information We Collect

3.1 Information You Provide Directly

• Account information: name, email address, and role
• Mood entries: mood state, score, notes, tags, and dates
• Journal entries: written content, titles, AI-assisted prompts, and mood associations
• Habit tracking: daily habit completions (meditation, exercise, sleep, hydration, reading, gratitude, breathing, hygiene, and more)
• Skill practice logs: DBT, CBT, and mindfulness skill usage and written reflections
• Gratitude entries: daily gratitude items
• Goal entries and vision board content: personal goals, categories, and associated images
• Reentry checklist progress: completion status of legal, housing, employment, health, financial, family, and documentation tasks
• Restorative action plans: accountability reflections and repair steps
• Crisis alert data: keyword-triggered alerts generated from journal or mood entries that may suggest imminent risk of harm
• Coloring artwork: saved canvas sessions
• Facility subscription and payment information: processed securely through our payment provider (we do not store raw card data)

3.2 Information Collected Automatically

• Usage data: features accessed, session frequency, and engagement patterns
• Device information: browser type, operating system, IP address
• Log data: error reports, timestamps, and access logs

3.3 Sensitive Health Information

Blue Phoenix collects information that may constitute mental health information, including mood states, journal content, crisis indicators, and therapeutic skill practice data. We treat all such information with the highest level of protection described in this Policy.

4. How We Use Your Information

• To provide, personalize, and improve the Blue Phoenix platform
• To generate AI-powered journal coaching responses from your written content
• To detect crisis keywords in journal entries and mood notes and generate crisis alerts visible to authorized facility staff
• To send optional weekly wellness digest emails (you may opt out at any time)
• To track and display your personal progress, achievements, and habit streaks
• To provide correctional facility administrators with engagement metrics and crisis alert information (see Section 5 for what is and is not shared)
• To process facility subscription payments and manage access codes
• To analyze aggregated, de-identified usage patterns to improve our services
• To comply with legal obligations and mandatory reporting requirements related to imminent risk of harm

We will never sell, rent, trade, or share your personal or health information with third parties for commercial purposes.

5. What Facility Administrators Can and Cannot See

Your wellness content is your private space. Blue Phoenix is designed to keep personal wellness data private from facility staff, with the following important exceptions:

What Facility Administrators CAN See:

• Whether an inmate has claimed an access code and is using the platform
• Aggregate engagement metrics: how often the inmate uses the app and which general feature areas they access
• Crisis alerts: if a journal entry or mood note contains language suggesting imminent risk of suicide or violence, an alert is automatically generated and made visible to authorized facility staff. The specific triggering text snippet is included in the alert so staff can respond appropriately. This is a deliberate safety feature.

What Facility Administrators CANNOT See:

• Full journal entries or written reflections (only the specific flagged text is shown in a crisis alert)
• Mood scores or emotional notes not flagged as a crisis
• Habit completion details
• Skill practice logs or therapeutic work
• Gratitude entries
• Goals, vision board content, or reentry checklist details
• Any other wellness content not related to an active crisis alert

By using Blue Phoenix, you acknowledge and consent to this crisis monitoring feature. It exists solely to protect your safety and the safety of others. All other wellness content remains private.

6. How We Share Your Information

We do not sell, rent, trade, or share your personal or health information for commercial purposes.

We may share information only in the following limited circumstances:

• Correctional Facility Staff: Crisis alert data (as described in Section 5) is shared with authorized administrators at the facility associated with your access code.
• Service Providers: We share data with trusted vendors (cloud hosting, payment processors, email delivery, AI processing) under strict data processing agreements. These vendors may not use your data for their own purposes.
• AI Processing: Journal content submitted for AI coaching is processed through a large language model API. This data is transmitted securely and is not used to train external AI models.
• Legal Requirements: We may disclose information if required by law, court order, or to protect the safety of individuals — including mandatory reporting obligations related to imminent risk of harm.
• Business Transfers: In the event of a merger or acquisition, your data may transfer to a successor entity under equivalent privacy protections.

7. Data Security

We implement industry-standard technical and organizational safeguards to protect your information, including:

• Encryption of data in transit using TLS/SSL
• Encrypted data storage at rest
• Role-based access controls: facility administrators can only see data for inmates associated with their institution
• Secure, unique access codes for inmate onboarding
• Regular security reviews and updates
• Secure authentication mechanisms

While we take strong measures to protect your data, no system is completely secure. In the event of a data breach affecting your rights, we will notify you as required by applicable law.

8. Data Retention

We retain your personal and health data for as long as your account is active or as needed to provide services. You may request deletion of your account and associated data at any time by contacting us at privacy@bluephoenixtx.com.

Upon deletion requests, we will remove your data within 30 days, except where retention is required by applicable law or for legitimate business purposes (e.g., payment records, crisis alert records required by facility compliance obligations).

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and data
• Portability: Request your data in a structured, machine-readable format
• Opt-Out: Unsubscribe from wellness digest emails at any time

To exercise any of these rights, contact us at privacy@bluephoenixtx.com. We will respond within 30 days.

10. Crisis Monitoring & Mandatory Safety Reporting

Blue Phoenix includes an automated crisis detection system that scans journal entries and mood notes for keywords associated with suicide risk or imminent violence. If such language is detected, a crisis alert is generated and made visible to authorized staff at your correctional facility. The alert includes the specific text that triggered it so staff can assess and respond.

This feature is intentional and exists to protect your life and the lives of others. In addition, if information in the platform suggests an imminent risk of harm to you or others, we reserve the right — and in some jurisdictions are required — to report to relevant authorities. This exception is applied narrowly and only in genuine safety emergencies.

By using Blue Phoenix, you consent to this monitoring as a condition of use.

11. Children's Privacy

Blue Phoenix is intended for adult users (age 18 and older). We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us immediately and we will take steps to delete it.

12. Third-Party Links

The platform's Resource Library and Crisis pages may contain links to external resources (e.g., crisis hotlines, legal aid organizations, government benefit programs). We are not responsible for the privacy practices of external sites and encourage you to review their policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 30 days before the change takes effect. Continued use of the platform after changes constitute your acceptance of the updated Policy.

This policy was last reviewed May 1, 2026.