Privacy Policy

Stronghold is operated by Dr. Hines Inc. of Broken Arrow, Oklahoma ("Stronghold," "we," "us," or "our"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Stronghold Assessment at app.strongholdassessment.com, the Stronghold Coach practitioner platform at my.stronghold.coach (including the pages, texts, emails, and calls your practitioner sends you from it), our public website at strongholdassessment.com, and related services. Where a practice below applies to only one of those, we say so explicitly.

Who is responsible for your information. If you work with a certified practitioner, that practitioner runs their own practice and decides how your coaching is delivered; Stronghold provides the platform they use and handles your information on their behalf. If you buy the assessment directly from Stronghold, you are a client of Stronghold's own house practice and Stronghold is responsible for your information.

1. Information We Collect

We collect the following types of information:

• Identity and Contact Information: Name, preferred name, email address, phone number, date of birth, gender, and city/state/country.
• Intake Information: What you tell us before the assessment, in your own words: why now, current struggles, what you have tried, goals, a five-year vision, your Wheel of Life ratings, and safety screening answers. If you choose to tell us, this can include your relationship status and the names and ages of your spouse and children.
• Assessment Responses: Your answers to assessment questions, including response timestamps and response times, and the scores calculated from them.
• Module Responses: Anything you complete in a module your practitioner sends you, such as Energy Lights, Right Now, weekly check-ins, goals and homework, boundary conversations and agreements, faith reflections, fitness intake, budget and debt figures, and documents or photos you upload (for example pay stubs, bills, or statements for a budget).
• Coaching Records: Session notes, plans, handouts, and files your practitioner adds to your record. If your practitioner uses session transcription, a written transcript of the session (see Section 6).
• Communications: Text messages you exchange with your practitioner (including photos, videos, and voice clips you send), emails sent through the platform, call logs, and voicemails you leave, including the recording and a written transcript of the voicemail.
• Payment Information: Invoices, payments, and statements. Card details are entered on and stored by Stripe; we never see or store your full card number. If someone else (for example an employer or a parent) pays your sessions, we keep their name and contact details for billing.
• Technical Data: IP address, device type, browser user agent string, pages viewed within our apps, and session timestamps.
• Consent Records: Electronic signature, the wording you agreed to, IP address at the time of consent, and the timestamp. This includes your choices about text messages, email, and marketing.

2. How We Use Your Information

• To administer your assessment and modules, and to produce your reports and coaching insights for your practitioner.
• To compute scores, confidence levels, and readiness measures.
• To run your coaching: booking, reminders, session notes, plans, handouts, and messages between you and your practitioner.
• To bill for sessions and services, send invoices, statements, and receipts, and take payments.
• To detect and respond to safety indicators, including alerting your practitioner and showing you crisis resources.
• To maintain audit trails for data integrity, security, compliance, and quality assurance.
• To improve Stronghold using anonymized, aggregated data only.
• To send you marketing or educational content, only if you separately opted in. You can opt out at any time.

3. How We Store and Protect Your Data

Your data is stored on encrypted infrastructure provided by Supabase (built on Amazon Web Services) in the United States. All data is transmitted over HTTPS/TLS encryption. Row level security policies restrict access to authorized users only. Your practitioner can view your records; no other practitioners or clients can access them.

4. Who Has Access to Your Data

• Your Practitioner: The practitioner you work with (or Stronghold's house practice, if you bought directly) can view your assessment results, module responses, coaching records, communications, and billing.
• Your Partner, where you take part as a couple: Couples features are designed so that each partner's private answers stay private. Your partner sees only what is built to be shared, such as a couple map after you both finish, or an agreement you both chose.
• Someone Paying for Your Sessions: If your sessions are billed to another person, that person receives invoices and statements showing session dates and amounts. They do not receive your assessment results or notes.
• Stronghold System Administrators: For technical support, security monitoring, and system maintenance only.
• Legal Requirements: Where the law requires it, or to protect someone from serious harm (see the Terms of Service on mandatory reporting).
• No Selling of Data: We do not sell or rent your personal data, and we do not share it with advertisers or data brokers.

5. Service Providers (Subprocessors)

We use the following providers to operate Stronghold. Each receives only what its service needs, under its own contractual data protection obligations.

• Supabase / Amazon Web Services: database, file storage, and server functions.
• Netlify: hosting for our websites and apps.
• Anthropic: AI processing for Macy, the Stronghold Guide, reports, plans, and document reading (see Section 7).
• AssemblyAI: converting audio to text, for voicemails and for sessions your practitioner chooses to transcribe.
• Twilio: text messages, phone calls, and voicemail.
• Bird (MessageBird): some text messages for the Boundary program.
• Postmark and Resend: email delivery.
• Google: Gmail and Google Calendar when your practitioner connects them, so their emails and calendar invites to you come from their own account; Google Analytics and Google Fonts on our public website (see Section 9); and connection services for video sessions.
• Cloudflare: relaying video session connections when a direct connection is not possible. Video sessions are not recorded.
• Stripe: payment processing, saved cards, invoices, and payouts to practitioners.
• ipify: reading your IP address during the assessment so it can be stored with your consent record.

6. Texts, Calls, Voicemail, and Transcription

• Text messages: If you give your phone number and agree to texts, your practitioner may text you about appointments, reminders, links to your modules and reports, and billing. Message frequency varies. Message and data rates may apply. Reply STOP to stop and HELP for help. Agreeing to texts is not a condition of buying anything. Marketing texts are sent only if you separately opt in.
• Calls: Live phone calls with your practitioner through the platform are not recorded.
• Voicemail: If you leave a voicemail, it is recorded and converted to text so your practitioner can read it.
• Session transcription: Some practitioners use transcription during sessions to take notes. Your practitioner must ask for your consent before transcribing a session, and you may say no.

7. AI-Assisted Processing

Stronghold uses AI provided by Anthropic (Claude) in two ways: Macy, an assistant for your practitioner, and the Stronghold Guide, an assistant you can talk to between sessions if your practitioner turns it on. Here is specifically how your data is handled:

• What the AI processes: To do its work, the AI receives your name and the names you gave for family members, your age, your intake answers in your own words, your assessment and module scores, your practitioner's session notes and plans, session and voicemail transcripts, and text read from documents and photos you or your practitioner upload. When you chat with the Stronghold Guide, it receives your messages. We do not deliberately include your email address or phone number, though they may appear inside a document or message you send.
• Purpose: For your practitioner: session prep briefs, plan recommendations, pattern summaries, report drafts, and reading uploaded documents. For you: the Stronghold Guide's replies, which follow your practitioner's approach and plan.
• Your practitioner stays in charge: Macy's work goes to your practitioner, who reviews it before anything reaches you. The Stronghold Guide is an AI, not your practitioner and not a person; it says so, it does not write into your record, and it directs you to your practitioner and to crisis resources when you need a person.
• Not used to train AI models: Your data is never used by us to train, fine tune, or improve AI models, and Anthropic's commercial terms do not permit using our API data to train its models. Anthropic may retain API data for a limited period under its own data handling policies.
• No autonomous decisions: AI does not make decisions about your coaching, referrals, or care.
• Opt-out: You may ask your practitioner in writing to coach you without AI assistance. Some features will not be available, but core coaching can continue.

8. Consumer Health Data

Some of what you share (for example wellbeing check-ins, stress, sleep, fitness, or substance use answers) may be considered consumer health data under laws such as Washington's My Health My Data Act and similar laws in Nevada and Connecticut. We collect it only to provide the services you asked for, with your consent; we share it only with your practitioner and the service providers above; we never sell it; and you may access it, delete it, or withdraw your consent using the contact details in Section 17.

9. Cookies and Tracking

Our apps (app.strongholdassessment.com and my.stronghold.coach) use your browser's storage for sign in and to save your progress. We record which pages are used inside our own database to improve the product; no third party analytics or advertising tools run inside the apps, and your answers are never visible to any analytics service.

The public website (strongholdassessment.com) uses Google Analytics to understand aggregate site usage: which pages are visited, roughly where visitors come from, and how they move through the site. This involves cookies and the transmission of technical data (such as a truncated IP address, device type, and pages viewed) to Google. It never includes assessment data, names, or contact details. You can opt out with the Google Analytics opt-out browser add-on or by using a browser's tracking protection. The public website also loads fonts from Google Fonts, which receives your IP address as part of serving the font files.

We do not use advertising cookies or retargeting pixels on any of our sites.

10. Data Retention

• Coaching records (contact details, assessment responses and scores, notes, communications, and voicemails) are retained for 7 years after your coaching ends, to support re-assessment comparisons and record keeping obligations.
• Budget photos taken to read figures in are deleted within about an hour of being read.
• Budget documents you upload for your practitioner are deleted after 14 days, or sooner if you or your practitioner delete them.
• Call recordings, where one is made for transcription, are deleted from our phone provider once the transcript is saved.

You may request deletion of your data at any time by contacting your practitioner or emailing johnathan@drhinesinc.com. Deletion requests are processed within 30 days, except for records we are required by law to keep.

11. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data.
• Portability: Request your data in a structured, machine readable format.
• Withdraw consent: Stop texts (reply STOP), unsubscribe from email, opt out of marketing, or opt out of AI assistance.
• Opt-Out: Opt out of anonymized data usage for system improvement.

To exercise any of these rights, contact us at johnathan@drhinesinc.com or through your practitioner.

12. California Residents (CCPA)

If you are a California resident, you have the right to: (a) know what personal information we collect and how it is used, (b) request deletion of your personal information, (c) correct inaccurate personal information, (d) limit the use of sensitive personal information, (e) opt out of the sale or sharing of personal information (we do not sell or share personal information for advertising), and (f) not be discriminated against for exercising your privacy rights.

13. Children's Privacy

Stronghold is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors, except the names and ages of children that an adult chooses to mention in their own intake. If you believe a minor has provided us with personal information, please contact us immediately.

14. Clinical Disclaimer

The Stronghold Assessment is a coaching tool, not a clinical instrument. Results do not constitute a medical diagnosis, psychological evaluation, or clinical assessment. If assessment results suggest patterns associated with a mental health condition, your practitioner may recommend a referral to a licensed mental health professional.

15. Security Incidents

If we learn of a security incident that affects your personal information, we will notify you and any required authorities as the law requires.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or via your practitioner, and the "Last Updated" date above will change. Continued use of the platform after changes constitutes acceptance of the updated policy.

17. Contact Us

For privacy inquiries, data requests, or questions about this policy:
Email: johnathan@drhinesinc.com
Website: strongholdassessment.com
Mail: Dr. Hines Inc., 2604 W Kenosha St, Suite 221, Broken Arrow, OK 74012