Bring It In Privacy Policy

Effective Date: July 15, 2026. Version 1.0.

Bring It In is a product of ECQO Holdings, built on the ECQO Safe Source clinical AI infrastructure.

1. Who We Are

Bring It In is an AI companion for athletes and the people around them, operated by ECQO Holdings ("we," "us," or "our") and built on the ECQO Safe Source clinical AI infrastructure. Bring It In was founded by Bianca D. McCall, M.A., LMFT, a Licensed Marriage and Family Therapist. Questions about this policy may be directed to [email protected].

2. Information We Collect

2.1 Information You Provide Directly

Account Information: Email address and password when you create an account. Authentication is provided through a secure managed identity service.

Signup Confirmations: Your confirmation that you are 18 or older, your state of residence, and the versions of the Terms of Service and Privacy Policy you have accepted.

Payment Information: Billing details processed securely through Stripe. We do not store full credit card numbers.

Conversation Content: The text messages and voice audio you send to the companion, and the companion's responses. See Section 4 for full provisions.

Check-In and Screener Responses: Responses to wellness check-ins used to personalize your experience and operate safety protocols.

Communications: Messages you send to us via email or contact forms.

2.2 Information Collected Automatically

Usage Data: Pages visited, features used, session duration, and interaction patterns. Device Information: Browser type, operating system, device identifiers, and IP address. Cookies and Tracking: Session cookies for authentication and preference cookies for personalization. Referral Data: UTM parameters and referral sources to understand how users discover Bring It In.

3. How We Use Your Information

We use your information to: provide and personalize the Service, including generating companion responses; operate the safety protocols described in Section 4; process subscription payments, top-ups, and manage your account; send service communications including receipts, updates, and support responses; improve and develop the platform through usage analysis; ensure the security and integrity of the Service; and comply with legal obligations.

We do not sell your personal information. We do not use your conversation content or check-in responses for advertising targeting.

4. Conversation Data and Human Safety Review

Conversations with the companion are among the most sensitive data we handle. The following provisions apply:

AI Processing: Your messages are processed in real time by third-party artificial intelligence providers, including Anthropic Claude models accessed through Amazon Web Services, under data processing agreements. Conversation content is transmitted to these providers solely to generate the companion's responses.

Automated Safety Monitoring: Automated systems evaluate conversations for safety indicators, including indicators of crisis or elevated risk.

Human Clinical Review: When safety indicators are present, or as part of quality assurance, conversation content may be reviewed by authorized licensed clinical reviewers. Reviewer access is restricted, credentialed, and logged. If safety thresholds are triggered, companion engagement may be paused pending clinician review.

Crisis Resources: If a conversation indicates crisis, the Service surfaces the 988 Suicide and Crisis Lifeline and other supportive resources. The Service is not a crisis service and does not dispatch emergency responders.

Storage: Conversation content is stored in encrypted form in our database so your conversation history persists across sessions.

Retention: Conversation content is retained while your account is active, and deleted or de-identified within 90 days following account closure or a verified deletion request. Records connected to safety events may be retained longer where required by law or professional standards.

5. Voice Data

The companion's voice replies are synthetic audio generated through our voice technology provider (ElevenLabs). Voice audio you send to the companion is processed to generate a response and is stored as part of your conversation history under Section 4.

6. How We Share Your Information

We do not sell personal information. We share data only in the following limited circumstances:

Service Providers: Trusted vendors who assist in operating the Service: Amazon Web Services (hosting, database, authentication, and AI model access), Anthropic (AI responses), Stripe (payment processing), ElevenLabs (voice synthesis), and Cloudflare (content delivery and security). All vendors are bound by data processing agreements and may not use your data for their own purposes.

Legal Requirements: When required by law, court order, or governmental authority.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before any such transfer and provide opt-out options where required by law.

Protection of Rights: When necessary to protect the rights, property, or safety of ECQO Holdings, our users, or the public.

7. Data Retention

Account Data: Retained for the duration of your subscription plus 90 days following cancellation, then deleted or anonymized. Conversation Data: Retained per Section 4. Check-In and Screener Data: Retained for the life of your account, then deleted. You may request deletion at any time. Payment Records: Retained for 7 years as required by financial regulations.

8. Your Rights

Depending on your jurisdiction, you may have the right to: access a copy of the personal data we hold about you; request correction of inaccurate or incomplete data; request deletion of your personal data, subject to legal retention requirements; request your data in a structured, machine-readable format; object to certain processing activities; and withdraw consent at any time for processing based on consent.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. California Privacy Rights (CCPA / CPRA)

Do Not Sell or Share: We do not sell or share personal information for cross-context behavioral advertising. You may still submit a Do Not Sell or Share request at [email protected].

Sensitive Personal Information: Conversation content, check-in responses, and payment card information are treated as sensitive. We collect this data only with your consent and use it only to provide the Service and operate its safety protocols.

Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Authorized Agent: You may designate an authorized agent to submit requests on your behalf. We will verify the agent's authority before fulfilling requests.

10. International Users (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, our lawful bases for processing personal data include contract (providing the Service you subscribed to), legitimate interests (analytics and security), consent (optional features and marketing communications), and legal obligation (financial record-keeping). EEA and UK users have the right to lodge a complaint with their local supervisory authority. Data may be transferred to and processed in the United States. Where required, we implement Standard Contractual Clauses to ensure adequate protection.

11. Children's Privacy

Bring It In is not directed to individuals under the age of 18, and signup requires confirmation that you are 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us immediately at [email protected] and we will delete it promptly.

12. Security

We implement industry-standard security measures including TLS encryption in transit, encryption at rest for stored data, secrets management for credentials and keys, least-privilege access controls, logged and credentialed access for authorized clinical reviewers, and regular security reviews. However, no system is completely secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect unauthorized access to your account.

13. Third-Party Services

Bring It In integrates with the following third-party services. Each has its own privacy policy governing its data practices: Amazon Web Services (hosting, database, authentication, and AI model access, aws.amazon.com/privacy), Anthropic (AI model provider, anthropic.com/privacy), Stripe (payment processing, stripe.com/privacy), ElevenLabs (voice synthesis, elevenlabs.io/privacy), and Cloudflare (content delivery and web security, cloudflare.com/privacypolicy).

Bring It In is not responsible for the privacy practices of these third parties. We encourage you to review their policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page and, for material changes, notify you by email or by displaying a prominent notice on the Service before the change takes effect. The Service records the version of the Privacy Policy you have accepted, and material changes may require renewed acceptance.

15. Contact Us

For privacy-related questions, requests, or concerns, contact us at:

ECQO Holdings Attn: Privacy [email protected] ecqoholdings.com

Bring It In is a wellness tool and is not a substitute for professional mental health treatment. Data collected through Bring It In is not protected health information (PHI) under HIPAA, as ECQO Holdings is not a covered entity or business associate under HIPAA. Always consult a licensed clinician for clinical concerns. If you are in crisis, call or text 988.

Read the Terms of Service →Back to ECQO Holdings