New Growth Recovery LLC Patient App — Privacy Policy

Effective date: 7 September 2026

This Privacy Policy describes how the New Growth Recovery LLC patient mobile application (“the App”) collects, uses, stores, and protects your information. It supplements, and does not replace, New Growth Recovery LLC’s HIPAA Notice of Privacy Practices, which governs your medical record as a whole. Where this policy and the Notice of Privacy Practices differ, the stricter protection applies.

Your use of this App, and the information you share through it, is protected by 42 CFR Part 2, the federal regulation governing the confidentiality of substance use disorder treatment records — in addition to HIPAA. Part 2 applies to everything in this App, including messages, survey responses, schedule information, and check-in data, not only clinical notes.

Information the App Collects

Account information: your phone number, which is how you sign in. The App does not use a password or a PIN. When you sign in, we text a six-digit code to your phone; it can be used once and expires after ten minutes. Signing in successfully keeps you signed in on that device for fourteen days.
Consent records: your Part 2 consent status, the version of the consent form you agreed to, and any updates or revocations you make.
Sign-in codes: short-lived codes generated when you check in for treatment. Each expires two minutes after it is created and can be used once.
Schedule information: appointment and group times you view, and the days you tell us you will miss, arrive late for, or leave early from, together with the reason you give.
Survey responses: your answers to satisfaction and engagement surveys.
Messages: reminders and announcements sent to you from New Growth Recovery LLC staff or generated automatically by our systems. Messaging is one-way; the App does not let you send messages to staff.
Rewards activity: points earned through app engagement.
Device information: a push notification token, so the App can notify you of new messages. Notification text is generic and never reveals treatment details, message content, appointment names, or the name of this program on your lock screen.

How Your Information Is Used

Your information is used only to:

Verify your identity and check you in for treatment
Show you your schedule and let you submit attendance plans
Deliver messages and reminders from your treatment program
Collect your feedback through surveys
Track your rewards progress

We do not use your information for advertising, and we do not sell your information to any third party.

How Your Information Is Stored and Protected

App data is stored on Google Cloud Platform (Cloud Run and Cloud SQL, in Google’s us-east1 region, within the United States). It lives in a separate cloud project with its own database, not alongside New Growth Recovery LLC’s staff-facing systems.
The database is encrypted at rest. In addition, the information most likely to say something about you is separately encrypted field by field, so it is unreadable even to someone holding a copy of the database: message content, survey answers, appointment descriptions, and the reasons you give for missing or shortening a day.
Access to your data is limited to authorized New Growth Recovery LLC staff who need it to provide your care, consistent with the “minimum necessary” standard under HIPAA and the qualified service organization and administrative-control provisions of 42 CFR Part 2.
We do not disclose sign-in, schedule, message, or survey data to any outside party without your written consent, except in the narrow circumstances permitted by 42 CFR Part 2 (for example, medical emergency, mandated reporting, or a valid court order) as described in our HIPAA Notice of Privacy Practices.

Information Shared With New Growth Recovery LLC’s Treatment System

The App and New Growth Recovery LLC’s internal treatment system are separate systems, and a limited amount of information moves between them so that the App can show you accurate information and so that your attendance is recorded:

Appointments come in. Your scheduled sessions are copied from the treatment system into the App so you can see your calendar. Only your individual sessions are copied; group sessions are not.
Check-ins go out. When staff scan your sign-in code at the front desk, the App confirms to the treatment system that the code was valid, so your attendance can be recorded. What crosses is that confirmation, the time, and the identifier the treatment system already uses for you. Your name is not sent: the first name staff see on the desk display comes from the treatment system’s own record of you, not from the App.

Both systems are operated by New Growth Recovery LLC, under its direct administrative control, and both are subject to 42 CFR Part 2 and HIPAA. No one outside the organization can reach your information through either of them. Moving information between them is New Growth Recovery LLC using your information to care for you; it is not a disclosure to anyone else, and it does not put your information outside the program.

Your Rights

You may:

Withdraw your Part 2 consent at any time, in the App’s Settings screen, by telling staff verbally or in writing, or by deleting the App. Withdrawing does not affect your treatment, and staff are not told about it except those who maintain the App.
Request a copy of the information the App holds about you. There is no button for this in the App; ask any member of staff and we will produce it.
Request correction of information you believe is incorrect, by contacting New Growth Recovery LLC.
Contact New Growth Recovery LLC with questions about how the App handles your information.

Because New Growth Recovery LLC is subject to state licensure recordkeeping requirements, some data may need to be retained for a required period even after a deletion request; we will explain any such limitation if it applies to your request. Withdrawing consent stops the App from showing or collecting your information, but does not by itself delete what was collected beforehand.

Deleting Your Information

How to ask. Tell any member of staff, or call New Growth Recovery LLC on (413) 288-3800, 9am to 8pm, any day. You can also write to us at the address at the end of this policy. Give the name and phone number you use with the App so we can find your account. You do not have to say why.

What we delete. Within 30 days of your request we remove, from the App’s systems: the messages you have been sent, your survey answers, your schedule submissions and the reasons attached to them, your appointment calendar, your rewards points and their history, and every device signed in to your account, including the token used to send you notifications. Your account is closed and you will not be able to sign in again unless you ask us to set it up afresh.

What we keep, and why. Three things survive a deletion request:

The record that you consented, and later withdrew, and the account entry it belongs to — your name and phone number. 42 CFR Part 2 works by our being able to show when your consent was in force and when it ended; deleting that record would destroy the evidence that we were entitled to hold your information at all. It holds the dates and which version of the form you agreed to, and nothing about your treatment.
The access record. Part 2 also expects us to be able to say what was looked at and when. That record is what makes your consent record mean something, so it is kept for the same reason. It notes which part of the App was opened, at what time, and never what it said — no messages, no survey answers, no appointment details.
Anything that has become part of your clinical record, and anything Massachusetts licensure rules require us to keep for a set period. If that applies to your request, we will tell you what it covers and when it expires.

Deleting the App from your phone is not the same thing. It stops the App reaching you, but information already collected stays on our systems until you ask us to remove it.

Your treatment record is separate. This section is about the App. Your clinical record is held in New Growth Recovery LLC’s own treatment system and is governed by our HIPAA Notice of Privacy Practices. Deleting your App information does not change it, and does not affect your care.

Age

The App is for patients aged 18 or over, or who have reached the age of consent for substance use disorder treatment in Massachusetts. We do not knowingly collect information through the App from anyone younger. Patients under that age check in and receive information the way everyone did before the App existed.

Third-Party Services

The App uses the following third-party services to operate. Each holds a signed business associate agreement with New Growth Recovery LLC, and none of them is permitted to use your information for its own purposes.

Google Cloud Platform — hosts the App’s servers and database in the United States.
RingRx — sends the text message containing your sign-in code. RingRx therefore handles your phone number. The message itself is deliberately bare — it reads only “123456 is your verification code” and does not name this program or say what the code is for, so that a text arriving on a lock screen does not disclose that you are in treatment.
Expo push notification service, and Apple Push Notification service — deliver notifications to your phone. They do not receive message content, appointment details, or your name; the notification says only that something is waiting. They do learn that a particular device was sent a notification at a particular time.

The App contains no analytics, advertising, or crash-reporting services of any kind.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the App before the changes take effect.

Contact Us

Questions about this Privacy Policy or how the App handles your information can be directed to:

New Growth Recovery LLC 1350 Main St, Suite 1500 Springfield, MA 01103