Consumer health data notice

BKL email accounts and optional encrypted saving

You can create a BKL account with a verified email address and password. Supabase manages authentication and Resend delivers confirmation and recovery email; email messages do not include your reflection text. Sign-in does not start a purchase or subscription. Existing ChatGPT learning access can be linked only after both accounts are verified and you explicitly confirm the link.

Optional encrypted saving is available in the journal and within the Selfhood & Individuation reflection and five modules. Only the work you review and confirm is saved. Unsaved writing and all other assessment and module worksheets retain their tab-only behavior. Saving stores ciphertext, your account identifier, pathway/module, revision and timestamps in BKL’s Supabase database in US East (Ohio). The hosting service processes these requests. Topic and size metadata remain visible. This information is used to provide saving, reopening, recovery and access control; it is not automatically shared with a therapist, partner or AI.

Your separate journal password and recovery key unlock saved writing on your device. They are not submitted to the storage API. Email account recovery alone cannot decrypt the journal. If you lose the journal password, recovery key and all unlocked sessions, BKL cannot recover the writing. Keep the recovery file private. Encryption does not protect an unlocked device or compromised application code; this implementation has not had an independent security review.

Each reflection or module has one current saved copy. A confirmed replacement overwrites that copy; it does not create an application history. Download any earlier copy you want to keep. You can reopen, replace, download or delete active saved work. Provider backups and downloaded copies are separate; deletion from backups and restoration handling have not been verified. For account or privacy requests, use Customer support without sending private reflection text. Account attempts use short-lived hashed request counters. No journal text or password is included in those counters.

Optional private workspace pilot

The owner-only private workspace is an exception to the tab-only worksheet behavior described elsewhere. Only text explicitly selected, reviewed and confirmed there is saved. It stores selected reflection fields, pathway/module, your Supabase account identifier, revision, notice version and save times in BKL’s Supabase database in US East (Ohio). The Sites host processes each request. Your account email and authentication are handled by Supabase; Resend delivers account confirmation and recovery email and does not receive your saved reflection text.

The workspace does not automatically import assessment answers, worksheet notes, AI reports or feedback. Other reflection tools retain their existing tab-local behavior. Saving is optional. Saved notes are available only through your verified account and the owner pilot gate; there is no partner or therapist sharing. Authorized infrastructure administrators may be able to access stored data. This is not end-to-end encrypted storage.

The current record remains until you replace or delete it; no automatic retention period or application-level text history is configured. You can reopen, download, replace or delete the active record in the workspace. Deletion from Supabase backups and restore handling have not been verified, and downloaded copies remain wherever you keep them. Public rollout requires further operational and privacy review. Test with fictional or low-sensitivity learning notes, without clinical records, client details or identifying information about others.

This describes the current learning-site design. A legal and vendor review is still needed to establish applicable requirements, retention periods, and a working request process for the live service. This notice is not a representation of completed legal compliance.

Optional AI assistance

All assessments and pathways offer an optional AI choice alongside independent learning. Generation is not activated; the existing configured owner pilot gate remains. If enabled, only separately selected and reviewed fields would be sent to OpenAI with explicit consent for one response. No writing is sent while you type or simply choose a mode. AI drafts are educational reflections and are not reviewed by a clinician. Read the AI processing and retention details before deciding whether to submit. Independent reports remain available without AI.

Reflections and downloads

The questionnaires and module exercises hold answers and notes in the current browser tab. Except for the explicit Selfhood saving control described above, these tools do not send those entries to Brian or store them with an account. Downloaded reports remain on your device unless you share them; device backups, browser extensions, shared devices, and your chosen sharing service have their own risks and settings.

Accounts, purchases, and requests

Hosting and sign-in services provide account identity for authentication and access control. The learning-site payment database stores an account-derived identifier, chosen module, payment environment, order and checkout references, timestamps, and checkout acknowledgment version and time. Square receives the module title and a checkout reference and handles payment information. These records are used to process purchases and verify access; they do not contain questionnaire answers or exercise notes.

Account-linked purchases and requested page addresses can reveal an interest in mental-health or relationship topics. Ordinary hosting and security information may include IP addresses and requested URLs. Browser-only answers therefore do not mean that all site activity is anonymous or that no potentially sensitive data is processed.

Customer support

The support form sends the contact information and message you choose to provide through FormSubmit to Brian’s inbox. A page name or message may reveal a learning interest. Do not send assessment answers, clinical information, or private reflections. FormSubmit retains a submission archive for 30 days; email copies may remain in the inbox. See Privacy & use for support handling details. You can use Customer support to make a privacy request without including sensitive details in the initial message.

Sources and recipients

Information comes from your browser requests, sign-in provider, checkout choices, and Square payment records. Hosting/authentication services and Square process information for those functions. Their retention and contractual terms require review. Following a reading or appointment link takes you to a separate service.

Uses and sharing

The current site code uses these records to deliver the site, authenticate access, process payments, and verify purchased modules. It does not send reflection answers to advertising services or sell answers. This statement does not establish that every vendor practice has been audited. Any additional use or sharing requires review and an appropriate updated notice and permission where required.

Access, deletion, and withdrawal requests

Use Customer support to request help with access, deletion, or withdrawal of consent. The full process for applicable requests and appeals, provider handling, and retention periods still requires documentation and review. Purchase acknowledgment is not consent to optional health-data sharing.