VibeCheck Privacy Notice

1. Who We Are

Mental Wealth Solutions, Inc. ("we," "us," or "our"), a New York corporation, operates VibeCheck, a software platform that licensed providers use to support care. Under HIPAA, we are a Business Associate of those providers; the provider is the Covered Entity. We handle protected health information ("PHI") on the provider's behalf under a written Business Associate Agreement ("BAA"). This notice is not a Notice of Privacy Practices — your provider issues that.

2. Information We Process

On behalf of your provider, we may collect and maintain:

• Registration data: Name, email address, date of birth, role (client/provider).
• Clinical data: Session notes, check-in responses, mood and wellness scores, assessments (PHQ-9, GAD-7, etc.), safety plans, and homework submissions.
• AI interaction data: Messages sent to and received from AI-assisted features.
• Usage data: Log data, session identifiers, IP addresses, and device information collected for security and operational purposes.

3. How We Use & Disclose Information

As a Business Associate, we use and disclose PHI only as permitted by our BAA and HIPAA — principally to provide VibeCheck to your provider and at your provider's direction. Your provider's Notice of Privacy Practices governs how your PHI is used for your treatment, payment, and the provider's health care operations.

• To operate the platform for your provider: Hosting, processing, and supporting the clinical workflow your provider uses within VibeCheck.
• Service providers under BAAs: We share PHI only with subcontractors that have signed Business Associate Agreements (see Section 6).
• As required by law: Responding to a valid court order, subpoena, or other legally required disclosure, and notifying your provider as the BAA requires.
• Safety: Supporting your provider's response when there is a serious and imminent threat to safety, consistent with HIPAA and the provider's instructions.

We do not sell PHI, and we do not use or disclose PHI for marketing except as your BAA and HIPAA permit.

4. AI-Assisted Features

VibeCheck uses AI features to support your provider's care (for example, draft summaries, supportive psychoeducational content, and safety-related classification). PHI is processed inside Mental Wealth Solutions, Inc.'s AWS environment and is sent only to an AI inference service that is covered by a Business Associate Agreement — currently Amazon Bedrock, running within AWS under the AWS HIPAA BAA. PHI is never sent to a consumer, non-BAA AI endpoint, and is not used to train general-purpose AI models. AI output is not a clinical judgment, diagnosis, or treatment decision; your provider reviews and remains responsible for your care. The AI is not a licensed clinician and is not a crisis service.

5. Your HIPAA Rights — Exercised Through Your Provider

HIPAA gives you rights over your PHI, but you exercise those rights through your provider, who is the Covered Entity and issues its own Notice of Privacy Practices. Through your provider you may:

• Access and copy your PHI (45 C.F.R. § 164.524).
• Request an amendment of your PHI (§ 164.526).
• Request an accounting of certain disclosures (§ 164.528).
• Request restrictions on certain uses and disclosures.
• Request confidential communications by alternative means or locations.
• Receive your provider's Notice of Privacy Practices.
• Be notified of a breach of your unsecured PHI.

Direct these requests to your provider — not to VibeCheck or Mental Wealth Solutions, Inc.. As Business Associate, we support your provider in fulfilling them, but your provider is responsible for responding.

6. Service Providers Under Business Associate Agreements

Where we use subcontractors that handle PHI, each has signed a Business Associate Agreement that flows down the same protections. Our primary subcontractor is Amazon Web Services, which provides our cloud infrastructure and the AI inference service (Amazon Bedrock) under the AWS HIPAA BAA. We do not send PHI to any vendor that has not executed a BAA.

7. How Long We Keep Information

We process and retain PHI on behalf of, and according to the instructions of, your provider under our Business Associate Agreement. HIPAA requires a Business Associate to retain HIPAA compliance documentation for at least six (6) years (45 C.F.R. §§ 164.316(b)(2), 164.530(j)(2)). Retention of the clinical record itself is governed by your provider's policies and applicable state law (for example, New York record-retention requirements), not by a fixed HIPAA period. Audit logs are retained consistent with our security program. De-identified data (45 C.F.R. § 164.514) may be retained.

On termination of a provider's BAA, we return or destroy the provider's PHI as the BAA directs. To delete an account or records, contact your provider; we act on your provider's instructions and applicable law.

8. How We Protect Information

• PHI is encrypted at rest using AES-256 (pgcrypto).
• All data in transit is encrypted via TLS 1.2+.
• Access is controlled by role-based permissions (RBAC).
• Multi-factor authentication (MFA) is enforced, and sessions time out after 15 minutes of inactivity.
• Infrastructure is hosted on AWS under a HIPAA Business Associate Agreement.
• Append-only, tamper-resistant audit logs record access to records.

9. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with your provider, with us, or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

• Contact us: hello@vibecheck.luxury
• HHS OCR: https://www.hhs.gov/hipaa/filing-a-complaint/

10. Contact

11. Changes to This Notice

We may update this notice. We will post the revised notice on this page with a new effective date. Changes to how PHI is handled remain subject to our Business Associate Agreements with providers.

Effective May 21, 2026 · Mental Wealth Solutions, Inc., a New York corporation · Patent Pending — U.S. Provisional Application No. 64/059,214 (filed May 6, 2026).