Privacy Policy

Last updated July 31, 2026

1. OVERVIEW

Traumalis, LLC, a Georgia limited liability company (“we,” “our,” or “us”), provides a self-guided digital wellness tool. The Service is offered only to users in the United States. This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices available to you.

We make the Service available in two ways, and parts of this Policy apply differently depending on how you use it:

  • “Individual Users” are individuals who purchase and use the Service directly, without a healthcare organization.
  • “Organizational Users” are healthcare organizations and the licensed clinicians who administer the Service to their patients, together with those patients.

Where a section applies only to one type of user, we say so.

2. INFORMATION WE COLLECT

2.1 From Healthcare Organizations (Organizational Users):

  • Account and billing information
  • Access configurations
  • Contractual and contact information for agreement purposes
  • Service usage analytics and support communications

2.2 From Clinicians (Organizational Users):

  • Name and email for account setup
  • Session activity and application usage data
  • Support requests

2.3 From Patients (via Clinician-Administered Sessions):

Patient data is collected through the healthcare organization and processed under clinician oversight. We do not collect information that we use to identify individual patients. Data collected includes:

  • Session data, including session responses, self-reported distress ratings, cognitive, emotional and physical assessments, and other data generated during use of the Service
  • Technical data such as session timestamps and device/browser information

2.4 From Individual Users (Direct Purchasers):

When you use the Service directly, without a healthcare organization, we collect:

  • Screening responses you provide before purchase to determine eligibility.
  • Session data, including your session responses, self-reported distress ratings, cognitive, emotional and physical assessments, and other information you generate during use of the Service. The Service does not require an account, and we do not ask you for information intended to identify you personally within the Service.
  • Technical data, such as session timestamps, device and browser information, and general location inferred from your IP address.
  • Payment information. Purchases are processed by our third-party payment processor, which collects the details needed to complete your transaction (such as name, email, and billing information). We do not store full payment card numbers.
  • Limited advertising measurement data. When you reach our website from an online advertisement, we and our advertising providers use cookies and similar technologies to measure whether the ad led you to visit our site. This is described further in Section 3 and Section 4.

3. HOW WE USE INFORMATION

3.1 Service Provision: To provide, maintain, and improve the Service.

3.2 Billing: To process payments and manage purchases and accounts.

3.3 Support: To provide technical support and respond to your requests.

3.4 Product Improvement: To analyze aggregated and de-identified usage in order to improve the Service.

3.5 Advertising Measurement (Individual Users): To understand how people find us and to measure and improve our advertising. For this purpose we use limited, non-identifying signals, such as whether an advertisement click led to a visit to our website. We do not use your session data, your screening responses, or information about your purchases for advertising.

3.6 Legal Compliance: To comply with applicable laws and to protect our rights, our users, and the public.

4. HOW WE SHARE INFORMATION

We do not sell, share, or give away your session data. Your session responses, distress ratings, and assessments are never used for advertising and are never transmitted to advertising or analytics providers.

We share information only as described below:

  • Service providers. Providers such as our payment processor and hosting providers act on our behalf under contract, only to deliver the Service you requested, and are not permitted to use your information for their own purposes, including advertising.
  • Advertising providers. For Individual Users, we share limited, non-identifying signals with advertising providers (such as Meta) to measure and optimize our advertising, for example that an advertisement click led to a visit to our website. We do not send advertising providers your session data, your screening responses, or information identifying your purchases.
  • Healthcare organizations. For Organizational Users, patient session data is made available to the administering healthcare organization and clinician.
  • Legal authorities, when required by law or to protect rights and safety.
  • Business successors, in connection with a merger, acquisition, or sale of assets.

We keep the session data you generate separate from your payment and advertising data, and we do not link your session responses or distress data to your payment identity.

5. DATA SECURITY

We implement appropriate technical and organizational measures to protect information, including encryption, access controls, and regular security assessments. Session data and payment data are maintained separately. No system is perfectly secure, and we cannot guarantee absolute security.

6. DATA RETENTION

We retain information only as long as necessary to provide the Service, operate our business, and comply with legal obligations, after which it is deleted or de-identified.

7. HEALTH DATA AND SENSITIVE INFORMATION

We treat your screening responses and session data as sensitive. We do not sell this information, we do not share it for advertising, and we do not use it for advertising. We collect it only to provide the Service to you.

For Organizational Users, the Service may involve protected health information (“PHI”). Because patient data is collected without information we use to identify individual patients, it does not currently constitute PHI under HIPAA. Should we begin processing identifiable PHI, we will implement HIPAA-compliant safeguards and execute Business Associate Agreements with the relevant covered entities before doing so.

For Individual Users, the Service is a direct-to-consumer wellness product and is not offered through a HIPAA-covered entity, so HIPAA does not apply to that use. Information you provide as an Individual User is handled under this Policy and applicable consumer-privacy and consumer-health-data laws.

8. YOUR CHOICES AND RIGHTS

Cookies. Most browsers let you refuse or delete cookies through your browser settings. Because we do not share personal information with advertising providers for targeted advertising, there is no advertising “sale” or “share” for you to opt out of.

State privacy rights. Depending on where you live, you may have rights to access or delete the personal information we hold about you. To make a request, contact us at support@traumalis.com, and we will respond as required by applicable law.

9. CONTACT INFORMATION

For privacy questions, contact us at support@traumalis.com or by mail at Traumalis, LLC, 8735 Dunwoody Place, Ste R, Atlanta, GA 30350.