Last updated: October 28, 2026
This policy covers the Next Step app, its optional Cloud Backup account and its clinician portal, operated by Cipher Haus, LLC, a Delaware limited liability company ("we", "us"). It applies to everyone who uses Next Step, including people in Washington, Nevada and Connecticut. Because Next Step is an eating disorder recovery app, we treat the personal data it handles as consumer health data, including data that could show that you use it.
Contact: [email protected].
If you use Next Step without an account, your recovery data stays on your phone and we don't receive it. We receive crash reports (see below) only if you choose to share them; the app asks the first time you open it, and they're off until you say yes. If you create a Cloud Backup account, we collect:
We use this data only to provide the features you ask for: to store, back up and sync your data, restore it on another phone, show it to clinicians you choose, deliver your messages, run your account (including the account emails listed in our Privacy Policy), keep the service secure, and find and fix problems.
For a Cloud Backup account, the app asks for your consent to this policy, separately from agreeing to our Privacy Policy and Terms. It asks on the sign-up screen; on the set-password page, if our staff created your account; and, for an account that hasn't given it yet (such as one from before October 21, 2026) or gave it for an older version of this policy, the next time you sign in or open the app. Until you consent, current versions of the app don't back up that account's data. We record when you consented and which version of this policy it was. Crash reports are a separate choice in the app (Settings, Privacy & Diagnostics).
Your data is stored on your phone. If you use Cloud Backup, it's sent over HTTPS to our server and stored there in a form our server can read; it isn't end-to-end encrypted. Our service providers process it for us: Render (our server and database), Cloudflare (photo storage), Resend (account emails) and Sentry (crash reports). Our staff can see some of it in the System Console, our administration tool, as our Privacy Policy describes: account details, connections, photos in cloud storage, and questionnaires with their answers, whatever your Care Team settings say. Staff accounts must use two-factor authentication, and what they do there is recorded. On Android, the app includes Google's ML Kit, which it uses only to scan a clinician's QR code. The scan happens on your phone; Google says ML Kit sends it device and app information, an installation ID and performance measurements.
We don't share consumer health data with any affiliates. We don't sell consumer health data.
You have the right to:
You can also act yourself in the app: change or revoke a clinician's access in Care Team, turn off crash reporting in Settings, under Privacy & Diagnostics, delete a chat on your side, delete your account in Cloud Backup, under Profile, and erase the data on your phone in Settings, under Data. See Delete your account for what's deleted and what's kept.
You can review and change most of your data in the app. To ask us to correct anything you can't change yourself, email us.
Email [email protected] with "Health data request" in the subject line, and tell us what you'd like us to do. If you have an account, write from the email address on it: we'll reply to that address to confirm the request came from you before we act. If that address was never confirmed, we can still delete your account or correct your data (other than your email address) once you've replied. To get access to your data or a copy of it, the address must be confirmed: sign in, confirm it with the code we email you, and then write to us again. You don't need to create an account to make a request. If you don't have one, we don't hold your recovery data; crash reports aren't linked to a name or email address, so we may not be able to find them.
We'll respond within 45 days of receiving your request. If we need longer, we'll tell you why within those 45 days, and take up to 45 more. If you ask us to delete your account and its data, we'll do it within 30 days of confirming the request came from you; see Delete your account for what's kept. Requests are free.
If we turn down your request, we'll tell you why. To appeal, reply with "Appeal" in the subject line. We'll answer in writing within 45 days, explaining what we decided and why. If we still turn it down, you can contact your attorney general:
No third party collects data about your activity over time and across other websites or apps through Next Step. Next Step doesn't use your location, and we don't use geofencing.
This policy takes effect on October 3, 2026. If we change it, we'll publish the new version on this page and update the "Last updated" date above. We won't apply a material change, such as a new use of data we already hold or a new kind of recipient, to data we already hold without your consent.