Privacy Policy

Who we are

BMW is operated by CIJE dev (cije.live), a private software development company. The main developers are Jeremy Carpenter and Ciara Smith. BMW's content draws on the Warren Model developed by Dr. Rosalyn Warren Avant.

Important: BMW is not a diagnosis or emergency service

PHQ-9 and GAD-7 are screening tools, not a diagnosis. BMW, including AI Wellness, does not replace a doctor, therapist, or emergency care.

If you’re in danger, call or text 988 (Suicide & Crisis Lifeline, US, 24/7) or your local emergency number.

Information we collect

Account information. When you create an account: your display name, email address, and password. Passwords are stored only as a salted hash, never in plain text. We also store your account role, when the account was created, and when you confirmed at sign-up that you are 18 or older.

Screening answers and scores. When you complete a PHQ-9 or GAD-7: your answer to each question, your total score, the severity label, your PHQ-9 question 9 score, and the date and time.

Daily check-ins. Mood (1–10), stress (1–10), hours of sleep, any optional note you write, and the time.

Care plan and personalization. Care-plan actions you mark as done (and the date), your topic preferences, and your cultural tone and affirmation settings.

Trusted contacts and check-in requests (optional). The contacts you add (name or label, and optionally email, phone, and notes), whether each one should get check-in emails, your email-consent setting, and any check-in request you record with an optional message, plus whether the emails were sent.

AI Wellness (optional). The text you type into AI Wellness, and a count of how many AI replies you used each day (used for the daily limit). Your AI conversation is saved to your account only if you turn on the AI journal option, which is off by default.

AI content reports (optional). Every AI Wellness reply has a Report button. If you report a reply, we store the text of that AI reply, the reason you picked (offensive, harmful, inaccurate, or something else), any note you add, the type of reply, the time, and your account ID. Your own message is stored with the report only if you tick “Include my message”. Reports are used only to review AI safety and quality and to moderate the feature.

Clinical review records. If a screening result reaches certain thresholds (for example, a PHQ-9 question 9 answer above zero, or a PHQ-9 or GAD-7 total of 15 or more), BMW automatically creates an internal follow-up flag. Authorized clinical staff may also add notes. These records are internal and are not shown to you in the app.

Usage and device information. For each visit we log pages viewed, the type of request, the response status, and in-app events (for example, sign-up, log-in, or a feature opened). Along with these we keep: the website you came from (domain only), any campaign tags in the link (utm_source, utm_medium, utm_campaign), and a one-way hashed form of your IP address and browser user-agent. We store the hashed forms, not the raw IP address or user-agent. If a log-in attempt fails, we record the email address that was entered.

Cookies and local storage

• Session cookie: keeps you signed in and protects forms against forgery (CSRF). This cookie is required for the app to work.
• bmat_vid: a random visitor ID that links your page views into one visit history for the usage analytics described above. It lasts up to 1 year and is HttpOnly.
• Local storage in your browser: remembers your cookie-banner choice and whether the sidebar is collapsed. This data stays on your device.
• Service worker: BMW registers a small service worker so the website can be installed to your home screen. It does not cache or store pages, account data, or files on your device; every page is loaded from our server, so BMW does not work offline.

How we use information

• To run your account and show your scores, check-ins, trends, history, wellness score, and care plan.
• To personalize care-plan suggestions, affirmations, and tone.
• To show safety and crisis information when a screening answer calls for it, and to flag results for follow-up by authorized clinical staff.
• To create AI Wellness replies when you ask for them, and to enforce the daily AI limit.
• To review AI replies you report, for safety and moderation, and to improve how AI Wellness responds.
• To email the trusted contacts you chose, but only when you ask for a check-in.
• To understand overall usage, keep the service secure, and fix problems.

We do not sell your personal information, and we do not use it for advertising.

Who can see your information

• BMW administrators and clinical staff. Authorized admins and therapists must accept an ethics acknowledgment before they can view user records (including screening results and check-ins). They can also add clinical notes and export a progress PDF. In admin exports, emails and free-text fields are masked by default. Administrators also review AI content reports and account deletion requests. Staff actions are recorded in an audit log.
• AI provider (only if you use AI Wellness). When you ask AI Wellness for a reflection, your message, display name, and tone preference are sent to an OpenAI-compatible AI service (OpenAI or Groq, depending on how the server is set up) to generate the reply. When you ask it to analyze your scores, your latest mood, stress, sleep, PHQ-9 and GAD-7 totals and severity labels, and PHQ-9 question 9 score are sent. Nothing is sent to the AI provider unless you use this feature.
• Your trusted contacts (only with your consent). If you turn on email consent, mark a contact for email, and record a check-in request, BMW emails that contact your display name and any message you included. These emails never include screening scores. They are sent from our own mail server on cije.live.
• Content delivery and embedded services. Pages load fonts from Google Fonts and the styling and script library (Bootstrap) from the jsDelivr CDN. Care-plan videos are embedded from YouTube, and slide decks may open in Microsoft’s Office Online viewer. Private Session uses a Google STUN server to connect the browsers. When your browser loads these resources, the providers receive your IP address and normal browser information under their own privacy policies.
• Private Session. Screen sharing goes directly between participants’ browsers. BMW only relays the connection setup and does not record the stream.
• Legal requirements. We may disclose information if the law requires it, or to protect someone’s safety.

Retention and deletion

Account data (profile, screenings, check-ins, care-plan activity, contacts, journal entries, and AI content reports) is kept until you delete it or ask us to delete your account. Usage analytics are cleaned up automatically by a daily job on our server: visit events (page views and in-app events) are deleted once they are more than 90 days old, and visit sessions are deleted once they have been inactive for more than 180 days and have no remaining events.

In the app, you can remove trusted contacts, undo a care-plan action you completed today, turn off email consent and the AI journal, and clear your saved AI journal history at any time.

Delete your account. Our Delete account page (https://cije.live/bmw/delete-account) offers two options:

• Delete now, in the app. If you are signed in, re-enter your password and confirm. Your account and all of its data are deleted immediately. We keep only a record that a deletion happened, with a masked email address (for example, j***e@example.com).
• Request deletion without logging in. Anyone can submit the form with the email address on their account and an optional reason. We store that email and reason only to process the request, may email you to confirm it is you, and complete it within 30 days. Once the request is handled, the email in the record is replaced with a masked version.

That page lists exactly what is deleted and what is kept.

To get a copy of your data, or to delete your account by email, write to admin@cije.live from the email address on your account. We will confirm your request and complete it within 30 days. You can also clear BMW’s cookies and local storage in your browser settings at any time.

Security

BMW is served over HTTPS. Passwords are hashed, forms are protected against cross-site request forgery, and staff access to records requires a special role, an ethics acknowledgment, and is audit-logged. No system is perfectly secure, but we work to protect your information.

Age requirement (18+)

BMW is intended for adults. You must be 18 or older to create an account, and everyone confirms this with a required checkbox at sign-up. BMW is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has created an account, contact us at admin@cije.live and we will delete it.

Changes to this policy

We may update this policy. When we do, we will post the new version on this page and change the effective date above. If a change is significant, we will give notice in the app.

Contact

Questions or requests: admin@cije.live · CIJE dev, cije.live