HIPAA Authorization and Practitioner Consent Agreement

Effective Date: January 1, 2026

Important Notice: This authorization permits the disclosure of your Protected Health Information (PHI) to your selected mental health practitioner(s) through the InkWell platform. Please read this document carefully and retain a copy for your records.

1. Purpose of Authorization

By accepting this agreement, you authorize Pegasus Realm LLC d/b/a InkWell ("InkWell," "we," "us," or "our") to use and disclose your Protected Health Information (PHI) to mental health practitioners, therapists, coaches, and counselors (collectively, "Practitioners") whom you voluntarily connect with through the InkWell Connect subscription service.

2. Information That May Be Disclosed

The following types of information may be shared with your selected Practitioner(s):

Journal Entries: Written reflections, daily entries, and emotional check-ins you create within the InkWell application
Manifest Statements: Goal-setting content, wishes, imagined outcomes, identified obstacles, and action plans
AI-Generated Reflections: Insights, prompts, and responses generated by "Sophy" (our AI assistant) in response to your journal entries
User Profile Information: Display name, email address, subscription status, and connection preferences
Communication History: Messages, replies, and interaction records between you and your Practitioner through the InkWell platform
Usage Metadata: Journaling frequency, streak data, and engagement patterns (anonymized when possible)

3. Who Will Receive Your Information

Your PHI will be disclosed only to Practitioners whom you explicitly select and connect with through the InkWell platform. You have complete control over which Practitioners can access your information. Information will not be shared with:

Practitioners you have not selected or approved
Third-party marketing companies
Insurance companies (unless legally required)
Employers or educational institutions
Any entity not explicitly mentioned in this agreement

4. Electronic Storage and Security

Your PHI is stored electronically using industry-standard security measures:

Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3 protocol
Cloud Storage: Data is stored on HIPAA-compliant Google Cloud Platform (Firebase) infrastructure with encryption at rest
Access Controls: Role-based access ensures only authorized Practitioners can view your information
Audit Logs: All access to your PHI is logged and monitored for security purposes
Regular Backups: Your data is backed up daily with geographic redundancy

5. Business Associate Relationship

Practitioners who use InkWell to connect with clients are independent contractors and not employees of Pegasus Realm LLC. Each Practitioner maintains their own HIPAA compliance obligations and professional liability. InkWell serves as a Business Associate under HIPAA regulations, providing a secure platform for communication and information sharing between you and your Practitioner.

Important: The therapeutic relationship, treatment decisions, and professional responsibility remain between you and your Practitioner. InkWell is a communication platform and does not provide mental health services, diagnoses, or treatment.

6. Your Rights

You have the following rights regarding this authorization:

Right to Revoke: You may revoke this authorization at any time by disconnecting from your Practitioner in the app settings or by emailing support@inkwellapp.com
Right to Access: You may request copies of all PHI stored in your InkWell account at any time through the data export feature
Right to Delete: You may request deletion of your account and all associated PHI (subject to legal retention requirements) through the account deletion feature
Right to Restrict: You may choose which specific journal entries or information to share with your Practitioner
Right to Be Informed: You will be notified of any data breaches affecting your PHI as required by law

7. Revocation Process

To revoke this authorization:

Navigate to Settings → Connected Practitioner in the InkWell mobile app or web portal
Select "Disconnect from Practitioner" and confirm your choice
Alternatively, email support@inkwellapp.com with "Revoke HIPAA Authorization" in the subject line

Please note: Revocation does not affect information already disclosed prior to revocation. Your Practitioner may retain records as required by their professional obligations and state licensing laws.

8. Expiration

This authorization remains in effect until:

You revoke the authorization as described in Section 7
You disconnect from your Practitioner through the InkWell platform
Your InkWell Connect subscription is canceled or expires (30-day grace period applies)
You delete your InkWell account (subject to legal retention requirements)

9. Consequences of Not Signing

Signing this authorization is voluntary. However, if you do not accept this authorization, you will not be able to:

Connect with Practitioners through the InkWell platform
Share your journal entries with mental health professionals via InkWell
Receive Practitioner responses or clinical feedback through the app
Access InkWell Connect subscription features that involve Practitioner interaction

You may still use the Free and Plus subscription tiers, which do not involve Practitioner connections.

10. Re-disclosure and Confidentiality

Important Notice: Information disclosed to your Practitioner may no longer be protected by federal HIPAA privacy regulations once it leaves the InkWell platform. Your Practitioner is bound by professional ethics codes, state licensing laws, and their own privacy policies. We encourage you to discuss confidentiality practices with your Practitioner directly.

InkWell cannot control or guarantee what Practitioners do with your information after it is disclosed, though all Practitioners must agree to our Terms of Service and Business Associate Agreement.

11. Minors and Guardianship

If you are under 18 years of age (or the age of majority in your jurisdiction), this authorization must be accepted by your parent or legal guardian. By accepting as a guardian, you acknowledge that you have the legal authority to consent to the disclosure of the minor's PHI.

12. State-Specific Rights

Some states provide additional privacy protections beyond HIPAA. Depending on your location, you may have additional rights regarding mental health records, substance abuse treatment information, HIV/AIDS status, genetic information, or other sensitive health data. This authorization complies with federal HIPAA requirements and state laws where applicable.

13. Contact Information

If you have questions about this authorization or your privacy rights, please contact:

Pegasus Realm LLC
Privacy Officer
Email: privacy@inkwellapp.com
Support: support@inkwellapp.com

To file a complaint about our privacy practices, you may also contact:

U.S. Department of Health and Human Services
Office for Civil Rights
https://www.hhs.gov/ocr/privacy/hipaa/complaints/

14. Acceptance and Electronic Signature

By checking the box below and clicking "I Accept," you acknowledge that:

You have read and understand this HIPAA Authorization and Consent Agreement
You voluntarily consent to the use and disclosure of your PHI as described
You understand your rights, including the right to revoke this authorization
You have been offered a copy of this agreement for your records
Your electronic signature has the same legal effect as a handwritten signature

I have read, understand, and agree to this HIPAA Authorization and Practitioner Consent Agreement. I authorize InkWell to disclose my Protected Health Information to mental health Practitioners I select through the platform. I understand I may revoke this authorization at any time.

I acknowledge that my electronic acceptance constitutes a legally binding signature equivalent to a handwritten signature under the ESIGN Act and applicable state laws.

I acknowledge that I have been provided access to a copy of this agreement and can download or print it for my personal records at any time.