Skip to content
Mobile App Privacy Policy - One Step

Mobile App Privacy Policy

One Step Online Privacy Policy
Last Updated: 8/28/2026

1. Please Read Carefully

This Online Privacy Policy describes the information One Step Software Inc. (“Company”) collects about you through our website(s), mobile application, and all other services we provide (collectively, the “Services”), how we use and share that information, and the privacy choices we offer. This policy applies to information we collect when you access or use our website(s) and mobile application (collectively, the “Site”), when you use our Services or when you otherwise interact with us.

2. Changes to this Online Privacy Policy

We may change this Online Privacy Policy from time to time. If we make changes, we will notify you by posting the updated policy on our Site and revising the “Last Updated” date above. We encourage you to review the Online Privacy Policy whenever you use our Services to stay informed about our information practices and about ways you can help protect your privacy.

3. Confidentiality of Health Information

Health information that Company receives and/or creates about you, personally, relating to your past, present, or future health, treatment, or payment for healthcare services, may be “protected health information” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”). Your health information may also be protected by state privacy and laws and regulations.

Company understands that health information about you and your health is personal. We support your privacy and make sure that the transmittal and use of your information complies with all laws. In this regard, where applicable, we comply with HIPAA, HITECH, and other relevant state laws and regulations by entering into Business Associate Agreements with the treatment providers for which we provide services to ensure that your protected health information is appropriately safeguarded. Each treatment provider has its own Notice of Privacy Practices. Please contact your treatment provider for more information regarding its privacy practices. Retention and deletion of protected health information that we hold on behalf of a treatment provider are governed by our Business Associate Agreement with that provider and by the provider’s instructions, as described in Sections 9 and 11.2.

4. Use of Services

Your access to and use of our Services are subject to certain terms and conditions, which are set forth in our Terms of Use.

5. Collection of Information

5.1. Information You Provide

We collect information you provide, such as when you email us, sign up through our Site, or submit information through our Site. We may collect, but are not limited to collecting, the following information: your name, gender, email address, mailing address, phone number, date of birth, payment card numbers, bank account number, bank routing number, employer, among other information.

5.2. Children

Company does not knowingly collect or maintain personally identifiable information from persons under 18 years of age without verifiable parental consent, and no part of the Services is directed at persons under 18. If you are under 18 years of age, then please do not use the Services. If Company learns that personally identifiable information of persons less than 18 years of age has been collected without verifiable parental consent, then Company will take the appropriate steps to delete this information. To make such a request, please contact us as described in Section 11.2.

5.3. Information We Collect from Your Use of the Services

We collect information about you when you use our Site, including, but not limited to the following:

  • Account Information. When you register with us using the Site to create an account and become a registered user, you will need to provide us with certain personally identifiable information to complete the registration, including information that can be used to contact or identify you and credit card or other billing information in some cases.
  • Device Information. We may automatically collect certain information about the computer or devices (including mobile devices) you use to access the Services. For example, we may collect and analyze information such as (a) IP addresses, geolocation information (as described in the next section below), unique device identifiers and other information about your mobile phone or other mobile device(s), browser types, browser language, operating system, the state or country from which you accessed the Services; and (b) information related to the ways in which you interact with the Services, such as referring and exit pages and URLs, platform type, the number of clicks, domain names, landing pages, pages and content viewed and the order of those pages, the amount of time spent on particular pages, the date and time you used the Services, the frequency of your use of the Services, error logs, and other similar information. As described further below, we may use third-party analytics providers and technologies, including cookies and similar tools, to assist in collecting this information.
  • Location Information. We may collect different types of information about your location, including general information (e.g., IP address, zip code) and more specific information (e.g., GPS-based functionality on mobile devices used to access the Services), and may use that information to customize the Services with location-based information, advertising, and features. For example, if your IP address indicates an origin in Los Angeles, California, the Services may be customized with Los Angeles-specific information and advertisements. In order to do this, your location information may be shared with our agents, vendors or advertisers. If you access the Services through a mobile device and you do not want your device to provide us with location-tracking information, you can disable the GPS or other location-tracking functions on your device, provided your device allows you to do this. See your device manufacturer’s instructions for further details.
  • Location: We may share your location with the treatment facility, sober living or other entity that is paying for your license to use One Step.
  • Cookies and Other Electronic Technologies. We may use the tools outlined below in order to better understand users. As we adopt additional technologies, we may also gather additional information through other methods.
  • Cookies: “Cookies” are small computer files transferred to your computing device that contain information such as user ID, user preferences, lists of pages visited and activities conducted while using the Services. We use Cookies to help us improve or tailor the Services by tracking your navigation habits, storing your authentication status so you do not have to re-enter your credentials each time you use the Services, customizing your experience with the Services, and for analytics and fraud prevention.

We may use a type of advertising commonly known as interest-based or online behavioral advertising. This means that some of our business partners use Cookies to display Company ads on other websites and services based on information about your use of the Services and on your interests (as inferred from your online activity). Other Cookies used by our business partners may collect information when you use the Services, such as the IP address, mobile device ID, operating system, browser, web page interactions, the geographic location of your internet service provider, and demographic information such as sex and age range. These Cookies help Company learn more about our users’ demographics and internet behaviors.

For more information on cookies, visit http://www.allaboutcookies.org.

  • Facility Information: We collect the information you enter about your facility location and your usage and activity on our Site.
  • Web Beacons: “Web Beacons” (a.k.a. clear GIFs or pixel tags) are tiny graphic image files embedded in a web page or email that may be used to collect anonymous information about your use of our Services, the websites of selected advertisers, and the emails, special promotions or newsletters that we send you. The information collected by Web Beacons allows us to analyze how many people are using the Services, using the selected advertisers’ websites or opening our emails, and for what purpose, and also allows us to enhance our interest-based advertising.
  • Site Analytics: We may use third-party analytics services in connection with the Site, including, for example, to register mouse clicks, mouse movements, scrolling activity and text that you type into the Site. These analytics services generally do not collect personal information unless you voluntarily provide it and generally do not track your browsing habits across sites which do not use their services. We use the information collected from these services to help make the Site easier to use.
  • Mobile Device Identifiers: Mobile device identifiers are data stored on your mobile device that may track mobile device and data and activities occurring on and through it, as well as the applications installed on it. Mobile device identifiers enable collection of personal information (such as media access control, address and location) and traffic data. Mobile device identifiers help Company learn more about our users’ demographics and internet behaviors.

5.4. Information from Third Parties

We may obtain additional information about you from third parties such as marketers, partners, researchers, and others. We may combine information that we collect from you with information about you that we obtain from such third parties and information derived from any other subscription, product, or service we provide.

5.5. Aggregate or De-identified Data

We may aggregate and/or de-identify information collected by the Services or via other means so that the information is not intended to identify you. Our use and disclosure of aggregated and/or de-identified information is not subject to any restrictions under this Online Privacy Policy, and we may disclose it to others without limitation for any purpose, in accordance with applicable laws and regulations. Where information is protected health information, we de-identify it only in accordance with the standard set forth at 45 C.F.R. § 164.514(b). We may retain and use de-identified and aggregated information after you close your account or after we delete other information about you, as described in Section 9.

6. Use of Information

We use the information that we collect for the following purposes:

  • For the purposes for which you provided the information;
  • To contact you when necessary or requested;
  • To personalize your experience with the Services by informing you of products, programs, events, services, and promotions of Company, our affiliates, our partners and/or third parties that we believe may be of interest to you (see the “Opt-In Policy” below);
  • To fulfill your purchase from us, including, to process your payments, communicate with you regarding your purchase or provide you with related customer service;
  • To send mobile notifications, emails, text messages (you may opt out of this service)
  • To provide, maintain, administer, improve, or expand the Services, perform business analyses, or for other internal purposes to support, improve or enhance our business, the Services, and other products and services we offer;
  • To customize and tailor your experience of the Services;
  • To send emails and other communications that display content that we think will interest you and according to your preferences;
  • To send you news and information about our Services;
  • To track and analyze trends and usage in connection with our Services;
  • To better understand who uses the Services and how we can deliver a better user experience;
  • To combine information received from third parties with the information that we have from or about you and use the combined information for any of the purposes described in this Online Privacy Policy;
  • To use statistical information that we collect in any way permitted by law, including from third parties in connection with their commercial and marketing efforts;
  • To share your information, including location, with the treatment provider, sober living provider or other entity that provided you with a code to use Company’s mobile application;
  • To share your information with the provider that is paying for your license to use One Step;
  • To prevent, detect, and investigate security breaches, fraud, and other potentially illegal or prohibited activities;
  • To enforce the legal terms that govern your use of the Services;
  • To protect our rights or property;
  • To administer and troubleshoot the Services; and
  • For any other purpose disclosed to you in connection with our Services.

We may use third-party service providers to process and store personal information in the United States and other countries.

7. Sharing of Information

We may share personal information about you as follows:

  • With third parties to provide, maintain, and improve our Services, including service providers who access information about you to perform services on our behalf;
  • With our affiliates and partners so that they may use such information for the purposes described in this Online Privacy Policy;
  • With our affiliates, partners or other third parties to allow them to contact you regarding products, programs, services, and promotions that we and/or they believe may be of interest to you (See the “Opt-In Policy” below);
  • In connection with, or during the negotiation of, any merger, sale of company stock or assets, financing, acquisition, divestiture or dissolution of all or a portion of our business (but only under non-disclosure and confidentiality agreements and protections);
  • If we believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process or governmental request; to enforce applicable user agreements or policies; to protect the security or integrity of our Services; and to protect us, our users or the public from harm or illegal activities; and
  • With your consent.

We may also share aggregated, non-personally identifiable information with third parties.

8. Opt-In Policy

When you supply us with personally identifiable information in connection with your use of the Services, you may be asked to indicate whether you are interested in receiving information from us about our product and service offerings and if you would like us to share personally identifiable information about you with our affiliates, partners or other third parties for their marketing purposes. If you do choose to opt in, you will receive such communications and/or we will share your information in accordance with your “opt-in” consent.

You may, of course, choose not to receive additional marketing information from us or choose not to allow our sharing of your personally identifiable information as follows: At any time, you can follow a link provided in our marketing-related email messages (but excluding e-commerce confirmations and other administrative emails) to opt out from receiving such communications; or at any time, you can contact us in accordance with the “Contact Us” section below to opt out from receiving such communications.

If you decide to contact us to change your contact preferences to opt out of receiving communications from us, please specify clearly which of the following choices you are opting out of: (a) Receiving marketing communications from us; (b) Allowing us to share personally identifiable information about you with our affiliates and partners for their marketing purposes; and/or (c) Allowing us to share personally identifiable information about you with other third parties for their marketing purposes.

We will endeavor to implement your requested change as soon as reasonably practicable after receiving your request. Please be aware that your requested change will not be effective until we implement such change. Please note that if you choose not to allow our sharing of your personally identifiable information, we are not responsible for removing your personally identifiable information from the databases of third parties with which we have already shared your personally identifiable information as of the date that we implement your request. If you wish to cease receiving marketing-related e-mails from these third parties, please contact them directly or utilize any opt-out mechanisms in their privacy policies or marketing-related e-mails.

Please note that if you do opt out of receiving marketing-related messages from us, we may still send you important administrative messages. You cannot opt out from receiving these administrative messages. We reserve the right, from time to time, to contact former customers or users of the Services for administrative purposes or in order to comply with applicable laws, rules or regulations.

9. Data Retention

We retain information for as long as necessary or appropriate for the purposes described in this Online Privacy Policy, or for any longer period required or permitted by applicable law.

We provide our Services both directly to users and on behalf of treatment providers, sober living operators, and similar organizations (each, a “Provider”). The information we hold is subject to different arrangements depending on the capacity in which we hold it.

Information we hold on behalf of a Provider that is a HIPAA covered entity. Where we create, receive, maintain, or transmit protected health information on behalf of a Provider that is a covered entity under HIPAA, we do so as that Provider’s business associate. Our use, disclosure, and retention of that information are governed by our Business Associate Agreement with the Provider and by applicable law, and not by this Section. Retention is directed by the Provider. Upon termination of our agreement, we will return or destroy that protected health information as the Business Associate Agreement requires; where return or destruction is not feasible, we will extend the protections of that agreement to the information and limit further uses and disclosures for so long as we retain it. The Provider may be subject to licensing, clinical, professional, or state-law record retention requirements that obligate it to retain records for a period of years, and the Provider may retain copies independently of us.

Information we hold on behalf of a Provider that is not a HIPAA covered entity. Where we hold information on behalf of a Provider that is not a covered entity, we hold it subject to our services agreement with that Provider and act on that Provider’s instructions with respect to its retention and deletion. Such information may nonetheless constitute consumer health data or otherwise regulated information under state law, and we retain and dispose of it in accordance with those requirements.

Information we hold for our own purposes. We retain information that we hold for our own purposes — including account registration and contact information, billing and payment records, device and usage information, communications with us, and marketing preferences — for as long as we consider necessary. In determining an appropriate retention period, we may consider factors including:

  • the nature and sensitivity of the information;
  • whether your account or your Provider’s subscription remains active;
  • our legal, regulatory, tax, accounting, and audit obligations;
  • the need to resolve disputes, enforce our agreements, and establish or defend legal claims;
  • the need to maintain the security and integrity of the Services, including detecting and investigating fraud, abuse, and security incidents;
  • applicable statutes of limitations; and
  • any other factor we consider relevant.

Backups, archives, and logs. Information removed from our active systems may persist in backups, archives, disaster recovery systems, and system logs for such period as our systems, processes, and retention schedules provide, after which it is overwritten or deleted in the ordinary course.

De-identified and aggregated information. We may retain, use, and disclose de-identified and aggregated information indefinitely and without restriction. Where information is protected health information, we de-identify it only in accordance with the standard set forth at 45 C.F.R. § 164.514(b). We do not attempt to re-identify de-identified information, except as permitted by law to test our de-identification measures.

10. Security

We take reasonable measures, including administrative, technical, and physical safeguards, to help protect personal information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. Unfortunately, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, Company cannot ensure or warrant the security of any information you transmit to us or from our online products or services, and you do so at your own risk. Our safeguards include measures for the secure disposal of personal information when it is no longer needed, as described in Section 9.

11. Your Privacy Choices

11.1. How You Can Access and Update Your Information

You may update or correct information about yourself at any time or by emailing us at info@onestepsoftware.com. You may also request deletion of your information, or close your account, as described in Section 11.2.

11.2. How You Can Delete or Close Your Account

The information we hold about you may be held in more than one capacity, and different rules apply to each. This Section explains what you can delete directly, what must be directed to your Provider, and what we may retain.

Closing your account. You can close your account within the One Step mobile application by emailing us at info@onestepsoftware.com or contacting us as described in Section 12. Closing your account terminates your access to the Services and deletes information we hold for our own purposes, subject to the exceptions below. Closing your account does not, by itself, delete information we hold on behalf of a Provider.

Health information held on behalf of a treatment provider. Where information about you is protected health information that we hold as a business associate of your treatment provider, we have no authority to delete, modify, or withhold it except as that provider directs. HIPAA does not provide individuals with a right to have protected health information deleted. HIPAA does provide you with rights to access your protected health information, to request that it be amended, and to receive an accounting of certain disclosures. Those rights are exercised through your treatment provider, and its Notice of Privacy Practices describes how. We will refer any such request we receive to your provider and will assist that provider in responding as our agreement with it requires. Your provider may be required by law or by its licensing obligations to retain records about you notwithstanding your request.

Information held on behalf of other Providers. Where we hold information on behalf of a Provider that is not a HIPAA covered entity, we act on that Provider’s instructions, and we will refer your deletion request to that Provider. Where applicable law grants you a right to delete consumer health data or other personal information directly from us, we will honor that right as the law requires.

Verification. We will not act on a deletion request unless we are able to verify, to our satisfaction, that the request was submitted by you or by an agent you have authorized in a manner we accept. We may require additional information for this purpose, and we may decline any request we are unable to verify.

Information we may retain. We may retain information, and may decline a request in whole or in part, where we or our service providers determine that retention is necessary or appropriate to:

  • complete a transaction or provide a product or service you requested, or perform a contract with you or with a Provider;
  • comply with a legal, regulatory, or contractual obligation, including our obligations to a Provider, or respond to legal process;
  • retain records required to be maintained by HIPAA, 42 C.F.R. Part 2, or other applicable law;
  • detect, prevent, or investigate security incidents, fraud, misuse, or illegal activity, or prosecute those responsible;
  • establish, exercise, or defend legal claims, or preserve information subject to a litigation hold;
  • protect the rights, property, or safety of you, us, our Providers, or others;
  • carry out internal uses reasonably aligned with your expectations based on your relationship with us and compatible with the context in which the information was provided; or
  • maintain de-identified or aggregated information as described in Sections 5.5 and 9.

Excessive or repetitive requests. We may decline to act on requests that are manifestly unfounded, excessive, or repetitive, including where you submit more requests than applicable law requires us to honor in any twelve-month period, or we may charge a reasonable fee for such requests to the extent permitted by law.

Effect. Closing your account is permanent and cannot be reversed. You will lose access to the Services and to content, history, and progress associated with your account, and we will have no obligation to restore it. Residual copies may remain as described in Section 9. We may retain a record of your request and of our handling of it, including as required by applicable law.

Timing. We will respond to verifiable requests within the time required by applicable law.

11.3. Cookies

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject cookies; however, our Services may not function properly if you do so.

11.4. Options for Opting out of Cookies and Mobile Device Identifiers

If you are interested in more information about interest-based advertising and how you can generally control cookies from being put on your computer to deliver tailored advertising, you may visit the Network Advertising Initiative’s Consumer Opt-Out link, the Digital Advertising Alliance’s Consumer Opt-Out link or TRUSTe’s Advertising Choices Page to opt-out of receiving tailored advertising from companies that participate in those programs.

Please note that even after opting out of interest-based advertising, you may still see Company’s advertisements that are not interest-based (i.e., not targeted toward you). Also, opting out does not mean that Company is no longer using its tracking tools—Company still may collect information about your use of the Services even after you have opted out of interest-based advertisements and may still serve advertisements to you via the Services based on information it collects via the Services.

11.5. How Company Responds to Browser “Do Not Track” Signals

We are committed to providing you with meaningful choices about the information collected on our Site for third-party purposes, and that is why we provide above the Network Advertising Initiative’s “Consumer Opt-Out” link, Digital Advertising Alliance’s Consumer Opt-Out Link, and TRUSTe’s Advertising Choices page. However, we do not recognize or respond to browser-initiated Do Not Track signals, as the Internet industry is currently still working on Do Not Track standards, implementations and solutions. For more information about DNT signals, visit http://allaboutdnt.com.

11.6. Links to Other Websites

Our Services may contain links to other websites and those websites may not follow the same privacy practices as Company. We are not responsible for the privacy practices of third-party websites. We encourage you to read the privacy policies of such third parties to learn more about their privacy practices.

11.7. Your California Privacy Rights

California law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those parties. If you are a California resident and would like to request this information, please submit your request in an email to info@onestepsoftware.com.

11.8. No Rights of Third Parties

This Online Privacy Policy does not create rights enforceable by third parties.

12. How to Contact Us

Please contact us with any questions or concerns regarding this Online Privacy Policy at:

One Step Software Inc.

Email: info@onestepsoftware.com