AskDrJoey Data Processing Addendum

Last updated: October 26, 2026.

1. What this addendum does

It governs personal information that Listen to Life Too, LLC, doing business as Work Positive Today (“Work Positive”), handles for the subscribing company (“the Subscriber”) through AskDrJoey.

Where it conflicts with any other AskDrJoey document about personal information, this addendum governs.

2. Words this addendum uses

Personal information means information that identifies, or could reasonably be linked to, a person, as the privacy laws define it.

Privacy laws means every United States privacy law that applies to the information, including the California Consumer Privacy Act as amended and the Virginia Consumer Data Protection Act, where each applies.

Subprocessor means a company Work Positive uses to handle personal information for the Subscriber.

Security incident means unauthorized access to, or loss or disclosure of, personal information Work Positive holds for the Subscriber.

Wellbeing flag means a record AskDrJoey creates when something a person shares suggests they are in difficulty.

Team results floor means the rule that a leader’s team results appear only when at least 3 team members respond.

3. Who decides what

The Subscriber decides. For personal information handled through AskDrJoey, the Subscriber is the controller or business, and Work Positive is its processor or service provider.

Where Work Positive decides alone. Work Positive decides for itself in two places only, and acts as an independent controller there:

• account, billing and relationship information it needs to run its business;
• wellbeing flags.

The fence around wellbeing flags. For wellbeing flags, Work Positive:

• uses them only to review a person’s wellbeing with care, and sends nothing to any person because of one;
• never discloses them to the Subscriber, in any form, at any time, and discloses one to a government authority only where the law requires it;
• never sells them and never uses them to train any AI model;
• lets only its trained reviewer read them;
• keeps them for 12 months after review, then deletes them;
• meets every duty the privacy laws place on a controller for them.

Crisis resource. AskDrJoey shows the 988 Suicide & Crisis Lifeline when a person’s words show an imminent threat to themselves or others. Work Positive’s trained reviewer reviews the flag and sends nothing.

The Subscriber agrees that its notices to its people cover this arrangement, consistent with the AskDrJoey Privacy Policy.

4. The Subscriber’s instructions

Work Positive handles personal information only to provide AskDrJoey, as the Terms of Service, this addendum and the Subscriber’s settings direct.

Instructions Work Positive refuses. Work Positive refuses any instruction that would:

• release a team result below the team results floor;
• identify which team member gave which answer, or who responded;
• disclose any person’s coaching conversation to anyone else at the Subscriber;
• show the Subscriber a usage figure for any one person;
• disclose a wellbeing flag.

Work Positive tells the Subscriber promptly where it believes an instruction breaks a privacy law.

5. Privacy law commitments

Work Positive:

• never sells personal information and never shares it for cross-context behavioral advertising;
• never keeps, uses or discloses it outside its direct business relationship with the Subscriber, or for any purpose beyond this addendum;
• never combines it with personal information from other sources, except as the privacy laws permit;
• gives it the same level of protection the privacy laws require of the Subscriber;
• tells the Subscriber if it can no longer meet these duties, and lets the Subscriber take reasonable steps to stop and fix unauthorized use;
• binds every person who handles it to a duty of confidentiality;
• helps the Subscriber answer requests from people about their information, keep personal information secure, meet its duties to notify a breach, and carry out any data protection assessment;
• gives the Subscriber, on request, the information reasonably needed to show it meets this addendum;
• binds each subprocessor in writing to duties that protect personal information at least as well as this addendum.

These commitments, with sections 4, 9, 10, 11 and 12, are written to meet a processor’s duties under the Virginia Consumer Data Protection Act (Va. Code § 59.1-579) and the California Consumer Privacy Act. Work Positive certifies that it understands and will comply with these restrictions.

6. The AI coach

The model provider. Anthropic, a subprocessor, provides the AI model that writes the coach’s responses and Sunny’s help desk answers. It receives the conversation and the coaching context needed for each response, and each question sent to the help desk.

No training. Work Positive trains no AI model on the Subscriber’s personal information. Anthropic’s commercial terms bar it from training its models on that information.

Retention. Coaching conversations last for the life of the subscription, so the coach remembers past sessions. Any user can delete their own history at any time. When a subscription ends, Anthropic deletes what it holds for Work Positive, except where the law requires it to keep information, where a dispute needs it, or where it needs information to address harmful misuse of its service.

Human review. A member of Work Positive’s team reads part of a conversation in three cases only: a user rates a coach response, and Work Positive reads that response and the message it answered; a wellbeing flag arises; or a user asks for help with a specific conversation.

The coach’s standing instructions. Work Positive improves the coach by revising its standing instructions, which hold no personal information. A user’s own information reaches the model with each conversation as context, as section 6 describes.

7. Confidential team answers

Every AskDrJoey assessment, for leaders and team members alike, collects ratings on a scale and nothing else.

Work Positive sends assessments through GoHighLevel, which links each team member to their answers. That link stays at Work Positive. Two named members of its team can see it, and they use it for scoring alone.

AskDrJoey receives team answers with no name or email attached.

The team results floor applies at every level. A withheld result cannot be worked out from any other view, including the owner’s company-wide view. Work Positive may raise the floor and never lowers it below 3.

The Subscriber sees AskDrJoey usage for the company as a whole only. AskDrJoey shows no usage figure for any one person.

8. Security

Work Positive keeps the protections in Annex 2 in place for the life of the subscription and may strengthen them at any time.

9. Subprocessors

The Subscriber authorizes the subprocessors in Annex 3.

Work Positive gives the Subscriber reasonable advance notice by email of any new subprocessor.

The Subscriber may object on reasonable data protection grounds within 14 days of the notice.

Work Positive then offers a reasonable alternative. Where none works, the Subscriber may end the affected service and receive a refund of prepaid fees for the unused period.

Work Positive stays responsible for each subprocessor’s handling of personal information.

10. Security incidents

Work Positive tells the Subscriber without undue delay, and within 72 hours of confirming a security incident.

The notice says what happened, what information was involved, and what Work Positive is doing about it. Work Positive adds detail as it learns more.

Work Positive coordinates with the Subscriber before telling the Subscriber’s people, unless the law requires otherwise.

11. When the subscription ends

Work Positive keeps the Subscriber’s personal information for 60 days, so a company that returns finds everything in place. On the Subscriber’s written request, Work Positive deletes it sooner.

On request within those 60 days, Work Positive returns it in a common format.

Work Positive then deletes it within 90 days of the end, unless a law requires Work Positive to keep it. Daily backups are kept for 7 days and then deleted on a rolling basis. They stay protected under this addendum until they are.

Work Positive confirms deletion in writing on request.

12. Checking Work Positive’s work

Work Positive allows and cooperates with reasonable assessments by the Subscriber, or by an assessor the Subscriber names, once a year on 30 days’ written notice. An assessment is carried out through written questions and the documents that answer them, including Work Positive’s answers to a reasonable security and privacy questionnaire.

13. Where information is kept

Work Positive stores personal information in the United States, in Supabase’s US East region. Vercel runs AskDrJoey in its US East region, in Washington, D.C. Work Positive’s other subprocessors process personal information where their own terms provide.

Annex 1. The details

Subject matter. Providing AskDrJoey: AI coaching, culture assessments, scoring and results.

Duration. The life of the subscription, then section 11.

People whose information is handled.

• The Subscriber’s owner, people leaders and managers who use AskDrJoey.
• The Subscriber’s employees who are 18 or older and answer assessments.

Kinds of information.

• Name, work email, role and company.
• Assessment answers, as ratings on a scale. Every AskDrJoey assessment collects ratings on a scale and nothing else.
• Leaders’ self-assessment answers, as ratings on a scale.
• Coaching conversations and ratings of coach responses.
• Records of sign-in and use.
• Wellbeing flags, which may include health information a person chooses to share, held under section 3.

Frequency. Continuous for the life of the subscription.

Annex 2. Security protections

Encryption in transit. Every connection is encrypted with TLS, provided by Vercel and Cloudflare.

Encryption at rest. The database is encrypted where it is stored, provided by Supabase.

Access. The tables holding assessment answers are closed to direct access by any user. Every read and write passes through controlled database functions, each protected by its own secret. Secrets rotate independently.

Sign-in. Users sign in with a single-use link sent by email. No passwords exist. Signed-in areas stay closed if the sign-in service is unavailable.

Refusal of identifying fields. Team answers are accepted only in a fixed set of nine fields. Anything else is refused at any depth, and every value is checked for an email address.

The team results floor. Enforced in one function, before any company figure is calculated.

Backups. The database is backed up daily, and each backup is kept for 7 days.

Annex 3. Subprocessors

Measured October 3, 2026 from the code and the running sites. Dr. Joey confirms the list.

Subprocessors that may touch a wellbeing flag: Supabase, which stores the flag and the conversation it came from; Anthropic, which processes that conversation.