Effective September 26, 2026 · Version 2026-09-26.1
This notice supplements the Privacy Policy. It describes consumer health data handled by Udom Software LLC, a Nevada limited liability company, doing business as Lessen, 732 South 6th Street, Suite N, Las Vegas, NV 89101. Email: admin@lessen.app.
It applies to our consumer health-data practices, including the rights provided by Washington's My Health My Data Act and Nevada's consumer health-data law when those laws apply. We make the same contact route available to all users. This notice is not a request for bundled consent.
1. Categories of health data
Consumer health data may include: gambling-screening answers and scores; reasons for seeking help; self-described triggers and past attempts; goals and support preferences; betting history, losses, staking amounts and patterns when linked to an effort to change gambling behavior; calculated risk windows, lapses, streaks and behavior inferences; interaction with interventions, including the "About to bet?" and lock-down tools; protection steps you mark done, such as a bank gambling block or a phone blocker; the days you open the app; money goals; support-person and clinician sharing relationships; health-related Les messages; and records showing that an identifiable person uses or seeks Lessen's services. Account identifiers, email, state, device/network information and timestamps may become health data when linked to these records.
We do not collect precise GPS location for the service, use geofences around health-care facilities to identify or target care seekers, or collect biometric templates or genetic information. Do not submit such information in free text.
Website self-assessment email. An email address linked to requesting a gambling self-assessment can reveal an interest in health-related services, even when no score is attached. For the website assessment, we collect your email, your collection and marketing choices, the notice version and time, and a short-lived salted network identifier used to limit abuse. Your nine answers and calculated score remain in browser memory and are not included in the email signup request. This website flow differs from the phone app's account-linked screening data described above.
2. Sources and purposes
Sources are you; the sportsbooks you authorize through SharpSports; your use of the app or portal; your device for settings and technical information; recipients acting on your sharing instructions; and calculations made from these inputs. Clinician business-control checks use submitted business details, confirmed sign-in email, and public domain or provider information where relevant.
We collect and process data necessary to provide the service you request: your own betting summaries, support tools, notifications, Les responses, goals, sharing, account security and support. Where collection is not necessary to provide the requested service or another statutory exception does not apply, we obtain the consent required by law before collecting it. We use a separate consent for an additional sharing purpose when required. We do not infer permission from silence, a preselected optional box, or acceptance of general Terms.
Website result access and optional updates. You provide the email directly. The current website asks for express agreement to email collection before displaying the result; the score calculation itself happens in your browser. A separate, unchecked choice lets you request launch news and occasional product or educational updates. Refusing marketing does not prevent access to results after the email-collection step. We do not treat providing an email for results as permission for marketing, nor use your answers or score to choose marketing messages. This form creates no app account, trial, payment or sportsbook connection.
3. Health data that may be shared, and with whom
- Hosting and authentication providers process account-linked information to run and protect the service.
- SharpSports receives connection identifiers and instructions and returns the records you authorized it to obtain.
- The AI provider receives your messages and relevant selected context when you use Les.
- For the website signup, Supabase stores the email and permission records for Lessen. If you separately request updates, EmailOctopus processes your email and subscription/confirmation status to send a confirmation and the messages you requested. The signup does not send it your answers, score, risk band, sportsbook data or patient details. These providers act for the described service purposes; an address associated with Lessen may itself reveal a health-related interest.
- Email and notification providers receive addresses or tokens and the minimum content needed for the communication you request. Detailed notifications or support correspondence can contain health information if you choose to provide it.
- A person you designate can receive the sections, status and history you authorize through a share. They may be a clinician, support person or other trusted recipient. Practice staff do not automatically inherit another staff member's patient permissions.
- Limited data may be disclosed where law requires or permits a specific protective disclosure, subject to the legal conditions for that disclosure.
See the named Service Providers. We do not share health data with a corporate affiliate for that affiliate's separate advertising or other independent commercial purposes. No outside research program is currently activated. We do not sell consumer health data to advertisers or data brokers. We do not use it to target advertising.
A future paid research disclosure may legally be a sale even if names are removed. Before any such disclosure, we must obtain any required separate, valid, signed authorization identifying the data, seller, purchaser, purpose, expiration and revocation rights, give you a copy, and keep the legally required record. An ordinary research toggle cannot substitute for that authorization. We will not condition core service on permission for that optional sale.
4. Choices and rights
Contact admin@lessen.app with “Health data request.” You can ask whether we collect or share your health data, obtain access and a copy, withdraw collection or sharing consent, request deletion, and obtain disclosure or recipient information available under applicable law. This can include a list of third parties and affiliates with whom covered data has been shared or sold and their contact information. You may use an authorized agent where permitted.
We verify requests reasonably, usually through control of the relevant account, without asking for more health data than necessary. We respond within 45 days unless a shorter deadline applies. A lawful extension, if needed, will be explained during the initial period. We communicate required deletion requests to processors, contractors and other recipients as the law requires and take reasonable steps to implement them. Backup or archived copies remain subject to applicable statutory deletion deadlines, including Washington's outside limit where applicable; an ordinary retention schedule does not override those duties.
If a request is denied, we explain the reason and the appeal route unless legally prohibited. Reply with “Health data appeal.” We review appeals and respond within the applicable deadline, ordinarily within 45 days. If unresolved, contact the attorney general in your state; Washington residents can contact the Washington Attorney General and Nevada residents the Nevada Attorney General. You do not have to buy a plan or waive legal rights to make a request.
5. Withdrawal and limits
Change sharing and research choices in Settings, or contact us. Ending a share stops future access through Lessen. Withdrawing research permission excludes you from future research preparation and deletes coded snapshot rows we still hold. Closing your account initiates deletion of account-linked health information. Necessary collection for a feature may have to stop if you withdraw permission needed for that feature. We explain that result without charging a penalty for exercising a right.
We cannot erase a recipient's memory or retrieve a screenshot, but that practical limit does not eliminate our duties to notify recipients, seek deletion, or honor applicable law. Truly deidentified information that cannot reasonably be linked to you may be outside some rights; we do not treat a random subject number alone as proof of deidentification.
For website emails, use the unsubscribe link to stop optional updates, or contact admin@lessen.app to withdraw collection consent or request deletion from Lessen and its processors. Unsubscribing alone may retain a limited suppression record so we do not send again; it is not the same as deleting all information. You can ask for deletion separately. Neither action changes a result already open in your browser. Reloading closes that local result.
6. Retention, changes and contact
Website email-only records expire after 30 days. Marketing requests not yet exported expire within two years. Confirmed subscriptions are retained until unsubscribe or a retention review, with limited suppression or consent evidence retained only as justified or required. Applicable deletion rights override these ordinary periods. See Retention. We limit access and use, apply legal deletion duties, and do not retain covered information merely for unspecified future uses. New categories or materially different purposes require the notice and permission applicable law requires before the change. Current and prior notices are available through Lessen or on request.
Contact: admin@lessen.app; Udom Software LLC, 732 South 6th Street, Suite N, Las Vegas, NV 89101.
Website signup reminders
If you complete the website assessment without requesting marketing updates, this browser may remember a signup-invitation preference for up to 90 days. This preference can indicate that you used the assessment, but contains no email, answers or score and is not sent to EmailOctopus. A card appears after results; eligible returning visits may show up to two additional invitations, at least seven days apart. A visit is treated as new after 30 minutes without a page visit. Reminders do not appear in the clinician portal, shared patient pages, policies or support. Choose “Don’t ask again on this browser” to stop invitations, or clear browser storage to remove this preference. Requesting updates stops further invitations in that browser. Other devices and browsers do not share the preference. Declining an invitation does not prevent viewing results.
For immediate gambling-related help, call 1-800-522-4700 or 1-800-MY-RESET.
Internal product and channel measurement
We use first-party measurement to understand whether Lessen is useful and which outreach brings people to it. Registered campaign links may contain a non-personal referral code. Marketing pages send that code and coarse events, such as a visit, assessment start/completion or app-store link click, to our own server. They do not send assessment answers, scores or email addresses in these measurement requests. Browser session storage remembers the code and limits repeat counts within the tab session. This measurement stops when Global Privacy Control or Do Not Track is enabled. A daily rotating, secret-derived network-address hash limits automated requests; hosting providers may separately hold ordinary security logs. Aggregate website counts are deleted after one year.
In the signed-in phone app, we record limited activity days and setup milestones, including viewing the trial screen, connection screen and data reveal, and completing setup. A milestone is not proof of a purchase, successful treatment or abstinence. You may voluntarily enter a referral code and answer short questions about what helped or why you plan to leave. A saved code links your account to that campaign for internal reporting. It does not grant a provider access to your patient information and is not sent to advertising platforms. You can remove the saved referral link in Settings. Feedback remains until you replace it, request deletion or delete your account. Daily app activity is deleted after one year. Account deletion removes linked attribution, activity, feedback and this internal receipt ledger. Separate legally required billing records are governed by our retention schedule.
Verified store notifications, when connected, provide purchase, trial, environment and coverage information for internal measurement. Sandbox receipts and free trials are separated from real purchase receipts. Only authorized Lessen administrators can view the internal aggregate report. Provider relationship notes contain practice-level counts, costs and next actions, not patient names or clinical notes. No new external research release, advertising audience or clinician access is authorized by this measurement.
Website accounts and saved setup
When you choose to create a consumer account and complete setup on our website, we save the answers you submit, your current setup step, and completion status with your account. This lets you continue on another device or in the Lessen app. These answers may include gambling-related health information. They are not sent to Stripe or our marketing list. Stripe receives the account identifier, email, selected plan and payment information needed to process and manage a website subscription. Creating an account or buying a subscription does not subscribe you to marketing emails.
We keep a one-way representation of the normalized account email for up to one year after a trial is claimed to help prevent repeated trials after account deletion. This is personal information used for abuse prevention, not anonymous research data. We retain minimal payment-provider references while a cancellation after account deletion is unfinished. Saved setup answers are deleted with the account and included in the account data export. Payment processors may separately retain transaction records under their own legal obligations.
Launch emails during account creation
The website account form offers a separate, optional choice to receive launch announcements, product updates and useful tips. If you choose it, we send your email address to our existing email signup service for confirmation. We do not include your setup answers, gambling history, assessment score or payment details in the email list. Account creation and service emails remain separate from marketing permission. You can unsubscribe from marketing emails without deleting your Lessen account.
Optional Google Ads measurement on public pages
If you allow cookies in our cookie pop-up, public marketing and policy pages load Google Ads tag AW-18466932609. Google may receive basic visit and device/network information and use advertising measurement cookies. Ad personalization is disabled. We do not configure enhanced conversions, send email addresses, or build remarketing audiences from health information. The tag is not loaded on the full self-assessment page, account setup, clinician portal, private shared pages or internal reports. The homepage shows the first assessment question; an answer given there stays in your browser and is never sent to Google. Assessment answers, risk scores, patient records and account identifiers are not included in our tag configuration.
Until you allow cookies, this Google tag does not load. You can choose No thanks without losing access to the site. Use Cookie choices at the bottom of a public page to change your choice. We remember the choice on that browser for up to 180 days. Declining after allowing removes the Google measurement cookies this site can access and reloads the page without this tag; it does not recall information already sent. We honor Global Privacy Control and Do Not Track by keeping the tag off. Email-list permission is a separate choice. See Google's privacy information and Service Providers.