Effective September 26, 2026 · Version 2026-09-26.1
Lessen helps adults understand and change their own sports-betting behavior. This policy explains the personal information we use to provide that service, operate our website and clinician portal, and protect accounts. Betting behavior and the inferences we draw from it can be sensitive health information even when a record does not contain a diagnosis.
1. Who is responsible
Udom Software LLC, a Nevada limited liability company, doing business as Lessen, 732 South 6th Street, Suite N, Las Vegas, NV 89101. Email: admin@lessen.app.
In this policy, “Lessen,” “we,” and “us” mean Udom Software LLC. Contact us at this address for privacy questions, access, correction, deletion, consent withdrawal, or an appeal. Please put “Privacy request” in the subject. Do not email passwords, full payment-card numbers, or patient records.
This policy covers lessen.app, the Lessen app, accounts, shared pages, the clinician portal, and support communications. Our Consumer Health Data Privacy Policy gives additional details and rights for sensitive health information. The Retention Schedule and Service Providers explain retention and outside services. These notices describe our practices; they are not permission to use information for an unrelated purpose.
2. Information we collect and its sources
Account and identity information. You provide an email address and, where offered, a password, saved name, age or date of birth, state, preferences, and account settings. Our authentication service stores password hashes rather than readable passwords. Google sign-in, where available, provides an account identifier, email, verification information, and basic profile information authorized on its sign-in screen. We do not request access to your Gmail messages or contacts to sign you in. A platform may provide additional account information under its own notice.
Setup answers and goals. You may provide reasons for using Lessen, gambling-screening answers and scores, your chosen mode, spending estimates or caps, triggers, previous attempts to change, personal reasons, intervention preferences, goals, self-reported progress, and information about a support person you choose. Some answers are optional. We identify required information in the relevant flow. Please provide another person's contact details only when you are entitled to do so; do not include unnecessary medical information about other people.
Connected sportsbook records. If you choose to connect an account, SharpSports provides account identifiers, connection and refresh status, and available betting history. Source records may include timestamps, stakes, outcomes, settlements, sports, wager types, selections, and technical fields such as odds. Lessen does not display odds, betting lines, or picks. History may be incomplete, delayed, or later corrected. The connection is read-only: Lessen cannot place bets or move funds. You enter sportsbook credentials in the connection provider's flow, not in Lessen's own account form. Lessen does not receive your sportsbook password. The connection provider's handling of credentials is covered by its own terms and security practices.
Calculations and interactions. We calculate summaries, patterns, likely betting windows, goal progress, lapses, coverage and freshness information, and other inferences from the records and choices described above. We record necessary operational events, such as an alert being sent, an option being selected, settings changing, refresh results, errors, and consent changes. We also record the days you open the app, the protection steps you mark done, any money goal you set, and when you use the "About to bet?" or lock-down tools. These support your first-30-days page and the Lessen Promise. A pattern or screening result is not a medical diagnosis.
Les messages. When you use Les, your messages, relevant conversation context, and selected account facts are processed by our AI service provider to generate a response. We do not keep a conversation transcript in Lessen's application database. Limited usage and safety records can include counts, timing, request status, and safety classifications without the message text. If you enable chat history, the app stores conversation history on your device. The AI provider has its own limited operational and safety retention; “no transcript in our database” does not mean no processing or retention by that provider. Avoid supplying another person's private information.
Sharing and portal information. We process the sharing choices made by the account holder, recipient email addresses, verification records, sharing codes in protected form, access sessions, access history, and the sections and historical versions made available. Clinician accounts also include practice names, optional website and provider details, business-control checks, authority confirmations, invitations, membership roles, review notes, subscription status, and client-place counts. An NPI is optional. Matching an email or controlling a website establishes account access, not professional licensure.
Professional outreach and feedback. We may keep professional names, roles, organizations, public or directly provided business contact details, conversation dates, product feedback, and agreed next steps when discussing Lessen with a clinician or organization. These records help us follow up and understand provider needs. They are restricted to authorized administration and must not contain patient information. We retain them only while needed for the relationship and applicable recordkeeping, and you may contact us to request correction, deletion or no further outreach.
Billing. Apple and Google process consumer app payments where offered. Stripe processes clinician portal payments. We receive subscription, customer, transaction, refund, dispute, and entitlement information needed to deliver and account for a purchase. A processor may also make billing contact details and limited payment-method information available for support and fraud prevention. Full card credentials are entered with the payment platform, not into Lessen's database. RevenueCat is planned for consumer subscription coordination and will receive the account identifier and purchase information when enabled; it is not a current recipient of betting records.
Website, device and support information. Website hosting, authentication, delivery and security systems process network addresses, browser or device information, timestamps, visited resources, referral information and logs. Marketing pages use limited website analytics. We do not place advertising pixels or behavioral advertising trackers on the portal or shared patient pages. Essential browser storage keeps sign-in sessions and preferences; device storage keeps app settings and unfinished setup. Email providers process delivery information and support correspondence. Device notification services process tokens and notification content. We do not collect precise GPS location for Lessen's core service.
Website result access and launch updates. The website self-assessment asks for your email and agreement to the collection notice before displaying results. Answers and the calculated score remain in browser memory and are not sent with the email signup. We store the email, collection/marketing choices, notice version and time, and a short-lived salted network identifier to limit abuse. An email associated with seeking Lessen may itself reveal a health-related interest. Launch, product and occasional educational emails require a separate choice and email confirmation; providing an email for results alone does not enroll you in marketing. Email-only records expire after 30 days. Unexported marketing requests expire within two years; you can request deletion sooner at admin@lessen.app. Confirmed marketing subscriptions are held until unsubscribe or a retention review. Unsubscribing stops optional messages; a limited suppression record may remain to prevent future sends. Contact admin@lessen.app to request deletion or withdraw collection consent separately. EmailOctopus processes email addresses and confirmation/delivery status for optional updates. Unsubscribing does not prevent you from viewing a result already open in the browser. Reloading clears those results. We do not create an app account, begin billing, connect a sportsbook, or send your score by email through this form.
3. How and why we use information
We use information to provide the functions you request: authenticate you, connect your own sportsbook accounts, display your history, calculate patterns, deliver selected notifications, answer Les questions, save preferences, administer sharing, verify business control, manage subscriptions, support you and honor privacy requests. We also use necessary records to protect the service, prevent duplicate accounts and payment abuse, investigate errors, keep accounts and billing accurate, meet legal obligations, and evaluate product reliability.
Your screening answers and stated triggers can inform relevant support and intervention choices. They do not, by themselves, establish a measured betting event. We distinguish a forecast, a user-set check-in, and a record received from a connected sportsbook.
Optional research, optional cross-user model development, sharing with another person, and marketing communications are not authorized merely by accepting Terms. Where an activity needs separate consent, we ask separately and honor refusal. We do not use individual betting history, screening answers, or Les messages to target advertisements. We do not sell personal information to advertisers or data brokers or share it for cross-context behavioral advertising.
4. When information is disclosed
Service providers. We use hosting, database, account authentication, connection, AI, email, notification and payment services. They receive information appropriate to their function, subject to applicable contracts and their legal responsibilities. See Service Providers. A payment platform or sign-in provider may also act for its own fraud prevention or legal purposes under its notice.
People you choose. A recipient can see only the sections and history your sharing choice allows. A practice membership or payment does not itself grant access to a patient's information. You may end sharing. Revocation prevents later access through Lessen; it cannot physically recall screenshots, printouts or notes already lawfully received. A recipient must still honor applicable legal and contractual deletion and use restrictions. We do not promise that a clinician's independently maintained records can always be deleted at your request.
Required or protective disclosures. We may disclose information when reasonably necessary to comply with a valid legal obligation, protect rights or safety, investigate security or fraud, or respond to a lawful request. We assess scope and challenge or limit requests when appropriate. We do not treat a broad contractual clause as consent to disclose consumer health data where the law requires a different legal basis. Lessen does not continuously monitor accounts for emergencies.
Business changes. Information may be evaluated or transferred in a merger, financing, acquisition, insolvency or asset transfer, subject to confidentiality, applicable law, and the protections in this policy. A transaction does not permit a materially inconsistent health-data use without legally required notice or permission.
Research. External research releases are not currently enabled. A general research preference does not authorize sale of consumer health data. A future project requires an appropriate, separate notice and any necessary specific consent or signed authorization before release. We will identify the data, recipients, purpose, duration and withdrawal limits. Coded data is not automatically anonymous. See Research Participation.
5. Communications and notification privacy
Account verification, security, subscription, sharing and clinic application decisions are service communications. Clinic approval emails do not start a purchase. Correction emails direct the practice owner to the portal and do not include patient information. You can control optional notifications in the app and operating system. Generic notification text is the default; choosing detailed messages may expose information to people who can see your lock screen. Notifications and email delivery are not guaranteed or emergency channels.
We do not enroll you in marketing or unfinished-onboarding email campaigns merely because you create an account. If we introduce an optional campaign, we will provide the required notice, choice and unsubscribe method. Essential account or legally required notices may still be sent after opting out of marketing.
6. Retention, deletion and backups
We retain information for the purposes and periods in the Retention Schedule, considering account needs, sensitivity, fraud prevention, legal duties and reasonable dispute periods. Deleting the app is not deleting the account and does not cancel a store subscription.
Account deletion removes account-linked application information and ends sharing. Our deletion process also removes coded research snapshot rows before removing the account-to-code map. Certain limited billing, anti-abuse, consent, legal-request and provider-erasure records may remain where legally necessary, with access and use limited to that reason. We do not keep health records indefinitely merely because they carry a code instead of a name. We may retain information subject to a valid legal hold only for the hold's purpose and duration.
Provider-held backups and records may take additional time to expire or be removed. Information in backups is isolated from ordinary use and must not be restored to active use contrary to a deletion request. Where we cannot erase a processor's record directly, we track the request and seek deletion or restricted use through that provider. A processor delay is not represented as completed erasure. Applicable statutory deadlines and duties take precedence over a general retention period.
7. Your choices and privacy rights
You can change available account details, revoke shares, disconnect sportsbook access, change notification or chat-history choices, withdraw optional research/model permissions, export account data, and request account deletion through the app or by contacting us. Disconnecting a sportsbook stops future authorized collection through that connection but does not by itself delete the history already used in your account. Ask for deletion if that is your goal.
Depending on applicable law, you may request confirmation and access, a copy in a usable format, correction, deletion, information about disclosures and recipients, withdrawal of consent, restriction of certain sensitive-data uses, and an appeal of a denied request. You may have rights to opt out of sale, targeted advertising, or profiling that produces legal or similarly significant effects. Lessen does not currently conduct those advertising activities or make employment, credit, insurance, treatment or eligibility decisions about consumers. We honor applicable recognized opt-out preference signals, including Global Privacy Control, for processing to which they apply; a signal does not automatically delete an account or override a sharing instruction you separately gave.
You do not need a paid account to submit a privacy request. An authorized agent may act for you subject to reasonable proof of authority. We verify identity proportionately to the request without demanding unnecessary sensitive information. We do not charge a fee except where law permits one, and we do not retaliate for exercising rights. Some requested service features cannot work without the data needed to provide them; we will explain that consequence.
We aim to respond within 45 days, or sooner if applicable law requires. If a lawful extension is needed, we will explain the reason and expected response date before the initial period expires. To appeal, reply with “Privacy appeal.” We will review the decision and respond within the applicable deadline, ordinarily within 45 days. You may also contact your state's attorney general or other competent regulator. California residents may have additional rights under the CCPA when its coverage requirements apply, including disclosure of categories, purposes and sources, and equal service without unlawful discrimination. This policy does not waive any state-specific right.
8. Security and processing locations
We use safeguards designed for the sensitivity of the information, including encrypted connections, hosted encryption at rest, account authentication, restricted access, server-side permissions, protected sharing credentials and limited operational access. No system can promise perfect security. See Data and Safety and Security Reporting. Do not share sign-in links or passwords; sign out on shared devices.
Lessen is a US service. Its application database is hosted in the United States. Providers may operate global infrastructure and personnel; we do not promise every support, delivery or network operation occurs only in the United States. International access remains subject to provider safeguards and applicable law. We do not solicit users outside the United States.
9. Age, health privacy and third parties
Lessen is for adults 21 and older. We do not knowingly solicit accounts or personal information from children. Contact us if a child has supplied information so we can investigate and remove it as appropriate.
Health information can be legally protected even when HIPAA does not apply. Whether a particular organizational use makes Lessen a HIPAA business associate depends on the actual relationship and services, not a label in these policies. Organizations must contact us before using Lessen in a capacity that requires a business associate agreement or other regulated processing agreement. A consumer's voluntary sharing does not certify all clinic workflows as compliant. See Clinician Portal Terms.
Sportsbooks, sign-in providers, payment stores, linked websites, and independent recipients have their own practices. We explain Lessen's role and do not claim to control theirs.
10. Changes and contact
We post the effective date and preserve prior versions. We provide additional notice of material changes, such as an in-product notice or email, where required. A policy update is not retroactive permission for a new sensitive-data purpose. Where renewed consent or authorization is needed, we obtain it before that use. Questions and requests: admin@lessen.app or the postal address in section 1.
Website signup reminders
If you complete the website assessment without requesting marketing updates, this browser may remember a signup-invitation preference for up to 90 days. This preference can indicate that you used the assessment, but contains no email, answers or score and is not sent to EmailOctopus. A card appears after results; eligible returning visits may show up to two additional invitations, at least seven days apart. A visit is treated as new after 30 minutes without a page visit. Reminders do not appear in the clinician portal, shared patient pages, policies or support. Choose “Don’t ask again on this browser” to stop invitations, or clear browser storage to remove this preference. Requesting updates stops further invitations in that browser. Other devices and browsers do not share the preference. Declining an invitation does not prevent viewing results.
For immediate gambling-related help, call 1-800-522-4700 or 1-800-MY-RESET.
Internal product and channel measurement
We use first-party measurement to understand whether Lessen is useful and which outreach brings people to it. Registered campaign links may contain a non-personal referral code. Marketing pages send that code and coarse events, such as a visit, assessment start/completion or app-store link click, to our own server. They do not send assessment answers, scores or email addresses in these measurement requests. Browser session storage remembers the code and limits repeat counts within the tab session. This measurement stops when Global Privacy Control or Do Not Track is enabled. A daily rotating, secret-derived network-address hash limits automated requests; hosting providers may separately hold ordinary security logs. Aggregate website counts are deleted after one year.
In the signed-in phone app, we record limited activity days and setup milestones, including viewing the trial screen, connection screen and data reveal, and completing setup. A milestone is not proof of a purchase, successful treatment or abstinence. You may voluntarily enter a referral code and answer short questions about what helped or why you plan to leave. A saved code links your account to that campaign for internal reporting. It does not grant a provider access to your patient information and is not sent to advertising platforms. You can remove the saved referral link in Settings. Feedback remains until you replace it, request deletion or delete your account. Daily app activity is deleted after one year. Account deletion removes linked attribution, activity, feedback and this internal receipt ledger. Separate legally required billing records are governed by our retention schedule.
Verified store notifications, when connected, provide purchase, trial, environment and coverage information for internal measurement. Sandbox receipts and free trials are separated from real purchase receipts. Only authorized Lessen administrators can view the internal aggregate report. Provider relationship notes contain practice-level counts, costs and next actions, not patient names or clinical notes. No new external research release, advertising audience or clinician access is authorized by this measurement.
Website accounts and saved setup
When you choose to create a consumer account and complete setup on our website, we save the answers you submit, your current setup step, and completion status with your account. This lets you continue on another device or in the Lessen app. These answers may include gambling-related health information. They are not sent to Stripe or our marketing list. Stripe receives the account identifier, email, selected plan and payment information needed to process and manage a website subscription. Creating an account or buying a subscription does not subscribe you to marketing emails.
We keep a one-way representation of the normalized account email for up to one year after a trial is claimed to help prevent repeated trials after account deletion. This is personal information used for abuse prevention, not anonymous research data. We retain minimal payment-provider references while a cancellation after account deletion is unfinished. Saved setup answers are deleted with the account and included in the account data export. Payment processors may separately retain transaction records under their own legal obligations.
Launch emails during account creation
The website account form offers a separate, optional choice to receive launch announcements, product updates and useful tips. If you choose it, we send your email address to our existing email signup service for confirmation. We do not include your setup answers, gambling history, assessment score or payment details in the email list. Account creation and service emails remain separate from marketing permission. You can unsubscribe from marketing emails without deleting your Lessen account.
Optional Google Ads measurement on public pages
If you allow cookies in our cookie pop-up, public marketing and policy pages load Google Ads tag AW-18466932609. Google may receive basic visit and device/network information and use advertising measurement cookies. Ad personalization is disabled. We do not configure enhanced conversions, send email addresses, or build remarketing audiences from health information. The tag is not loaded on the full self-assessment page, account setup, clinician portal, private shared pages or internal reports. The homepage shows the first assessment question; an answer given there stays in your browser and is never sent to Google. Assessment answers, risk scores, patient records and account identifiers are not included in our tag configuration.
Until you allow cookies, this Google tag does not load. You can choose No thanks without losing access to the site. Use Cookie choices at the bottom of a public page to change your choice. We remember the choice on that browser for up to 180 days. Declining after allowing removes the Google measurement cookies this site can access and reloads the page without this tag; it does not recall information already sent. We honor Global Privacy Control and Do Not Track by keeping the tag off. Email-list permission is a separate choice. See Google's privacy information and Service Providers.