PRIVACY POLICY

Affective Software, Inc. d/b/a Gottman Inc.

Last updated: October 14, 2026

Table of Contents

1. Introduction

Affective Software, Inc. d/b/a Gottman Inc. ("Gottman," "we," "us," or "our") is committed to protecting the privacy of everyone who uses our websites and services. This Privacy Policy explains what information we collect, how we use it, when we share it, and what choices you have.

This Policy applies to the following properties (collectively, the "Services"):

  • www.gottman.com — our primary website offering educational resources, professional training, books, courses, workshops, and products;
  • www.gottmanconnect.com — our clinical platform connecting therapists and clients for relationship assessment, treatment planning, and telehealth services ("Gottman Connect");
  • gottmanreferralnetwork.com — our therapist referral directory ("Gottman Referral Network" or "GRN");
  • www.affectivesoftware.com; and
  • The Gottman mobile application ("App") available on iOS and Android.

Please read this Policy carefully. By accessing or using the Services, you acknowledge that you have read and understood how we collect and use your information as described here. Where we rely on your consent as a legal basis for processing, we will obtain that consent separately and explicitly.

2. Who This Policy Covers

This Policy applies to:

  • Consumers and visitors who browse our websites or purchase products, courses, or workshop registrations, including individuals who self-enroll in consumer psychoeducational assessments;
  • Therapists, clinicians, and other mental health professionals ("Providers") who register on Gottman Connect or the Gottman Referral Network; and
  • Clients and individuals who access clinical tools in Gottman Connect through a Provider's invitation or as part of a Provider-directed assessment or clinical workflow.

If you are a Provider using Gottman Connect, additional terms apply to protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Please see Section 8 ("Health Information and HIPAA") below.

3. Information We Collect

3.1 Information You Provide Directly

We collect information you provide when you create an account, make a purchase, complete an assessment, contact us, or otherwise interact with our Services. This may include:

  • Contact information: name, email address, mailing address, phone number;
  • Account credentials: username and password;
  • Professional information (Providers): license type, license number, state of licensure, professional credentials, areas of specialization, practice name, and biography;
  • Payment information: credit card or other payment details (processed by our third-party payment processor; we do not store full card numbers);
  • Assessment and clinical data (Gottman Connect): responses to relationship assessments (e.g., the Gottman Relationship Checkup), notes, treatment goals, session records, and similar clinical information;
  • Communications: messages you send to us, your Provider, or through the App; and
  • Profile content: photos, preferences, or other information you add to your account.

3.2 Information Collected Automatically

When you access the Services, we and our service providers automatically collect certain technical and usage information, including:

  • Device and browser information: IP address, browser type and version, operating system, device identifiers;
  • Usage data: pages visited, features used, links clicked, time spent, referring URLs;
  • Location data: general geographic location derived from IP address (we do not collect precise GPS location without your explicit permission); and
  • Cookies and similar technologies: as described in Section 7 ("Cookies and Tracking Technologies").

3.3 Information from Third Parties

We may receive information about you from third parties, including:

  • Payment processors (e.g., Stripe) who confirm transaction status;
  • Analytics providers who help us understand how our Services are used;
  • Providers who invite clients to Gottman Connect; and
  • Single sign-on (SSO) providers if you choose to log in through a supported identity provider.

4. How We Use Your Information

We use the information we collect for the following purposes:

4.1 Providing and Improving the Services

  • Create and manage your account;
  • Process purchases, subscriptions, and registrations;
  • Facilitate clinical assessments and treatment planning through Gottman Connect;
  • Enable communications between Providers and Clients;
  • Deliver course content, workshop materials, and other purchased resources;
  • Maintain and improve the functionality, security, and performance of our Services; and
  • Develop new features, products, and services.

4.2 Communications

  • Send transactional emails (e.g., order confirmations, appointment reminders, account notices);
  • Respond to your inquiries and support requests;
  • Send marketing and promotional communications, subject to your opt-in choices and applicable law (see Section 10); and
  • Send updates about our products, training programs, and research.
  • Detect, investigate, and prevent fraud, abuse, and security incidents;
  • Enforce our Terms of Use and other applicable policies;
  • Comply with applicable laws, regulations, and legal processes; and
  • Protect the rights, property, and safety of Gottman, our users, and the public.

4.4 Service Improvement and Troubleshooting

We may process information, including AI inputs and AI-generated outputs, only as reasonably necessary to provide, maintain, secure, debug, troubleshoot, and improve the Services and the user's experience. Where clinical data or PHI is involved, these activities are performed in accordance with the applicable BAA and only to the extent necessary for those purposes. We do not publish clinical or AI data, use it for independent research or marketing, disclose it to third parties for their own purposes, or transmit it to third-party large language model providers.

5. How We Share Your Information

We do not sell your personal information as that term is defined under applicable state privacy laws. We do not use third-party advertising or general marketing analytics technologies to collect clinical data from Gottman Connect or clinical-facing accounts. Gottman.com is a separate, non-clinical consumer website and may use consent-based analytics and marketing technologies, including Google Analytics and similar tools, as described in Section 7 and our Cookie Settings. Clinical data from Gottman Connect is not provided to those analytics or marketing technologies. We share information only in the following circumstances:

5.1 Service Providers

We share information with vendors and service providers who perform functions on our behalf, such as payment processing, cloud hosting, email delivery, customer support, and, for non-clinical consumer Properties, analytics. These providers are contractually obligated to use information only as directed by Gottman and to maintain appropriate security safeguards. Clinical data from Gottman Connect is not provided to advertising or general marketing analytics providers.

5.2 Providers and Clients (Gottman Connect)

When a Provider invites a Client to Gottman Connect, the Provider may view the Client's assessment results, session notes, and related clinical data within the platform. Clients may access only the data, reports, notes, recommendations, or other materials that their Provider affirmatively chooses to share with them. Gottman does not independently share clinical data with Clients or decide what clinical information a Client may view. Each party is responsible for maintaining appropriate confidentiality consistent with professional and legal obligations.

5.3 Gottman Referral Network Listings

Provider profile information submitted to the Gottman Referral Network (name, credentials, specialty, geographic area, contact information, and photo) is displayed publicly on the directory and may be indexed by search engines. Providers must not include any client PHI or other confidential client information in their profiles.

We may disclose information when we believe in good faith that disclosure is necessary to: (a) comply with applicable law or respond to valid legal process; (b) protect the rights or safety of Gottman, our users, or the public; (c) enforce our agreements; or (d) detect or prevent fraud or security threats.

5.5 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of Gottman's assets, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Services before or promptly after any such transfer becomes effective and inform you of any choices you may have.

We may share your information for any other purpose with your prior written consent.

6. Data Specific to Gottman Connect

Gottman Connect is a platform designed for licensed mental health professionals and their clients. The following additional provisions apply to information processed through Gottman Connect:

6.1 Provider Responsibilities

Providers who use Gottman Connect are independently responsible for: (a) obtaining informed consent from their clients prior to using digital tools for assessment and treatment; (b) complying with all applicable professional licensing laws, ethical standards, and confidentiality obligations; (c) entering into a Business Associate Agreement (BAA) with Gottman where required by HIPAA; and (d) providing clients with a Notice of Privacy Practices as required by law.

6.2 Client Data

Clinical data entered into Gottman Connect, including assessment responses, session records, and communications between Providers and Clients, constitutes protected health information (PHI) where HIPAA applies. Gottman processes such PHI in its capacity as a Business Associate of the covered entity Provider. Where HIPAA does not apply, such information may constitute consumer health data and is handled as described in Section 10.2 and our Consumer Health Data Privacy Policy.

6.3 AI and Automated Features

If Gottman Connect includes AI-assisted features (e.g., automated summaries, scoring, or recommendations), any AI processing of PHI is conducted in accordance with HIPAA requirements and our BAA with Providers. Outputs from AI features are intended as clinical decision support only and do not constitute independent medical or psychological advice. Gottman does not guarantee the accuracy, completeness, or clinical appropriateness of AI-generated outputs. Providers retain full clinical judgment and responsibility for all treatment decisions, and Gottman disclaims liability for clinical outcomes arising from reliance on AI outputs.

6.4 Optional Google Calendar Integration

Certain programs offered by Affective Software, Inc. d/b/a Gottman Inc., provide an optional Google Calendar integration to make scheduling easier for clinicians. This integration is optional and applies only to certain programs and is not required to use other features. We access Google Calendar only after the clinician chooses to connect their account and grants permission through Google.

Information Accessed and Used

The integration handles calendar-event titles, descriptions, and scheduled times, depending on the connection mode:

  • Read-only: We import new events created in the clinician's connected Google Calendar into Gottman Connect, including the event's title or description and scheduled time. This mode does not create or modify events in Google Calendar.
  • Read/write: In addition to importing events, Gottman Connect can publish scheduled events to the clinician's connected Google Calendar, including their titles, descriptions, and scheduled times.

We use this information only to provide the calendar display, scheduling, and synchronization features the clinician enables.

Storage and Security

Calendar information synchronized into Gottman Connect is retained to support the clinician's scheduling experience. We protect calendar information using encryption in transit and at rest and restrict access to authorized personnel and service providers as permitted by Google's policies.

Sharing and Restricted Use

Information is exchanged with Google as necessary to perform the synchronization the clinician authorizes. Service providers may process this information only as permitted by Google's policies, including providing the authorized integration with the user's consent, security purposes, or legal compliance. Human access is limited to permitted circumstances, including explicit user authorization to access specific information, necessary security investigations, or legal requirements.

Google Calendar data is not sold, used for advertising or marketing, published for research, or used to train generalized artificial-intelligence models. These restrictions take precedence over broader information-use or sharing provisions elsewhere in this Privacy Policy.

Disconnection and Deletion

Clinicians can disconnect the optional Google Calendar integration. Once disconnected, we do not retain the connection credentials, and future events will no longer be imported from Google Calendar or published to Google Calendar.

Previously created or imported events remain in Gottman Connect to maintain calendar continuity and avoid disrupting the clinician's workflow, subject to applicable retention and deletion requirements. Clinicians can also revoke access through their Google Account permissions. Questions and deletion requests may be directed to [email protected].

Google API Policy Compliance

Our use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements and applicable Google Workspace user-data policies.

7. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to operate the Services and understand how they are used. Each of our websites (www.gottman.com, www.gottmanconnect.com, gottmanreferralnetwork.com, and www.affectivesoftware.com) maintains a separate Cookie Policy that provides property-specific details; those policies are available via the Cookie link in the footer of each site. This section provides an overview applicable across all properties.

7.1 Types of Cookies We Use

We use the following categories of cookies:

  • Strictly necessary cookies: Required for core platform functionality such as maintaining login sessions, processing secure transactions, and remembering your cookie preferences. These cannot be disabled. Legal basis (GDPR): necessary for the performance of a contract or our legitimate interest in operating a secure, functional platform.
  • Functional cookies: Remember your preferences and settings (e.g., language selection, account preferences) to improve your experience across visits. Legal basis (GDPR): our legitimate interests, or your consent where required by applicable law.
  • Analytics cookies (non-clinical consumer Properties only): Help us measure and improve how users interact with non-clinical consumer Properties such as gottman.com. On those Properties, we use Google Analytics (cookies: _ga, _gid, _ga_[container], _gat) and may use similar tools. These cookies collect pseudonymous identifiers linked to device and usage data; they do not identify you by name. These technologies are not used to collect clinical data from Gottman Connect or clinical-facing accounts. Legal basis (GDPR): your consent. We have configured Google Analytics to anonymize IP addresses and to disable data sharing with Google advertising products.
  • Marketing and targeting cookies: Used — only with your prior, specific, informed, and freely given consent — to deliver promotional communications and to measure the effectiveness of our marketing. We do not use marketing cookies to enable behavioral advertising by third-party ad networks or to sell your data to advertisers. Legal basis (GDPR): your consent.
  • Third-party cookies: Some pages on our Services embed content from or link to third-party services (e.g., embedded video players, social sharing buttons, payment forms). These third parties may set their own cookies subject to their own privacy policies. We do not control these cookies and recommend reviewing the relevant third-party privacy policies.

When you first visit any of our websites, you will be presented with a cookie consent banner that allows you to accept or decline each category of non-essential cookies individually. Consent is sought before any analytics or marketing cookies are set. Where analytics or marketing technologies may receive consumer health data, the consent request identifies the categories of data collected, the purpose, the recipients, and how to withdraw consent, as described in our Consumer Health Data Privacy Policy. You may change your preferences at any time upon entering each site.

Consent can be withdrawn at any time with the same ease with which it was given. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. Strictly necessary cookies will remain active regardless of your preferences.

We do not use pre-ticked consent boxes, cookie walls, or other mechanisms that bundle consent with access to the Services.

Cookie retention periods vary by cookie type:

  • Session cookies generally expire when the browser session ends, subject to browser settings.
  • Retention periods vary by cookie, technology, configuration, and property. Current cookie names, purposes, providers, and expiration periods are available through the Cookie Settings tool on the applicable property. Non-essential cookies remain subject to your consent, which you may withdraw at any time.

7.4 Browser Controls and Do Not Track

You may configure your browser to block or delete all cookies, including strictly necessary cookies, though doing so may impair certain Services. Most browsers allow you to view and manage cookies in their settings menus.

We do not currently respond to browser Do Not Track (DNT) signals because no uniform industry standard for recognizing and honoring DNT has been established.

8. Health Information and HIPAA

To the extent that Gottman processes PHI on behalf of a covered entity Provider through Gottman Connect, Gottman acts as a Business Associate under HIPAA and will:

  • Enter into a Business Associate Agreement (BAA) with the Provider before processing PHI;
  • Use and disclose PHI only as permitted by the BAA and applicable law;
  • Implement administrative, physical, and technical safeguards required by the HIPAA Security Rule;
  • Report any breach of unsecured PHI to the covered entity in accordance with the HIPAA Breach Notification Rule; and
  • Ensure that subcontractors who access PHI agree to equivalent obligations through subcontractor BAAs.

Gottman does not use or disclose PHI for marketing purposes or sell PHI.

Note for Providers: Providers who register for Gottman Connect and use the platform for clinical purposes enter into the Gottman Connect Business Associate Agreement through the electronic registration or clinical activation process. The BAA is presented for affirmative acceptance, and Gottman captures and stores the acceptance date and applicable BAA version in the Provider's user record. Providers do not need to request a separate BAA by email.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, or as required by law. Retention periods vary by data type:

  • Account and profile data: Retained while the account is active. After account closure, we retain this data only as reasonably necessary for legal and contractual obligations, security, dispute resolution, and enforcement of our agreements, after which it is deleted or de-identified.
  • Clinical and assessment data (Gottman Connect): Retained while the Provider's account is active and managed under the Provider's direction and applicable professional and legal recordkeeping requirements. Upon account closure or termination, the data will be returned, exported, retained, or deleted in accordance with the Provider's instructions, the applicable BAA or DPA, and applicable law.
  • Payment and transaction records: Retained for as long as reasonably necessary to process transactions, manage refunds and disputes, comply with tax and accounting obligations, and establish or defend legal claims. Retention periods may vary based on the type of record and applicable law.
  • Analytics and service log data: Retained only for as long as reasonably necessary to operate, secure, troubleshoot, and improve the Services and to comply with applicable law, after which it is deleted or de-identified.

When you close your account, we will de-identify or delete personal information that is no longer needed, subject to applicable legal retention requirements.

10. Your Privacy Rights

Depending on where you live, you may have certain rights regarding your personal information. We will not discriminate against you for exercising these rights.

10.1 Rights for All Users

  • Access: Request a copy of the personal information we hold about you.
  • Correction: Request that we correct inaccurate or incomplete information.
  • Deletion: Request that we delete your personal information, subject to legal retention obligations.
  • Portability: Request a copy of your information in a structured, machine-readable format.
  • Opt-Out of Marketing: Unsubscribe from marketing communications at any time using the unsubscribe link in our emails or by contacting us at the address below.

10.2 Washington Consumers (My Health My Data Act)

The Washington My Health My Data Act (MHMDA) provides additional protections for consumer health data. Washington consumers (as defined by the MHMDA) have the right to:

  • Confirm whether we collect, share, or sell their consumer health data, and access consumer health data we have collected about them, including a list of all third parties and affiliates with which we have shared or sold it;
  • Withdraw consent to our collection or sharing of consumer health data;
  • Have consumer health data deleted; and
  • Appeal our decision on any rights request.

Consumer health data is defined broadly under the MHMDA and may include information that identifies a consumer as seeking health care services, as well as information inferred or derived from other data. We collect consumer health data only with your consent or as necessary to provide a product or service you have requested, and we do not sell consumer health data or share it for cross-context behavioral advertising. For full details, including the categories of consumer health data we collect and share, the recipients, and how to exercise and appeal your rights, see our Consumer Health Data Privacy Policy. To submit a MHMDA request, contact [email protected].

10.3 Other State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Nevada, and other states with comprehensive privacy laws may have similar rights to access, correct, delete, and port their personal information, and to opt out of certain uses. To exercise these rights, contact [email protected].

10.4 EEA, UK, and Swiss Residents (GDPR / UK GDPR / nFADP)

For the purposes of the GDPR, Gottman acts as the data controller for personal data collected directly through the Services and as a data processor for PHI processed on behalf of Providers through Gottman Connect.

Your Rights

If you access our Services from the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the GDPR, UK GDPR, or Swiss nFADP as applicable, including:

  • Right of access (Article 15 GDPR): Request a copy of personal data we hold about you and information about how we process it.
  • Right to rectification (Article 16): Request correction of inaccurate or incomplete data.
  • Right to erasure / "right to be forgotten" (Article 17): Request deletion of your data where there is no compelling reason for us to continue processing it.
  • Right to restriction of processing (Article 18): Request that we restrict processing of your data in certain circumstances.
  • Right to data portability (Article 20): Receive your data in a structured, machine-readable format and transmit it to another controller, where processing is based on consent or contract.
  • Right to object (Article 21): Object at any time to processing of your personal data that is based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary for legal claims. You may always object to processing for direct marketing purposes, and we will always honor that objection.
  • Rights related to automated decision-making (Article 22): You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects concerning you. Where Gottman's AI Tools generate outputs that inform clinical decisions, the platform is designed so that a licensed Provider is expected to review all such outputs before any decision affecting you is made. If you believe an automated process has produced a significant decision affecting you without human review, contact [email protected].
  • Right to withdraw consent (Article 7(3)): Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
  • Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority (e.g., in the EU, your Member State's data protection authority; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner).

Lawful Bases for Processing

Gottman relies on the following lawful bases for processing personal data of EEA/UK/Swiss residents:

  • Contract (Article 6(1)(b)): Processing necessary to provide the Services you have requested, including account management, order fulfillment, and platform operation.
  • Legitimate interests (Article 6(1)(f)): Analytics, fraud prevention, security, and improving the Services — where our interests are not overridden by your rights. You may object to this processing at any time (see Right to Object above).
  • Legal obligation (Article 6(1)(c)): Processing required to comply with applicable laws, including tax, healthcare recordkeeping, and regulatory requirements.
  • Consent (Article 6(1)(a)): Analytics and marketing cookies; any processing of special category data (including health data) outside of the clinical context. Consent is obtained explicitly and can be withdrawn at any time.
  • Vital interests or health care (Articles 6(1)(d) and 9(2)(h)): Processing of health data necessary for the provision of health care services through Gottman Connect, where the Provider is a health care professional subject to professional confidentiality obligations.

Data Protection Officer and EU Representative

Gottman has an appointed DPO/Representative and is available to answer requests as needed. For additional questions, please reach out to [email protected].

EEA/UK/Swiss data protection inquiries may be directed to the same point of contact.

11. Data Security

We implement administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These include:

  • Encryption of data in transit using TLS 1.2 or higher;
  • Encryption of sensitive data at rest;
  • Role-based access controls limiting employee access to personal information;
  • Multi-factor authentication for administrative systems;
  • Regular technical and nontechnical security assessments and testing appropriate to identified risks; and
  • Incident response procedures including breach notification protocols.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

If you believe your account has been compromised or you become aware of a potential security incident involving Gottman's Services, please notify us immediately at [email protected].

12. Children's Privacy and Age Restrictions

Our Services are not directed to individuals under 18. Gottman Connect may not be used with individuals under 18, including creating minor Client accounts or entering identifiable minor clinical data.

Providers must ensure that every Client invited to or represented by identifiable clinical data in Gottman Connect is at least 18 years old. If you believe information about an individual under 18 has been entered into Gottman Connect, contact [email protected] so that Gottman can review the matter and take appropriate action consistent with applicable law and the Provider's recordkeeping obligations.

Our Services may contain links to third-party websites, services, or resources that are not operated or controlled by Gottman. This Privacy Policy does not apply to third-party sites or services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

14. International Data Transfers

Gottman is based in the United States. If you access our Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those of your home country. For EEA/UK/Swiss users, we rely on appropriate transfer mechanisms, including Standard Contractual Clauses approved by the European Commission, to ensure adequate protection of your personal data. For all other international users, by using the Services you acknowledge this transfer.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by: (a) posting the updated Policy on our websites with a new effective date; (b) sending an email notice to the address associated with your account; and/or (c) displaying a prominent notice within the Services.

Your continued use of the Services after the effective date of an updated Policy constitutes your acknowledgment of the changes. Where applicable law requires your affirmative consent to material changes in how we process your personal information, we will obtain such consent before implementing those changes. If you do not agree to the updated Policy, you should stop using the Services.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Affective Software, Inc. d/b/a Gottman Inc. — Privacy Team

Email contact, and for security-related or BAA-related questions: [email protected]

We aim to respond to all privacy-related inquiries within 30 days of receipt.

© 2026 Affective Software, Inc. d/b/a Gottman Inc. All rights reserved.