Free — One active client with scheduled SMS/Telegram check-ins free forever.1
Client-side charges
Not established — not in the amount
Platform
Not recorded
Observed in an account
No. Everything on this page is documented from the vendor's pages and store listings that were read.
What we could not establish
SMS fair-use limits need review.
Paid annual equivalents are not verified upfront totals; paid prices withheld.
WhatsApp and API roadmap features not treated as available.
No account test or regulatory suitability assessment.
Regulated use — lay reading
Lay reading. What each vendor's own pages say about US HIPAA and Ontario PHIPA, read by habit.report, without legal training. Not legal advice. A vendor's account of the law is not a source for the law. Each feature is assessed separately; evidence for one never covers another.
US HIPAA-covered activity
Not assessed — Contractual and operational suitability not assessed.
Ontario PHIPA-subject activity
Not assessed — Contractual and operational suitability not assessed.
Regulatory features — what the vendor's pages state
Data entry
Vendor states: Terms: a Client is "a person the Coach adds to helping.app in order to send them check-ins" and "has no account"; the coach is "responsible for the accuracy of the phone numbers and identifiers you add". Privacy policy: clients "reply by message — they never create an account or log in".23· checked 21 Oct 2026
Hosting
Vendor states: Privacy policy and DPA: "self-hosted on infrastructure the operator controls, not a shared public cloud"; the operator is a sole trader registered in Spain; the DPA says subprocessors such as Stripe, Twilio/Telnyx and Telegram "are based in or may process data in the United States". Hosting provider and region are not named.34· checked 21 Oct 2026
Messages
Vendor states: Check-ins and replies go "over SMS and Telegram", delivered by Twilio (and Telnyx, where applicable) and Telegram Messenger Inc.; terms say delivery "depends on third-party carriers and platforms". The DPA lists "encryption in transit (TLS), encryption at rest, and field-level encryption for phone numbers".342· checked 21 Oct 2026
Notifications
Not stated
Attachments
Not stated
Video
Not stated
Exports
Vendor states: Terms: "you can export your data (for example, as a CSV) before termination". DPA: "On termination, Client Data is deleted or returned to you". Privacy policy lists a right to "receive a copy of your data in a portable format".243· checked 21 Oct 2026
Integrations
Vendor states: DPA and privacy policy list subprocessors and purposes: Twilio/Telnyx (SMS), Telegram Messenger Inc. (Telegram), Stripe (payments and billing), self-hosted infrastructure, and Glitchtip or a Sentry-compatible service (error monitoring); each is "bound by written terms that require appropriate confidentiality and security".43· checked 21 Oct 2026
AI features
Not stated
US business associate agreement
Not stated
Canada or Ontario
Vendor states: The only Canada text is in the terms, where the coach must comply with messaging laws "including.. Canada's CASL". No Canada hosting or PHIPA statement.2· checked 21 Oct 2026
Evidence
1. Helping · helping.app/ Vendor page · Read 21 Oct 2026 · No copy saved Scheduled coach-defined check-ins via SMS/Telegram; replies logged, missed responses followed up. Free forever1active client. Annual equivalents19/35/69 for10/50/200 clients; exact invoices not captured. SMS fair-use applies.14-day paid trial.
2. helping.app terms · helping.app/legal/terms Vendor page · Read 21 Oct 2026 · No copy saved Read by searching the full text. "A Client is a person the Coach adds to helping.app in order to send them check-ins. A Client is not a user of helping.app and has no account." "You are responsible for the accuracy of the phone numbers and identifiers you add". "Message delivery depends on third-party carriers and platforms (such as telecoms networks, Twilio, and Telegram)". "If you close your account, you can export your data (for example, as a CSV) before termination." The only Canada text: the coach must comply with "applicable messaging and telecom laws, including the TCPA (United States), the UK GDPR and EU GDPR together with PECR / the ePrivacy rules, Canada's CASL, Australia's Spam Act". No HIPAA or BAA text.
3. helping.app privacy policy · helping.app/legal/privacy Vendor page · Read 21 Oct 2026 · No copy saved Read in full (31 July 2026). "a messaging-based accountability platform used by coaches to send automated check-ins to their clients over SMS and Telegram. Clients reply by message — they never create an account or log in." Coach is controller: "They decide which clients to add, what to ask, when to message, and on which channel". "We are self-hosted on infrastructure the operator controls, not a shared public cloud." Same subprocessor list as the DPA ("Each subprocessor is bound by written terms that require appropriate confidentiality and security."). Rights list: "receive a copy of your data in a portable format (data portability)". Retention: coach data is kept "for a short period after closure so we can complete export". "The only piece of the web a client ever sees is an optional, read-only progress link a coach chooses to share, which expires within 24 hours." No HIPAA, BAA or Canada text.
4. helping.app data processing agreement · helping.app/legal/data-processing Vendor page · Read 21 Oct 2026 · No copy saved Read in full (last updated 31 July 2026; the page calls itself "a first draft for review by a qualified lawyer"). Operator: "Darren, a sole trader (autónomo) registered in Spain". "Client Data means the personal data of your clients that you cause helping.app to process: names and identifiers, phone numbers, Telegram identifiers, check-in messages and replies, response, streak and engagement metrics, and timezones." Security: "encryption in transit (TLS), encryption at rest, and field-level encryption for phone numbers". "Our current subprocessors, and the purpose for which each is used, are: Twilio (and Telnyx, where applicable) — SMS delivery for check-ins and replies. Telegram Messenger Inc. — Telegram message delivery for check-ins and replies. Stripe — Payment processing and billing. Self-hosted infrastructure — Hosting and storage of account and client data, on infrastructure the operator controls (not a shared public cloud). Glitchtip (or a Sentry-compatible service) — Error monitoring and application diagnostics." Transfers: "Stripe, Twilio/Telnyx, and Telegram — are based in or may process data in the United States". "On termination, Client Data is deleted or returned to you". No HIPAA, BAA, PHIPA, Canada, AI, attachment or video text.