Privacy Policy

Account Information: When you register, we collect your name, email address, and the password you create. If you create a clinic, we also collect the clinic name.

Clinic and Scheduling Data: You and your authorized staff enter client records (names, dates of birth, diagnoses, insurance information), staff information, session schedules, authorizations, and related clinical-operational data. Much of this data constitutes PHI under HIPAA.

Usage Data: We automatically collect information about how you interact with the Platform, including login timestamps, pages visited, and actions taken. This data is used solely to maintain the service, troubleshoot issues, and improve the Platform.

• To provide and maintain the Platform's scheduling and clinic management features.
• To authenticate your identity and manage role-based access within your clinic.
• To send service-related notifications, such as schedule changes and authorization alerts.
• To generate audit logs as required for HIPAA compliance.
• To communicate with you about your account, billing, and service updates.
• To improve the Platform based on aggregated, de-identified usage patterns.

We do not sell, rent, or trade your personal information or PHI to third parties. We do not use your data for advertising. We do not share your data with third parties except as described in this policy.

We may share information only in the following limited circumstances:

• Service Providers: We use trusted infrastructure providers to host and operate the Platform. These providers are bound by data processing agreements and, where applicable, Business Associate Agreements.
• Legal Requirements: We may disclose information if required by law, subpoena, court order, or governmental regulation.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data would be transferred as part of that transaction, and you would be notified.

We handle PHI in accordance with the HIPAA Privacy Rule and Security Rule. Key safeguards include:

• Business Associate Agreements: We execute BAAs with each clinic before any PHI is entered into the Platform.
• Role-Based Access Control: The Platform enforces role-based permissions (Owner, Admin, Scheduler, BCBA, RBT) so that staff members see only the data relevant to their role.
• Audit Logging: All access to PHI is logged, including who accessed what and when. Audit logs are retained for a minimum of six years.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS.
• Access Controls: Administrative functions are restricted to authorized clinic staff with appropriate roles.

We retain your data for as long as your account is active. If you terminate your account, we retain your data for 30 days to allow for export, after which it is permanently deleted. Audit logs are retained for six years as required for HIPAA compliance, even after account termination.

You have the right to:

• Access: Request a copy of the data we hold about you or your clinic.
• Export: Download your clinic's data at any time using the Platform's built-in export tools.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your account and data, subject to legal retention requirements.

To exercise these rights, contact us at [email protected].

The Platform uses essential session cookies to keep you signed in and maintain your preferences. We do not use third-party advertising cookies or tracking pixels. We do not track you across other websites.

The Platform is designed for use by clinic professionals, not by children. We do not knowingly collect information directly from children under 13. Client records entered by clinic staff on behalf of minors are governed by HIPAA and the clinic's own policies.

In the event of a security breach involving PHI, we will notify affected clinics and individuals in accordance with HIPAA breach notification requirements and applicable state laws. Notifications will be provided within the timeframes required by law.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Platform at least 30 days before they take effect. The "Effective Date" at the top of this page indicates when this version was last updated.

This Privacy Policy is governed by the laws of the State of Texas.

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

ABA Study Companion LLC
[email protected]