Privacy Policy

1Scope, Clinical Discretion & Covered Entity Relationship

This Privacy Policy applies to our website (https://www.behaviorops.com/), the BehaviorOps Cloud Application, our iOS and Android mobile applications, and all related clinical APIs.

When a healthcare clinic uses BehaviorOps to manage patients and clinical therapy, the clinic acts as a Covered Entity and BehaviorOps acts as a Business Associate. All processing of electronic Protected Health Information (ePHI) strictly complies with the HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164) and our executed Business Associate Agreement (BAA).

Clinical & Medical Discretion Notice: BehaviorOps is a clinical documentation, data collection, and practice management aid for licensed and credentialed healthcare practitioners (BCBAs, BCaBAs, RBTs) and does not independently diagnose, treat, cure, or prevent any medical condition. Patients and caregivers must always seek the advice of a qualified physician or licensed healthcare professional before making any medical decisions.

2Information We Collect & How It Is Collected

We collect information strictly necessary to provide healthcare operational tools:

3How We Use Collected Information

Information collected by BehaviorOps is used exclusively to:

• Deliver session note documentation, graphing, and target mastery calculations;
• Validate EVV compliance and calculate therapist payroll rates;
• Format and submit electronic medical claims (EDI 837P) and reconcile electronic remittance advice (ERA 835);
• Provide optional HIPAA-compliant, clinician-supervised AI note drafting and pre-signature compliance auditing;
• Provide role-based clinical security and protect against unauthorized access;
• Maintain automated HIPAA-mandated immutable SHA-256 hash-chained audit logs of all clinical record accesses and modifications.

4Zero-PHI Advertising & Third-Party Sharing Prohibition

We do not embed third-party advertising SDKs, cross-app tracking identifiers (IDFA), or marketing pixels inside our authenticated clinical portals or mobile applications.

5Where Data Is Kept (100% U.S. Sovereign Data Residency) & Subprocessors

We partner exclusively with enterprise HIPAA-compliant cloud infrastructure providers that maintain executed Business Associate Agreements (or PCI-DSS Level 1 certifications) with BehaviorOps:

• Google Cloud Platform (GCP — US-East us-east1): SOC 2 Type II, ISO 27001, and HIPAA BAA-covered Cloud SQL, Cloud Run, and Cloud Storage hosting in South Carolina, USA, with FIPS 140-2 validated AES-256 disk encryption at rest and mTLS encryption in transit.
• Google Cloud Vertex AI (BAA-Covered Healthcare AI with Pre-Send PHI Tokenization): Optional AI-assisted clinical narrative drafting, pre-signature note compliance auditing, and document OCR run exclusively through BAA-covered Google Cloud Vertex AI endpoints (*.aiplatform.googleapis.com in us-east1). Before any prompt leaves the application server, our HipaaPhiScrubberService scrubs and tokenizes patient, caregiver, and clinician identifiers ([CLIENT], [PROVIDER], [SUPERVISOR], [CAREGIVER], [SERVICE_DATE], [SSN_REDACTED], [PHONE_REDACTED]) and re-hydrates tokens strictly in-memory upon return. Zero customer data or ePHI is ever retained by Vertex AI or used to train foundation models.
• Stripe Inc.: PCI-DSS Level 1 and SOC 2 Type II certified payment processing. Payment card details are tokenized directly on Stripe’s servers and are never stored on BehaviorOps infrastructure.
• Twilio / SendGrid: TLS-encrypted transactional notifications for password resets and critical system alerts (zero clinical narratives transmitted via email/SMS).

6Encryption at Rest, Encryption in Transit & Technical Security Safeguards

BehaviorOps implements defense-in-depth administrative, physical, and technical safeguards meeting or exceeding HIPAA Security Rule (45 CFR § 164.312) and AICPA SOC 2 Trust Services Criteria (CC6–CC8):

• Cloud Encryption at Rest (Disk + Application Field Layer): All cloud databases, disk volumes, backups, and document storage buckets are encrypted at rest using FIPS 140-2 validated AES-256. Sensitive PII/ePHI database columns are additionally encrypted at the application layer using authenticated AES-256-GCM encryption (SensitiveDataEncryptor), and user passwords are hashed using BCrypt.
• Mobile On-Device Offline Encryption at Rest: When clinicians work offline in the BehaviorOps iOS or Android mobile app, cached caseloads, trial data, and session note drafts are stored in an isolated local SQLite database encrypted at rest with AES-256 (offlineCrypto). The master symmetric key is generated via cryptographic CSPRNG and sealed inside the device’s hardware-backed iOS Secure Enclave Keychain or Android Hardware Keystore (expo-secure-store).
• Encryption in Transit & Payload Integrity Attestation: All external web and mobile API traffic is encrypted in transit using TLS 1.3 enforced via HTTP Strict Transport Security (HSTS). Mobile and web API requests are signed with HMAC-SHA256 client-to-server request integrity attestation (X-Bops-Integrity). Internal Cloud Run-to-Cloud SQL database traffic uses mutual TLS (mTLS).
• Zero PHI Logging & 365-Day Immutable Audit Trail: Application logging filters strictly prohibit client names, DOBs, SSNs, diagnosis codes, and clinical narratives from appearing in operational logs, while every clinical read, export, or mutation is recorded in a tamper-evident SHA-256 hash-chained audit log retained for 365 days.
• Cryptographic Multi-Tenant Schema Isolation: Clinic tenant databases are strictly isolated at the PostgreSQL schema level via verified JWT security context binding to prevent cross-organization data access.

7Data Retention, Account Deletion, & Right to Erasure

In accordance with Apple App Store Review Guideline 5.1.1(v), Google Play Data Safety Account Deletion requirements, and state medical records retention laws:

Clinical records (session notes, treatment plans, assessments) belong to the prescribing healthcare clinic (Covered Entity) and are maintained in accordance with applicable state medical record retention statutes (typically 7 to 10 years).

8Privacy Officer & Regulatory Inquiries

For any questions, compliance audits, or requests regarding this Privacy Policy or your healthcare data rights, please contact: