AutismSprout ("we," "our," or "the platform") is an applied behavior analysis (ABA) therapy management platform that helps clinicians, educators, and caregivers track student progress, generate intervention programs, and produce reports. This Privacy Policy explains how we collect, use, store, and protect personal and health-related information when you use our services.
By creating an account, you acknowledge that you have read, understood, and agreed to the practices described below.
1. Information We Collect
We collect information necessary to provide and operate the platform:
- Account information: name, email address, and authentication credentials you provide at registration.
- Student and client data: names, dates of birth, diagnoses, communication levels, behavioral observations, session notes, progress data, and documents uploaded by authorized users.
- Protected health information (PHI): clinical notes, assessment data, and therapy records that may qualify as health information under applicable law.
- Usage data: audit logs, activity records, and technical information about how the platform is accessed and used.
2. How We Use Information
We use collected information to:
- Provide, maintain, and improve the therapy management tools and features.
- Authenticate users and secure access to accounts and records.
- Generate AI-assisted program content, summaries, and suggestions (always subject to clinician review before use).
- Produce reports, progress tracking, and documentation for authorized clinicians and caregivers.
- Maintain audit trails for accountability and security compliance.
- Respond to support requests and communicate important service information.
3. Lawful Basis and Health Data
Because the platform may store protected health information and student records, we design our practices to align with applicable U.S. health-privacy standards, including the Health Insurance Portability and Accountability Act (HIPAA) where applicable. We act as a business associate or service provider to covered entities that use the platform, and we enter into appropriate agreements to support HIPAA compliance. Users are responsible for ensuring they have the legal authority and consent (including from parents, guardians, or authorized representatives) to enter client data into the platform.
4. Data Sharing and Disclosure
We do not sell your personal or health information. We share data only as necessary to operate the service or as required by law:
- Within your authorized team: data is visible to the clinician or organization that creates it, and to users they explicitly invite, based on least-privilege access controls.
- Service providers: trusted third-party vendors that host infrastructure, provide authentication, or power AI features under confidentiality obligations.
- Legal compliance: where required by law, court order, or to protect the rights, property, or safety of users, clients, or others.
5. Data Security
We implement reasonable administrative, technical, and physical safeguards to protect information, including secure authentication, encrypted data transmission, role-based access controls, session management, and audit logging. Access to records is restricted to authorized users and the minimum necessary information needed to perform their role. No method of transmission or storage is completely secure, but we work to protect your data using industry-standard practices.
6. Data Retention
We retain account and client data for as long as your account is active or as needed to provide the service and meet legal or professional obligations. Authorized users may delete records within the platform. Upon account closure, we will remove or de-identify data in accordance with our retention schedule and applicable legal requirements.
7. Your Rights
- Access and portability: request a copy of the personal data we hold about you.
- Correction: request correction of inaccurate or incomplete information.
- Deletion: request deletion of data, subject to legal and clinical retention obligations.
- Consent withdrawal: withdraw consent for processing where consent is the lawful basis; note this may limit platform features.
8. Children's Privacy
The platform is designed to manage information about students and minors in a therapeutic context. Such information is entered only by authorized clinicians, educators, parents, or guardians who have the legal authority to do so. We do not knowingly collect personal information directly from children outside of this authorized, supervised context.
9. International Users
The platform is primarily operated from the United States. If you access the service from outside the U.S., your information may be transferred to and processed in the U.S., and you consent to such transfers.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, notifying users through the platform. Continued use after changes constitutes acceptance of the revised policy.
11. Contact
For privacy questions or requests, contact your AutismSprout administrator or the organization that provisioned your account. For legal or compliance inquiries, contact the platform administrator handling your deployment.