Privacy Policy

1. Introduction

ABA AI (“we,” “our,” or “us”) is committed to protecting your privacy and the privacy of your clients. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform.

As a platform used by healthcare providers, we are subject to the Health Insurance Portability and Accountability Act (HIPAA) and take our obligations seriously.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, professional role, and clinic information.

Clinical Data (Protected Health Information)

If you enter client data, session notes, goals, or other clinical information, this constitutes Protected Health Information (PHI) under HIPAA. This data is encrypted at rest and in transit and is only accessible to authorized members of your clinic.

Usage Data

We collect information about how you use the platform including pages visited, features used, and session duration. This data is used to improve the service and is never sold to third parties.

3. How We Use Your Information

• To provide, operate, and maintain the ABA AI platform
• To process billing and manage your subscription
• To send important service notifications and updates
• To provide customer support
• To improve and develop new features
• To comply with legal obligations

We do not sell, rent, or share your personal information or your clients' PHI with third parties for marketing purposes.

4. HIPAA Compliance

ABA AI acts as a Business Associate under HIPAA. We enter into a Business Associate Agreement (BAA) with each covered entity (clinic) that uses our platform. Our HIPAA safeguards include:

• End-to-end encryption for all PHI in transit (TLS 1.2+)
• Encryption at rest for all stored PHI
• Role-based access controls limiting PHI access to authorized users
• Audit logging of all PHI access and modifications
• Automatic session timeouts
• Breach notification procedures within HIPAA-required timelines

5. Data Retention

We retain your account data for as long as your account is active or as needed to provide services. Clinical data is retained according to your clinic's configuration and applicable state and federal record retention requirements.

Upon account termination, you may request export of your data. PHI will be deleted or returned per the terms of your BAA.

6. Data Security

We implement industry-standard security measures including:

• Secure cloud infrastructure hosted on Supabase and Vercel
• Regular security assessments and penetration testing
• Employee security training and access controls
• Incident response procedures

7. Your Rights

• The right to access your personal data
• The right to correct inaccurate data
• The right to request deletion of your data
• The right to data portability
• The right to opt out of certain data processing

To exercise these rights, contact us at privacy@aba-ai-assistant.com.

8. Cookies

We use essential cookies to maintain your session and authentication state. We do not use tracking cookies or third-party advertising cookies.

9. SMS Communications

ABA AI Assistant may send SMS text messages to users who have opted in to receive notifications. By opting in, you consent to receive text messages including session reminders, appointment alerts, and clinic notifications.

• We will never share or sell your mobile phone number to third parties
• Message frequency varies based on your clinic activity
• Message and data rates may apply
• To opt out, reply STOP to any message
• To get help, reply HELP to any message
• You can also opt out by updating your notification settings in the platform

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on the platform. Continued use of the platform after changes constitutes acceptance of the updated policy.

10. Contact Us