Privacy Policy

Our role, and your clinic's

The clinic is responsible for the client information in its account. Under HIPAA the clinic is the covered entity and Cardinal Practice is its business associate: we process information on the clinic's instructions, for the purpose of running the clinic's services, and for no purpose of our own.

If you are a client or the parent or guardian of a client and want to see, correct, or ask about your records, please contact your clinic directly. They hold the relationship and the legal obligation; we cannot release records to anyone but them.

What the mobile app collects

• Your staff account: name, work email address, the role your clinic assigned you, and a profile photo if you upload one. Sign-in is handled by Amazon Cognito.
• Session records you create: appointment times, the times you start and end a session, behavior and skill data you record, the session note you write, the narrative generated from it, and signatures captured on the device — yours, and a parent or guardian's where one is given.
• Staff messages: the messages, replies and reactions you send in the app's internal communication area.
• A device notification token, so the server can deliver a push notification to your device. It identifies the device, not you personally.
• Security records: the time of significant actions, the IP address the request came from, and the browser or app version, kept in an append-only audit log. This is a HIPAA requirement and is used to investigate access to records.

What the app does not do

• No tracking. The app contains no analytics, advertising, attribution or crash-reporting SDKs of any kind. It does not track you across other apps or websites, and there is no third party receiving your activity.
• No sale or sharing of data. We do not sell personal information or protected health information, and we do not share it for advertising. We never have.
• No access to your camera, photo library, microphone, contacts, or location. The app does not request these and contains no code that uses them.
• No client names or message text in notifications. A push notification tells you only that a named colleague sent you a message, or sent one in a named channel. The message body and any client information stay inside the app, behind your sign-in.
• Your phone number is used only for sign-in codes. If you choose “Text me a code” when signing in, we send one 6-digit code by text for that sign-in. We never send marketing texts and never share your number for marketing. Reply STOP to stop texts or HELP for help; message and data rates may apply. You can choose email codes instead at any time.

Where information goes

Cardinal Practice runs on Amazon Web Services in the United States, under a Business Associate Agreement with AWS. We use these sub-processors:

• Amazon Web Services — hosting, database storage, file storage, email delivery, sign-in (Cognito), and the model that drafts session narratives (Bedrock).
• Apple Push Notification service — delivery of the notifications described above.
• Stedi — insurance eligibility checks, when a clinic uses that feature. Only the details needed to ask a payer whether coverage is active are sent.

When a session narrative is drafted, the information sent to the model is deliberately limited: it excludes the client's surname, date of birth, client number, diagnosis and insurance details. This limit is enforced by the structure of the request, not by convention.

How information is protected

• Encrypted in transit, with full certificate verification, and encrypted at rest using keys we manage.
• The database has no public endpoint and is reachable only from the application's own network.
• Access is limited by role, and separately by the clinic that owns the record — staff at one clinic cannot reach another clinic's information.
• Significant actions are written to an append-only audit log.
• Accounts are suspended or removed by the clinic, and a suspended account stops working on its next request.

How long information is kept

Clinical records are kept for as long as the clinic needs them to meet its own legal and professional obligations, which are usually set by state law.

If a clinic ends its relationship with us, its information is returned or deleted following a reasonable wind-down period, on the clinic's instruction, and subject to any legal or regulatory retention obligations that apply to us or to the clinic. Where such an obligation requires information to be retained beyond that point, it stays protected under the same safeguards described above for as long as it is held.

Accounts and deletion

Staff accounts are created, suspended and removed by the clinic that employs the staff member — there is no self-service sign-up and no in-app account deletion, because an individual clinician cannot unilaterally delete records their employer is legally required to keep. To have your account removed, ask your clinic administrator. If you cannot reach them, write to info@cardinalpractice.com and we will work with the clinic that owns the account.

Children

Many clients receiving ABA therapy are children, and information about them is held in the system by their clinic. The app itself is not directed to children and is not used by them: every account belongs to a member of clinical or administrative staff.

Changes and contact

If this policy changes materially we will update the date at the top and notify the clinics we serve. Questions about this policy, or about information held in Cardinal Practice, can be sent to info@cardinalpractice.com.