Draft for attorney review. Not yet in effect.

Privacy Policy

Effective date: [Effective date]

This Privacy Policy explains how [Company legal name] ("we," "us," or "our") collects, uses, shares, and protects personal information through the IntakeAlly website and application (together, the "Service"). IntakeAlly is software that helps organizations, such as assessment providers that work with California regional centers, prepare intake and assessment documents, manage their teams, and run their back office.

If you have questions about this policy, contact us at support@example.com.

1. Two kinds of information: this policy and client records

The Service handles two very different kinds of information, and different rules apply to each.

Account and website information. This is information about the people who visit our website or use the Service: organization administrators, team members, independent coordinators, outside accountants, and people who contact us. This Privacy Policy governs that information, and we decide how it is used.

Client records. Organizations that subscribe to IntakeAlly ("customer organizations") upload and create records about the people they serve. These records can include names, dates of birth, diagnoses, medical and developmental history, regional center case numbers, assessment notes, and other health information. We process client records only on behalf of, and under the instructions of, the customer organization, under a Business Associate Agreement and the Customer Agreement. Client records are protected by federal and California law, including the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA, Civil Code §56 et seq.), and, for regional center clients, Welfare and Institutions Code §4514.

We do not use client records for our own purposes, we do not sell them, and we do not use them for marketing or advertising.

If you are a client, or the parent, guardian, or representative of a client, and you want to see, correct, or ask questions about a record, please contact the organization that provided services to you or your regional center. They control the record and are responsible for responding to your request. If you contact us, we will refer your request to the right organization and help that organization respond as our agreements require.

The rest of this policy is about account and website information unless it says otherwise.

2. Personal information we collect

We collect the following categories of personal information.

Information you give us

Contact and account details: name, work email address, phone number, job title, organization name, and your role in the organization (for example, administrator, coordinator, or accountant).
Sign-in information: your password (we store only a one-way scrambled version, never the password itself) and, if you turn on two-step sign-in, the setup information for your authenticator app.
Professional details for coordinators: information you or your organization add to your profile, such as service area, languages spoken, availability, and credentials, so organizations can assign work.
Business and billing information for organizations: business name, address, and billing contact. When an organization chooses to connect a bank account or use payroll features, see Sections 8 and 9.
Messages and support requests: what you write when you contact us or send feedback.

Information collected automatically

Activity and security logs: sign-in times, failed sign-in attempts, the actions you take in the Service (for example, which case you opened and when), your IP address, and your browser and device type. We keep these to protect accounts, investigate problems, and give organization administrators an activity log of who viewed each case.
A single sign-in cookie: see Section 5.

We do not collect Social Security numbers or bank account and routing numbers through the Service. Payroll details are entered directly on Gusto's pages, and bank connections are made through Plaid's own window.

Information from others

From your organization: if an administrator invites you, they give us your name, email address, and role.
From service providers we connect to at your organization's request: limited information from Plaid or Gusto, described in Sections 8 and 9.

3. How we use personal information

We use account and website information to:

create and manage accounts and let organizations invite and manage their teams;
provide the features of the Service, including assigning work, preparing documents, and showing activity logs to administrators;
keep the Service secure, including detecting suspicious sign-ins, locking accounts after repeated failed attempts, and investigating incidents;
send service messages, such as invitations, password resets, security alerts, and notices about changes to our terms or this policy;
respond to support requests and feedback;
bill organizations for their subscriptions once billing begins;
understand, in aggregate, how the Service is used so we can fix problems and improve it, without using client records; and
comply with law and enforce our agreements.

We do not use your information to show you advertising, and we do not build marketing profiles.

We share personal information only as described here.

With your organization. If you use the Service as part of an organization, that organization's administrators can see your account details, your role, and your activity in the Service, including which cases you viewed.
With subprocessors and service providers that help us run the Service, such as our cloud hosting and AI provider, under contracts that limit their use of the information to providing services to us. Our current list is on the Subprocessors page. The categories are: cloud hosting, database, file storage, and AI processing (Amazon Web Services); bank connections (Plaid); payroll (Gusto); and email delivery.
With services you or your organization choose to connect, such as Plaid and Gusto, as described below.
For legal reasons, when we believe in good faith that disclosure is required by law, subpoena, or court order, or is needed to protect the rights, safety, or property of our users, the public, or us. For client records, we follow the legal process requirements in the Business Associate Agreement and in HIPAA, the CMIA, and W&I Code §4514.
In a business transfer, such as a merger or sale of assets, subject to this policy and to our obligations under any Business Associate Agreement.
With your consent or at your direction.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in California law. We have not done so in the past twelve months.

California Shine the Light (Civil Code §1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

5. Cookies, Do Not Track, and tracking across sites

Cookies. We use one strictly necessary cookie that keeps you signed in. It is required for the Service to work and is removed when you sign out or your session ends. We do not use advertising cookies, analytics cookies, tracking pixels, or social media plug-ins.

Do Not Track. Some browsers send a "Do Not Track" signal. Because we do not track you across websites or over time for advertising or similar purposes, our Service works the same way whether or not your browser sends this signal. We also treat Global Privacy Control signals the same way: we already do not sell or share your information.

Third-party tracking. We do not allow third parties to collect personal information about your online activities over time and across different websites when you use the Service. When you open a Plaid or Gusto window from inside the Service, that provider's own privacy policy applies to the information you enter there.

6. AI processing

Some features use artificial intelligence to read uploaded documents and draft text, such as summaries of records or sections of an assessment report. These features run through Amazon Bedrock, a service of Amazon Web Services, using Anthropic's Claude models hosted by AWS. This processing is covered by our Business Associate Agreement with AWS.

Customer content, including client records, is not used to train AI models, by us or by AWS. Amazon Bedrock does not use inputs or outputs to train its models.
AI processing happens within AWS in the United States.
AI drafts are only drafts. A qualified professional at the customer organization must review, correct, and approve every document before it is used.
We do not use AI to make decisions that produce legal or similarly significant effects about you.

7. Subprocessors

We use a small number of service providers to run the Service. Only Amazon Web Services stores or processes client records, and it does so under a Business Associate Agreement. Our source code is hosted on GitHub, which never receives customer data. See the full list and how we announce changes on the Subprocessors page.

8. Bank connections through Plaid

If your organization chooses to connect a bank account (for example, to help with bookkeeping), we use Plaid Inc. ("Plaid") to gather your organization's data from financial institutions. By using this feature, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from your financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid End User Privacy Policy.

Plaid gives us a secure connection token, which we store encrypted, and account and transaction information that the connection provides. We do not receive or store your bank sign-in credentials. Only organizations that choose this feature use it, and client records are never sent to Plaid. You can disconnect a bank account at any time in the Service's settings.

9. Payroll through Gusto

If your organization chooses to run payroll through Gusto (Gusto, Inc.), payroll setup, including employee tax and bank details, is entered directly on Gusto's pages, and Gusto's own terms and privacy policy apply. We receive limited information from Gusto, such as employee names, pay dates, and payroll status, so the Service can show payroll information alongside your other records. We do not collect or store Social Security numbers or employee bank details. Client records are never sent to Gusto.

10. How long we keep information

We keep account and website information for as long as your account is active and as needed to provide the Service. After an account or organization is closed, we delete or de-identify account information within a reasonable time, except where we need to keep it longer to comply with law, resolve disputes, keep security and audit logs, or enforce our agreements. Activity logs that support HIPAA audit requirements may be kept for up to six years. [Counsel: confirm retention periods.]

Client records are kept, exported, and deleted according to the customer organization's instructions and the Customer Agreement and Business Associate Agreement.

11. How we protect information

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, encryption at rest (at launch), role-based access, two-step sign-in, automatic sign-out, and activity logging. Every record belongs to one organization, and access checks run on every request. You can read more on our Security page.

No system is perfectly secure. If we learn of a security incident affecting your information, we will notify you and others as required by law and our agreements.

12. Children

The Service is for professionals and organizations. Accounts are not for children under 13, and we do not knowingly collect personal information from children under 13 for an account. If you believe a child has created an account, contact support@example.com and we will delete it.

Customer organizations often serve children, and client records may contain information about children. We process those records only on the customer organization's behalf, under the protections described in Section 1.

13. Your choices and California privacy rights

Reviewing and changing your information. You can review and update most of your account information at any time in your profile settings. Organization administrators can update information about their team members. You can also ask us to review, correct, or delete your account information by emailing support@example.com.

Rights we offer to everyone. We may not currently be required to comply with the California Consumer Privacy Act (CCPA), but we offer the following to all users regardless of where they live:

Access: ask what personal information we have about you and receive a copy.
Correction: ask us to correct inaccurate information.
Deletion: ask us to delete your account information, subject to legal exceptions (for example, records we must keep for security, legal, or billing reasons).
Non-discrimination: we will not treat you differently for using these rights.

To make a request, email support@example.com from the address on your account, or write to us at [Mailing address]. We will confirm your identity before acting, usually by confirming control of your account email. You may use an authorized agent; we may ask for proof of the agent's authority. We aim to respond within 45 days.

If you are a team member of a customer organization, some requests (for example, deleting your account while you are still assigned work) may need to go through your organization's administrator.

Medical information. Medical information governed by HIPAA or the CMIA, including client records, is exempt from the CCPA. Requests about client records should go to the customer organization or regional center, as described in Section 1.

Email. We send only service messages related to your account. You cannot opt out of essential messages such as security alerts and password resets while you have an account.

14. Where information is stored

We store and process information in the United States. Client records are stored and processed only in the United States.

15. Changes to this policy

We may update this policy from time to time. The effective date at the top shows when it was last changed. If we make a material change, we will notify you before it takes effect by email to the address on your account, by a notice in the Service, or both. We will not make a material change to how we use information already collected without giving you notice and, where the law requires, getting your consent.

16. Contact us

[Company legal name] [Mailing address]

Privacy questions and requests: support@example.com General support: support@example.com