Privacy Policy

1INTRODUCTION

TheraSnap ("we," "our," or "us") is committed to protecting the privacy and security of your information. This Privacy Policy explains how we collect, use, and safeguard your information when you use our clinical documentation application. TheraSnap is built for licensed healthcare professionals, including speech-language pathologists, occupational therapists, physical therapists, and behavioral health clinicians.

2INFORMATION WE COLLECT

2.1Account Information

• Name and credentials
• Email address
• Professional license information
• Billing information (processed by third-party providers)

2.2Clinical Documentation Information

• Client names and contact information you enter (encrypted)
• Your voice recordings and dictation (encrypted)
• Clinical notes you create or edit (encrypted)
• Treatment information you document

2.3Usage Information

• App usage statistics
• Feature usage patterns
• Device information
• IP address (for security)

2.4Voice Recordings and Dictation

• Audio recordings of YOUR voice memos and dictation (encrypted)
• Transcription data from your voice recordings
• AI-processed content generated from your dictation

IMPORTANT CLARIFICATION: TheraSnap is designed for therapists to record voice memos AFTER sessions end. We collect recordings of therapist dictation, not recordings of therapy sessions with clients present. However, if you choose to use TheraSnap to record actual client sessions (not our intended use), those recordings would also be collected and stored with encryption.

3HOW WE USE INFORMATION

3.1To Provide Services

• Process your voice recordings into clinical notes
• Store and organize client data you enter
• Generate reports based on your documentation
• Enable secure access to your clinical records

3.2To Improve Services

• Analyze de-identified usage and performance metrics (for example, feature usage counts and error rates)
• Develop new features
• Fix bugs and diagnose errors

We do not use your clinical content, voice recordings, transcripts, or client information to train or fine-tune artificial intelligence models, and we do not permit our AI subprocessors to do so. Where diagnosing a specific error requires access to clinical content, that access is logged in the audit trail and limited to the minimum necessary.

3.3For Security

• Detect unauthorized access
• Prevent fraud
• Maintain audit logs
• Comply with legal obligations

4HIPAA COMPLIANCE

4.1Protected Health Information (PHI)

We handle PHI in accordance with HIPAA requirements:

• Encryption at rest and in transit
• Access controls and audit logs
• Minimum necessary access
• Secure disposal procedures

4.2Business Associate Agreement

We act as your Business Associate under HIPAA when you use TheraSnap for PHI. Your voice memos, dictation, and clinical notes contain PHI and are treated with the highest level of security and confidentiality.

5DATA SECURITY

5.1Technical Safeguards

• AES-256 encryption for data at rest
• TLS encryption for data in transit
• Secure key management, with client data keys held in the device keychain
• Periodic review of security controls and dependency vulnerabilities

HOW ENCRYPTION WORKS, PRECISELY. Your clinical content is encrypted on your device and stored encrypted. To produce a transcription, note, report, or other AI-assisted output, that content is transiently decrypted in server memory and sent to the AI subprocessors listed in Section 7, each engaged under a Business Associate Agreement. It is re-encrypted for storage and is not retained in plaintext after processing. TheraSnap is therefore encrypted at rest and in transit, but is NOT end-to-end encrypted, and we do not claim that it is.

5.2Administrative Safeguards

• Workforce HIPAA training appropriate to the size and complexity of our organization
• Role-based access controls and audit logging of PHI access
• Documented incident response procedures
• Periodic risk assessment of systems that handle PHI

5.3Physical Safeguards

• Secure data centers (Google Cloud)
• Access controls
• Environmental protections
• Device security

6DATA SHARING

6.1We DO NOT Share

• PHI with third parties (except as required by law or with your consent)
• Client information for marketing purposes
• Your voice recordings with anyone
• Clinical notes with anyone

6.2We May Share

• Anonymized aggregate statistics (de-identified data only)
• Information with your explicit consent
• Information to comply with legal obligations
• Information with service providers under strict Business Associate Agreements

6.3Third-Party AI Processing

Producing transcriptions, notes, reports, and other AI-assisted output requires sending your clinical content to third-party AI providers. We engage each such provider under a Business Associate Agreement, and none of them may retain your content for their own purposes or use it to train their models. The specific providers are listed in Section 7.1.

7THIRD-PARTY SERVICES AND SUBPROCESSORS

7.1AI Subprocessors

Depending on the feature you use and your subscription plan, your clinical content may be processed by:

• OpenAI — speech-to-text transcription of session recordings (Whisper) and clinical note generation. BAA in place; no retention; no model training.
• Google — the SLP Expert AI Assistant, including its analysis, chat, and audio transcription (Gemini and Chirp). BAA in place; no retention; no model training.
• Anthropic — note generation and related AI-assisted output on our highest-tier plan (Claude). Enabled only where a Business Associate Agreement is in place; no retention; no model training.

We will update this section before adding or substituting any AI subprocessor that receives PHI.

7.2Infrastructure

• Google Cloud Platform (hosting, storage, serverless compute) - BAA in place
• Firebase (authentication, database, file storage) - BAA in place

7.3Payment Processing

Payment processors receive your billing information but do not receive PHI or clinical content.

• Apple App Store (in-app purchases)
• Google Play Store (in-app purchases)
• Stripe (web payments)

8YOUR RIGHTS

8.1Access Rights

You can:

• View your information
• Export your data
• Request copies of your records

8.2Correction Rights

You can:

• Update account information
• Correct client records
• Modify notes

8.3Deletion Rights

You can:

• Delete specific records
• Request account deletion
• Remove recordings and notes

8.4Consent Management

You can:

• Revoke consents
• Manage permissions
• Control data usage

9DATA RETENTION

9.1Active Accounts

• Client data: Retained while your account is active
• Voice recordings: Retained while your account is active, unless you delete them
• Clinical notes: Retained while your account is active
• Audit logs and other business associate records: Six years, consistent with HIPAA's documentation retention requirement

You can delete individual recordings, notes, and client records at any time from within the app. Deleting a client also deletes that client's sessions and notes.

9.2After Termination

• 30-day grace period for data export
• Complete deletion after 90 days
• Backup systems purged within 180 days
• Legal holds may extend retention as required by law

10MINORS AND SCHOOL SETTINGS

TheraSnap accounts are for licensed professionals only and are not available to anyone under 18. We do not knowingly collect information directly from children; information about a minor client reaches us only because you, the clinician, entered it.

Many of our users serve pediatric caseloads, so clinical information about minors is handled as PHI under HIPAA and applicable state law governing minors' healthcare privacy.

FERPA. If you work in a school, preschool, early-intervention, or other educational setting, your documentation may be an education record governed by the Family Educational Rights and Privacy Act ("FERPA") and state education-privacy law rather than, or in addition to, HIPAA. Determining which regime applies to your records, and obtaining any vendor approval or authorization your district requires before entering student information, is your responsibility as the clinician. We will sign a written agreement with your district or employer where one is required.

11BREACH NOTIFICATION

Under HIPAA, you are the Covered Entity and we are your Business Associate. That determines who notifies whom.

OUR OBLIGATION TO YOU. If we discover a breach of unsecured PHI, we will notify you without unreasonable delay. HIPAA permits a Business Associate up to 60 days; our practice is to notify you as soon as we have confirmed a breach occurred and identified its scope, and we will not wait for a complete investigation to tell you that one is underway. Our notice will identify the affected individuals and records where known, describe what happened, and set out the remediation steps we are taking.

YOUR OBLIGATION TO YOUR PATIENTS. Notifying affected individuals, the Secretary of Health and Human Services, and (for breaches affecting 500 or more individuals in a state or jurisdiction) the media are the Covered Entity's duties under HIPAA, not ours. We will give you the information you need to meet them, and will cooperate with your investigation, but we cannot make those notifications on your behalf unless we have separately agreed in writing to do so.

Please report any suspected breach or unauthorized access on your side to us promptly at info@therasnap.ai.

12CALIFORNIA PRIVACY RIGHTS

California residents have additional rights under CCPA:

• Right to know what information we collect
• Right to delete personal information
• Right to opt-out of data sales (we don't sell data)
• Right to non-discrimination for exercising privacy rights

13SERVICE AVAILABILITY AND DATA LOCATION

TheraSnap is offered to clinicians practicing in the United States and Canada, and all data is processed and stored in the United States. The Service is not intended for, or offered to, clinicians or patients in the European Economic Area, the United Kingdom, or Switzerland, and we do not undertake to meet the requirements of the EU or UK General Data Protection Regulation. If you access the Service from outside the United States, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

14RECORDING DISCLOSURE

TheraSnap's recording feature is designed for therapist voice memos recorded AFTER sessions end. If you choose to use TheraSnap to record actual therapy sessions with clients present:

• You are responsible for obtaining proper consent from clients
• You are responsible for complying with state recording laws
• You must inform clients their voice will be recorded and processed
• TheraSnap is not liable for unauthorized or illegal recordings

15CHANGES TO PRIVACY POLICY

We may update this policy periodically:

• Material changes will be notified via email and in-app notification
• Continued use constitutes acceptance
• Previous versions available upon request
• You will be prompted to review significant changes

16BROWSER EXTENSION

The TheraSnap Session Helper Chrome extension moves a finished note from your account into your web-based practice or billing software. The extension:

• Accesses your session data only when you explicitly request it
• Does not collect browsing history or unrelated page activity
• Stores its settings locally using Chrome's secure storage
• Logs PHI access to the same audit trail as the app
• Requires authentication with your TheraSnap account
• Is covered by the same Business Associate Agreement as the app

17CONTACT US

For privacy questions or concerns:

Privacy Officer: info@therasnap.ai
HIPAA Compliance: info@therasnap.ai
General Support: support@therasnap.ai

Case Creative LLC d/b/a TheraSnap
2474 Walnut Street #216
Cary, NC 27518

PLEASE DO NOT SEND PHI BY EMAIL. Email is not a secure channel and is not covered by our encryption controls. If you need to discuss a specific client record, contact us without identifying the client and we will arrange a secure channel.