Privacy Policy

1. Our role

Reflectra is software that counseling practices use. When you're a client of a practice, the health information in Reflectra is part of your practice's records. Your practice is the custodian of those records, and we handle them only for your practice, under a business associate agreement and HIPAA.

Your practice's Notice of Privacy Practices explains how it uses and shares your health information. If it conflicts with this policy about your health information, it controls. For anything about your records, contact your practice.

2. What we collect

• When you enroll: on the checkout page we host for your practice, your name, email and, if you give it, your mobile number; whether you agreed to texts, and when; and your acceptance of our Terms and this policy.
• Your account: your name, email, mobile number, and how you sign in (email and password, Apple or Google). If you sign in with Apple or Google, we receive your name and email from them.
• From your practice: your invite, your counselor and your program.
• What you enter for your care: your signed consent, intake and questionnaire answers, check-ins, practice logs, messages, your emergency contact and the address you join sessions from. These are part of your practice's records.
• Your voice: when you use Talk, your words are turned into text on your iPhone, and the recording is deleted when you stop. Only the text you choose to save is sent to Reflectra.
• Your device: a notification token so we can send you notifications, and technical logs such as IP address, app version and errors.
• Payments: handled by Stripe through your practice's account. Your card details go to Stripe, not to Reflectra or your practice.
• Help requests: your name, email, topic, message and, if you add it, your device.
• Website visitors: technical information our web host records, and what you send us if you contact us or book a call.

3. How we use it

We use information to run Reflectra for your practice: to enroll you with your practice, sign you in, keep your account secure, send your invite and notifications, answer help requests, prevent fraud and misuse, and comply with the law. Notifications never include health information. They say only, for example, "New message from your counselor." Even so, a notification or text can show that you're a client of your practice to anyone who sees your phone.

We never sell your information, and we never use health information for advertising. The Reflectra app and the web pages your practice sends you have no ads, no tracking and no analytics, and they set no cookies. reflectra.co uses only the cookies the site needs to run.

4. Who we share it with

• Your practice and its clinicians, to provide your care.
• Service providers that run Reflectra for us, each limited to that job: Amazon Web Services (hosting, storage, email and texts, in the United States), Apple (sign-in and notifications) and Google (sign-in), Stripe (payments to your practice), our AI vendors (section 5), and an error-monitoring service that receives technical details, never your health information.
• When the law requires it, or to protect someone from serious harm.
• With your permission.
• In a merger, acquisition or sale of assets, with the same protections for your information.

Every service provider that handles health information signs a business associate agreement.

5. AI in Reflectra

When your practice uses them, Reflectra's AI features:

• The Guide, a practice partner in the app that you can turn off.
• Check-in reflections, a short reflection after each check-in.
• Score summaries, which compare your questionnaire scores with your past scores.
• Drafts for your clinician: session notes and your treatment plan, which your clinician reviews, edits and signs.
• A safety check that reads check-ins and reflections for signs of a crisis and alerts your clinician during business hours. It isn't an emergency service.
• An AI scribe, only if your clinician uses it and you agree. The audio is deleted once the transcript exists.

AI never diagnoses you or decides your care. Your practice's informed consent explains which features it uses. Our AI vendors work under business associate agreements, and your health information is stored in the United States. We don't use your health information to train AI models, and neither do our AI vendors.

6. Text messages

We use your mobile number only to text your invite link, if you agreed when you paid, and for your account. We send at most 6 texts for each invite. Texts never include health information, but each one shows your practice's name. Consent to texts is not a condition of purchase. Message and data rates may apply. Reply STOP to opt out or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

7. Your choices and rights

• Your records: to see, copy or correct them, ask your practice. We help your practice answer.
• Your account information: email legal@reflectra.co.
• Delete your account in the app, in Settings. That ends your sign-in, removes your notification tokens and disconnects Sign in with Apple. Your records stay with your practice, which must keep them as the law requires.
• Notifications and the microphone: turn them off at any time in your iPhone's Settings.
• Texts: reply STOP.

8. Keeping it safe

Health information in Reflectra is encrypted and stored in the United States; what you write is encrypted with a separate key for each client. Your practice decides how long your records are kept, as the law requires, and we keep them for it. If your practice stops using Reflectra, we return its records to it or delete them, as our agreement with your practice requires. Help requests are deleted after 90 days.

No system is perfectly secure. If a breach affects your information, you'll be told as the law requires.

9. Children and changes

Reflectra isn't for anyone under 18, and we don't knowingly collect information from children.

We may update this policy. We'll tell you about a material change in the app or by email before it takes effect. The date at the top shows the current version.