Privacy Policy

Effective Date: October 23, 2026
Last Updated: October 23, 2026

1. INTRODUCTION

Behavior Plan Pro ("Behavior Plan Pro," "Company," "we," "us," or "our") respects the privacy and confidentiality of individuals and organizations using our website and cloud-based software platform (collectively, the "Service").

This Privacy Policy describes how we collect, use, disclose, store, protect, and retain personal information in connection with the Service.

Legal Operator: Behavior Plan Pro
Business Location: Georgia 31313, United States
Contact: contact@behaviorplanpro.com

Behavior Plan Pro provides software designed to assist applied behavior analysis ("ABA") professionals and healthcare organizations with clinical documentation, assessments, behavior intervention plans, staff management, and related workflows.

Because our platform may process sensitive clinical information, we distinguish between:

• Account and Business Information: Information collected to operate accounts, subscriptions, billing, and customer relationships.
• Customer Data: Information submitted, uploaded, generated, or maintained by clinics and authorized users.
• Protected Health Information ("PHI"): Individually identifiable health information protected under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended, and its implementing regulations.

Where Behavior Plan Pro acts as a business associate of a HIPAA-covered organization, PHI is governed by the applicable Business Associate Agreement ("BAA").

If this Privacy Policy conflicts with an executed BAA regarding PHI, the BAA controls to the extent necessary to comply with applicable law.

2. INFORMATION WE COLLECT

2.1 Account Registration Information

When an individual or organization creates an account, requests information, or subscribes to the Service, we may collect:

• Full name and professional title.
• Business email address.
• Clinic or organization name.
• Professional role.
• Organization size and number of locations.
• Selected subscription plan.
• Account and subscription preferences.
• Communications submitted to us.

2.2 User Authentication Information

We use Amazon Cognito to support account authentication and access management.

Depending on the configuration, authentication information may include:

• User identifiers.
• Email addresses.
• Authentication status.
• Multifactor authentication enrollment.
• Sign-in activity.
• Security-related events.

Passwords are managed through the authentication system. Behavior Plan Pro does not intentionally collect or store users' plaintext passwords in its application database.

2.3 Clinical and Client Information

Clinics and authorized users may submit information relating to individuals receiving behavioral or clinical services.

This information may include:

• Client names and identifying information.
• Assessments and clinical observations.
• Behavior intervention plans.
• Behavioral definitions and intervention procedures.
• Treatment goals and progress documentation.
• Staff implementation instructions.
• Parent and caregiver training materials.
• Other clinical documentation.

Such information may constitute PHI.

Behavior Plan Pro processes this information on behalf of the Customer, subject to the applicable BAA and law.

The clinic or healthcare organization determines what client information is submitted, who may access it, and how it is used for authorized clinical purposes.

2.4 Billing and Subscription Information

We collect information necessary to manage subscriptions, including:

• Subscription plan.
• Billing frequency.
• Number of authorized seats.
• Additional locations.
• Payment status.
• Transaction identifiers.
• Subscription history.
• Billing contact information.

Payments are processed through Stripe.

Behavior Plan Pro does not intentionally receive or store complete payment card numbers in its application database.

Stripe processes payment information according to its own applicable privacy and security terms.

2.5 Agreement and Consent Records

When an authorized representative electronically accepts our Terms of Service or executes a BAA, we may retain:

• Signatory name and title.
• Organization legal name.
• Agreement version.
• Acceptance date and time.
• Internet Protocol ("IP") address.
• Electronic acceptance records.

These records may be maintained to establish contractual acceptance and satisfy legal or compliance obligations.

2.6 Technical and Security Information

We may automatically collect technical information necessary to operate and protect the Service, including:

• IP addresses.
• Browser and device information.
• Login timestamps.
• Session information.
• Authentication events.
• Application error logs.
• Security events.
• Authorized user activity.
• Audit records identifying changes to clinical documentation.

We use this information for security, troubleshooting, system administration, and compliance purposes.

2.7 Customer Support Information

When users contact us or submit a problem report, we may collect the information included in their request.

Users should avoid including unnecessary PHI in ordinary email or support messages.

Where support requires access to PHI, we will handle that information in accordance with the applicable BAA and authorized support procedures.

3. HOW WE USE INFORMATION

Behavior Plan Pro uses personal information and Customer Data for legitimate business and contractual purposes, including:

3.1 Providing the Service

We process information to:

• Establish and administer accounts.
• Authenticate authorized users.
• Provide clinical documentation tools.
• Store and retrieve Customer Data.
• Support authorized document sharing.
• Manage subscription features.
• Process billing.
• Provide technical support.

3.2 Security and Fraud Prevention

We use technical and account information to:

• Detect suspicious activity.
• Investigate unauthorized access.
• Prevent fraud and abuse.
• Maintain audit logs.
• Protect system availability and integrity.
• Enforce applicable access restrictions.

3.3 Service Communications

We may send operational communications concerning:

• Account verification.
• Login and security notifications.
• Subscription and billing activity.
• Free-trial expiration.
• Product updates.
• Changes to legal agreements.
• Service interruptions.

These communications may be necessary to maintain the Customer's account and contractual relationship.

3.4 Marketing Communications

We may send promotional communications to business contacts where permitted by applicable law.

Recipients may unsubscribe using the instructions provided in the message or by contacting us.

We do not use PHI or identifiable clinical records for advertising or promotional targeting.

4. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

4.1 AI-Assisted Documentation

Behavior Plan Pro may provide AI-assisted features that help authorized clinicians draft, organize, summarize, or revise clinical documentation.

Information submitted to these features may be processed by automated systems to generate the requested output.

4.2 Clinical Information and AI

Where AI processing involves PHI, Behavior Plan Pro will process that information only as permitted by the applicable BAA, contractual arrangements, and law.

Any external AI service provider receiving PHI must be appropriately authorized and subject to required contractual safeguards.

4.3 AI Model Training

Behavior Plan Pro will not use identifiable PHI to train general-purpose AI models without separate lawful authorization and any required contractual protections.

4.4 Human Oversight

AI-generated documentation is intended to assist qualified professionals.

Behavior Plan Pro does not independently diagnose patients, prescribe treatment, or authorize clinical interventions.

Clinicians remain responsible for reviewing and approving all clinical content before use.

4.5 AI Data Retention

Retention of information processed through AI features will be governed by the applicable BAA, authorized processing arrangements, and documented retention procedures.

5. DISCLOSURE OF INFORMATION

Behavior Plan Pro does not sell personal information or PHI.

We do not disclose client records to advertisers or data brokers.

We may disclose information under the following circumstances.

5.1 Service Providers

We use third-party providers to support platform operations.

These currently include:

Amazon Web Services ("AWS")

AWS supports cloud infrastructure, data storage, authentication, and related platform functions.

Where AWS services process PHI on our behalf, the applicable services must be covered by appropriate business associate arrangements and configured for authorized use.

Stripe

Stripe processes payments and subscription transactions.

Stripe is not intended to receive clinical records or PHI through our payment integration.

Additional service providers, including AI providers, may be used only subject to appropriate contractual, privacy, and security requirements.

5.2 Authorized Customer Users

Information may be disclosed to individuals authorized by the Customer, including clinicians, administrators, staff members, and caregivers, according to applicable permissions.

5.3 Legal Obligations

We may disclose information when required by applicable law, court order, or valid legal process.

Disclosures involving PHI remain subject to applicable HIPAA restrictions and contractual obligations.

5.4 Business Transactions

In connection with a merger, acquisition, reorganization, or sale of business assets, information may be transferred subject to applicable confidentiality, contractual, and legal protections.

Any transfer involving PHI must comply with applicable HIPAA and BAA requirements.

6. INFORMATION SECURITY

Behavior Plan Pro is designed to incorporate security measures appropriate for a platform handling sensitive healthcare information.

Such measures may include:

• Encryption of data in transit.
• Encryption of stored data.
• Multifactor authentication.
• Role-based access controls.
• Clinic-level data segregation.
• Server-side authorization.
• Audit logging.
• Restricted administrative access.
• Security monitoring.
• Backup and recovery controls.

We evaluate security measures in relation to applicable legal obligations, system risks, and operational requirements.

No electronic system can guarantee absolute security.

Where required, Behavior Plan Pro will provide security incident and breach notifications according to applicable law and the executed BAA.

7. DATA RETENTION

7.1 Active Accounts

We retain account and Customer Data as reasonably necessary to provide the Service and fulfill applicable contractual and legal obligations.

7.2 Subscription Termination

When a subscription ends, account access may be restricted or terminated.

Customer Data, including PHI, will be handled according to the executed BAA and documented retention and deletion procedures.

Behavior Plan Pro does not promise indefinite retention or permanent availability of canceled account data.

7.3 Return and Destruction of PHI

Upon termination of an applicable BAA, PHI will be returned or destroyed as required by that agreement and applicable law.

Where return or destruction is infeasible, applicable protections and restrictions will continue for as long as the information is retained.

7.4 Billing and Legal Records

We may retain transaction records, agreement acceptance records, and other business information for periods required by tax, accounting, contractual, or legal obligations.

7.5 Security Logs and Backups

Security logs and backup information may be retained for documented operational, security, or legal purposes.

Where retained information contains PHI, appropriate safeguards and applicable BAA restrictions will continue.

7.6 Deletion Requests

Authorized Customers may request information export or deletion by contacting contact@behaviorplanpro.com.

Requests will be reviewed and fulfilled subject to applicable legal requirements, identity verification, contractual obligations, and technical limitations.

8. YOUR PRIVACY RIGHTS AND CHOICES

8.1 Account Information

Users may request access to or correction of their account information by contacting us.

8.2 Marketing Preferences

Users may opt out of promotional emails at any time.

Opting out of marketing does not prevent necessary account, security, or billing communications.

8.3 Clinical Records

Behavior Plan Pro generally processes clinical records on behalf of the healthcare organization that submitted them.

Individuals seeking access to, correction of, or other action concerning their clinical records should contact the responsible clinic or healthcare organization.

Behavior Plan Pro will assist Customers with applicable privacy requests as required by law and the BAA.

8.4 Applicable Privacy Laws

Where state or federal privacy laws provide additional rights, Behavior Plan Pro will honor applicable obligations and exceptions.

Certain healthcare information may be governed by HIPAA rather than general consumer privacy statutes.

9. COOKIES AND SESSION TECHNOLOGIES

Behavior Plan Pro uses authentication and session technologies necessary to operate the Service.

These technologies may support:

• Secure login.
• Session continuity.
• Authentication.
• Fraud prevention.
• Application functionality.

Behavior Plan Pro does not intentionally use third-party advertising or cross-site behavioral tracking cookies.

If additional analytics or tracking technologies are introduced, this Privacy Policy will be updated as appropriate.

10. CHILDREN'S PRIVACY

Behavior Plan Pro is intended for use by authorized healthcare professionals, clinic personnel, and adult caregivers.

The Service is not designed for independent use by children.

Clinics may enter information about minors as part of authorized clinical documentation.

Such information is processed on behalf of the Customer and is subject to applicable healthcare privacy requirements and the executed BAA.

Behavior Plan Pro does not knowingly solicit children to create independent accounts.

11. DATA LOCATION AND INTERNATIONAL ACCESS

Behavior Plan Pro currently intends to store and process Customer Data within United States-based infrastructure.

Customers are responsible for ensuring that access to the Service by their authorized users complies with applicable legal and organizational requirements.

Any material change to the geographic processing of PHI must comply with applicable contractual and legal obligations.

12. THIRD-PARTY WEBSITES AND SERVICES

The Service may contain links to third-party websites or services.

Behavior Plan Pro is not responsible for the independent privacy practices of third parties that operate outside our contractual service-provider relationships.

Users should review the privacy policies of those services before providing information.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our services, technology, legal obligations, or information practices.

The updated version will be posted with a revised effective date.

We will provide reasonable advance notice of material changes where appropriate or legally required.

Changes affecting PHI processing will remain subject to the applicable BAA and governing law.

14. CONTACT INFORMATION

For privacy inquiries, information requests, or questions concerning this Privacy Policy, contact:

Behavior Plan Pro
Georgia 31313, United States
Email: contact@behaviorplanpro.com

Privacy and security requests will be handled according to applicable legal and contractual requirements.