EMILE-E Practice OS · Legal
Practice OS Privacy Policy
This Privacy Policy explains how EMILE-E.tech Corp, a Florida corporation ("EMILE-E," "we," "us"), handles information in connection with EMILE-E Practice OS: the staff web portal, the client mobile app, and related services (together, the "Service"). It covers practice staff who use the portal, and clients of practices who use the Client App.
1. The most important thing
If you are a therapy client whose practice uses Practice OS, your clinical information belongs to your practice's record, and your practice controls it. We process it only on the practice's behalf, under a Business Associate Agreement ("BAA") as required by HIPAA. For questions about your records, or to exercise your rights over them, contact your practice; we support the practice in honoring those rights.
2. Information we process
For practice staff. Account information (name, work email, role, password credentials), the content staff create in the portal (schedules, notes, messages, billing entries), and sign-in and audit events.
For clients (via the practice and the Client App). Contact and demographic information the practice keeps in its charts; appointments and booking requests; secure messages with the practice; wellness check-in responses (for example, PHQ-9 and GAD-7); intake forms and documents; telehealth session participation; and invoices and payment status. Most of this is protected health information handled under the BAA.
AI Note Assistant. When a clinician uses it, session audio and transcripts are processed to generate a draft note for that clinician's review. This content is PHI, is handled under the BAA, is not used to train generalized AI models, and is retained only as needed to deliver the feature.
Automatically. Technical logs for security and reliability: IP addresses, device and app version information, and error logs. Push notifications to the Client App are designed to be PHI-free.
3. How we use information
- To provide the Service to the practice: scheduling, charting, messaging, telehealth, measurement-based care, documents, billing, and payments.
- To secure the Service: authentication, role-based access, tenant isolation, abuse prevention, and immutable audit logging.
- To support practices and improve reliability, using de-identified, aggregated usage data.
- To bill practices for the Service.
We do not sell personal information. We do not use it for advertising. We do not use Customer Data, including PHI, to train generalized AI models.
4. How information is shared
We share information only with service providers needed to run the Service, each bound by appropriate agreements (including BAAs where they handle PHI): Google Cloud (hosting, database, authentication), our telehealth media provider, our payment processor (we do not store full card numbers), and AI processing providers for the AI Note Assistant. We may also disclose information if required by law, to protect the safety and security of the Service, or as part of a business transfer, in which case this policy continues to apply.
5. HIPAA roles
The practice is the HIPAA covered entity and the custodian of its clinical records. EMILE-E is a business associate. The executed BAA governs our handling of PHI, including permitted uses, safeguards, breach notification, and disposition of PHI at termination. Where this policy and the BAA conflict with respect to PHI, the BAA controls.
6. Retention and deletion
Customer Data is retained while the practice's subscription is active. Signed clinical notes and audit logs are kept immutably during the term; corrections are made by amendment, consistent with clinical recordkeeping norms. After termination, the practice may export its data for 30 days, after which we may delete it, subject to legal retention obligations and the BAA. Clients should direct record-retention questions to their practice, which owns the record.
7. Security
The Service runs on Google Cloud infrastructure under a BAA, with encryption in transit and at rest, per-practice tenant isolation enforced by server-set access controls, role-based permissions, server-authoritative writes for sensitive records, and immutable audit logging. No system is perfectly secure; if we learn of a breach affecting your information, we will notify affected practices consistent with applicable law and the BAA, and support their notification obligations.
8. Your choices and rights
Practice staff can review and update account information in the portal.
Clients exercise rights over clinical records (access, amendment, accounting of disclosures) through their practice under HIPAA. Depending on where you live, you may also have consumer-privacy rights in information we hold as a business; contact us at privacy@emile-e.tech and we will respond consistent with applicable law, coordinating with your practice where HIPAA applies.
Client App notifications can be turned off in device settings; the app remains usable without them.
9. Children
Practices may treat minor clients; in that case the Client App is used by or for a minor under the practice's and guardian's direction, and the information involved is PHI governed by the BAA and the practice's own policies. We do not knowingly collect information from children outside that clinical context.
10. Website visitors
Our marketing site (emile-e.tech) sets no advertising cookies and runs no third-party analytics or tracking scripts.
11. Changes and contact
We will post any material changes to this policy here and, for active practices, provide notice by email or in the portal at least 30 days before they take effect. Questions and requests: privacy@emile-e.tech, EMILE-E.tech Corp, Florida, USA.