Alpaca Health, Inc. ("Alpaca Health," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, and share your information when you visit our website (the "Website") and use our proprietary AI Notetaker platform (the "Platform") for Board Certified Behavior Analysts (BCBAs) and other ABA therapy professionals.

1. Users and Acceptance of Terms

This Privacy Policy applies to:

• Visitors: Individuals who visit the Website.

• Customers: ABA clinics and independent practitioners who sign up for and use the Platform.

• Authorized Users: Employees or contractors of Customers who are granted access to the Platform.

By using the Website or the Platform, you agree to the terms of this Privacy Policy and our Terms of Use.

2. Information We Collect and How We Use It

2.1 Contact Information

When you contact us or sign up for our services, we may collect your name, email, phone number, company name, job title, and other details you provide. This information is used to communicate with you about our services.

2.2 Account Information

To access the Platform, you must create an account and provide an email and password. This information is used to verify your identity and manage your account.

2.3 Billing Information

If you purchase services, we may collect payment details, which are processed by a third-party payment processor. Alpaca Health does not directly store or process payment information.

2.4 AI Notetaker Transcriptions and User Data

• The Platform transcribes, summarizes, and stores session notes entered by BCBAs.

• Session transcriptions are stored indefinitely but can be deleted at any time upon user request.

• Transcriptions may be analyzed to improve AI accuracy, but we do not use identifiable PHI for AI training.

2.5 Automatically Collected Information

We may collect technical data about your use of the Website and Platform, including:

• Device type, IP address, browser type, operating system

• Usage data such as frequency of use and feature engagement

• Cookies and tracking technologies (see Section 4 for opt-out options)

2.6 Third-Party Integrations

• If enabled by users, we may integrate with ABA-specific Electronic Health Record (EHR) systems (e.g., CentralReach, Motivity, Healthie, Medplum) to facilitate clinical documentation.

• If enabled by users, data may be shared with insurers or payers for billing purposes.

3. HIPAA Compliance and Security

• Alpaca Health is HIPAA-compliant and meets federal and state regulations for handling Protected Health Information (PHI).

• We enter into Business Associate Agreements (BAAs) with all customers on sign up.

• All data is encrypted at rest and in transit to ensure security.

4. Data Sharing and Third-Party Use

We do not share PHI with advertisers or third-party marketing services. However, we may share data with:

• Authorized third-party service providers (e.g., cloud hosting, IT security, analytics providers).

• Legal authorities if required by law or necessary to protect our rights.

• Affiliated companies for internal business purposes.

• Customers (BCBA clinics) who own and control their data within the Platform.

5. Data Retention and Deletion

• Session transcriptions are stored indefinitely but can be deleted at any time by the user.

• Users can request deletion of account data and associated transcriptions by contacting us.

• Certain data may be retained to comply with legal and regulatory obligations.

6. Parental Consent and Minor Data Handling

• BCBAs using the Platform must obtain caregiver consent before recording or transcribing sessions involving minors.

• Alpaca Health provides guidance on obtaining informed consent but is not responsible for individual compliance.

7. Your Choices and Rights

• Managing Cookies: You can adjust browser settings to reject cookies, but certain Platform features may be limited.

• Marketing Communications: You can unsubscribe from marketing emails at any time.

• Data Access & Corrections: You may update or delete your personal information via your account settings or by contacting us.

8. Data Transfers and Non-U.S. Users

Our servers are located in the United States. By using our services, non-U.S. users consent to their data being transferred and processed in the U.S.

9. Do Not Track Signals

We do not currently honor "Do Not Track" browser signals.

10. Compliance with State Laws

• California Residents: You have the right to request disclosure of how your data is shared under the California Consumer Privacy Act (CCPA).

• Nevada Residents: You may opt out of data sales by contacting us (though we do not currently sell data).

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Continued use of the Website and Platform constitutes acceptance of any changes.

12. Contact Us

For privacy-related inquiries, please contact:

• Email: founders@alpacahealth.io