Privacy Policy
EasyMindCare is committed to protecting the privacy and security of providers and their clients.
What We Collect
- Provider profile, credentials, and billing data
- Client PHI entered by providers in the EHR
- Optional phone numbers and SMS opt-in consent
- Technical metadata and secure interaction logs
- Cookies and similar technologies for secure operation
How We Use Data
- Manage accounts, payments, support, and updates
- Process PHI strictly on behalf of covered entities
- Use de-identified metrics for reliability and improvements
- Never train generalized AI on PHI without consent
Data Protection
- TLS/SSL in transit and AES-256 encryption at rest
- Role-based access controls and MFA support
- Comprehensive auditing aligned with HIPAA Security Rule
- HIPAA-compliant cloud infrastructure safeguards
Rights & Choices
- Providers can update account data and preferences
- Patients direct HIPAA record requests to providers
- 30-day export window after cancellation
- Administrative/security notices remain required
Complete Privacy Policy
This policy covers the personal information we collect about you, our provider customers. It does not cover how your clients' Protected Health Information is handled: that processing is governed by our Terms of Service and Business Associate Agreement (BAA), and your practice remains the controller of your clients' data under HIPAA. If any provision of those agreements conflicts with this policy regarding client PHI, those agreements control.
1. The Information We Collect
Provider Information
When you register, we collect personal information such as your name, email address, phone number, professional credentials, practice details, and billing information.
Client Information (PHI)
As an EHR, we store Protected Health Information (PHI) that you input into the system, including patient demographics, session notes, clinical assessments, treatment plans, and billing records.
Automatically Collected Data
We automatically collect technical data such as IP address, browser type, operating system, access times, and interaction logs. We use cookies and similar technologies to keep the platform secure and efficient.
Social Sign-In
If you sign in with Google, Facebook, or Microsoft, we receive basic profile information (such as your name and email address) from that provider under its own privacy policy.
Telehealth Media
When you use telehealth features, audio and video are transmitted in real time between you and your client for the duration of the session.
Phone Numbers and SMS Consent
If you voluntarily provide your phone number and check the SMS opt-in box on our contact form, we store your number, your consent status, and the date and time consent was given. The phone number field is always optional and is not required to submit the form.
2. How We Use Your Information
To Provide the Service: We use Provider Information to manage your account, process payments, provide support, and communicate service updates.
To Support You: We respond to your inquiries and customer service requests, and we may send you newsletters and promotional communications that you can opt out of at any time as described in Section 6.
To Keep the Service Safe: We use your information to detect, prevent, and address fraud, abuse, and security incidents, and to comply with our legal and regulatory obligations.
To Safeguard PHI: Client Information is processed strictly on behalf of Providers as outlined in the BAA. We do not sell PHI or use PHI for our own marketing.
To Improve the Platform: We may use aggregated, fully de-identified usage data to monitor performance, fix bugs, and improve user experience.
AI & Machine Learning: We do not use your PHI to train generalized AI or machine learning models without your explicit consent.
3. How We Share Your Information
We do not sell or rent your personal information or your clients' PHI. We only share information in limited circumstances.
- Service Providers: Trusted vendors (e.g., cloud hosting, clearinghouses, payment processors) under strict subcontractor BAAs where PHI is involved
- Legal Requirements: Disclosures required by law, court order, subpoena, or regulatory authorities
- Safety and Fraud: We may disclose information to law enforcement or other third parties when we believe in good faith that disclosure is necessary to protect our rights or property, the safety of you or others, or to investigate fraud
- Business Transfers: In merger, acquisition, or sale scenarios, transferred data remains bound by equivalent confidentiality and HIPAA obligations
If we receive a subpoena, court order, or other legal request compelling the disclosure of your information (including client PHI), we will notify you before disclosing it unless prohibited by law or court order, so that you may seek a protective order.
Text Message (SMS) Opt-In Data and Consent
We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you the services of that campaign. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.
4. Cookies and Tracking Technologies
We and our partners use cookies, pixels, and similar technologies to collect information when you visit or interact with our websites, including:
- Log data: IP address, browser and operating system, pages visited, referring page or campaign, date and time of visit, and errors that occur during your visit
- Analytics data: the pages and links you view, time spent on our site, and general geographic location inferred from your IP address
Our marketing website uses Google Analytics to measure site performance, and may use the Meta (Facebook) advertising pixel to measure the effectiveness of our advertising. These third parties may set their own cookies and process your data under their respective privacy policies; no client PHI is ever shared with them. Our hosting provider Cloudflare may also inject lightweight web analytics into pages served through its network.
You can manage or block cookies through your browser settings, though disabling them may affect the functionality of our site and other websites you visit. Our website does not currently respond to "Do Not Track" or Global Privacy Control signals from browsers.
5. Data Security & HIPAA Compliance
We employ robust, industry-standard security measures:
- Encryption: TLS/SSL in transit and AES-256 at rest
- Access Controls: Role-based access, strict password policies, and multi-factor authentication
- Auditing: Comprehensive logs of user access and activity aligned with HIPAA Security Rule requirements
- Infrastructure: Secure HIPAA-compliant cloud hosting with physical and electronic safeguards
No method of internet transmission or electronic storage is 100% secure, so we cannot guarantee absolute security. In the event of a security breach affecting your information, we will provide notification as required by applicable law.
6. Your Rights and Choices
Providers: You may update account information in platform settings and opt out of promotional emails, while still receiving required administrative and security notices.
SMS Recipients: You may opt out of text messages at any time by replying STOP to any message (or START to resubscribe) and by contacting us at [email protected].
Patients/Clients: As EasyMindCare acts as a Business Associate, requests to access, amend, or delete records must be directed to the Provider. We assist Providers in fulfilling these requests as required by law.
State Privacy Rights
Residents of certain US states, including California, Colorado, Connecticut, Delaware, Florida, Iowa, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia, have additional rights under state privacy laws:
- The right to know and access the personal information we hold about you, in a portable format where available
- The right to correct inaccurate personal information
- The right to request deletion, which we may deny where law requires us to retain the information (for example, to comply with legal obligations or resolve disputes)
- The right to limit the use and disclosure of sensitive personal information; we do not exchange it for targeted advertising or any commercial purpose
- The right to equal service; we will not discriminate against you for exercising any of these rights
We do not "sell" personal information as defined under state privacy laws. We may share limited, non-PHI personal information with advertising partners to measure the effectiveness of our marketing on our public website. To exercise these rights, email [email protected]. We will verify your identity before processing a request, and you may designate an authorized agent to act on your behalf with proof of authorization. If you disagree with our decision on a request, you may appeal by emailing us with the subject line "Privacy Request Appeal."
7. Data Retention
We retain Provider and Client Information while your account is active, as needed to provide the Service, and as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. If you cancel, you receive a 30-day export window. After that, data is securely wiped from active servers under HIPAA data destruction guidelines, while limited encrypted backups may persist until overwritten.
8. Children's Privacy
Our services are intended for licensed healthcare professionals and are not directed at children under 13. We do not knowingly collect personal information directly from children. If we learn that we have received personal information from a child under 13 without verified parental consent, we will delete it. Records involving minor clients are processed on behalf of your practice in accordance with the BAA and applicable law.
9. International Users
EasyMindCare is based in the United States, where privacy laws may differ from those of your country of residence. By using our services you acknowledge that your information may be transferred to and processed in the United States. If you access our services from outside the United States, you are responsible for complying with applicable local laws.
10. Third-Party Websites and Services
Our website may contain links to third-party sites that we do not own or control, including social sign-in providers and advertising partners. We are not responsible for their privacy practices; please review their policies before sharing information with them.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our information practices. If we make any material changes, we will notify you by email or by a prominent notice on our website, providing at least thirty (30) days' notice before the change takes effect. We encourage you to review this page periodically for the latest information on our privacy practices.
12. Contact Us
If you have questions about this Privacy Policy, security practices, or HIPAA compliance obligations, contact our Privacy Officer:
Email: [email protected]
Website: easymindcare.com
13. Data Deletion Requests
You can request deletion of your EasyMindCare account and all associated data at any time. To delete your account yourself, sign in and go to Settings → Security, scroll to Delete Account, type the confirmation word, and submit. This permanently removes your provider profile, sessions, notes, and billing records from active servers. If you prefer, email our Privacy Officer at [email protected] and specify the email address of the account you want deleted; we will process the request and confirm in writing once it is complete.
Users Who Sign In With Facebook
If you signed in with Facebook Login, you can also request deletion by removing EasyMindCare from Facebook. Go to Facebook Apps and Websites, click Remove next to EasyMindCare, then View Removed Apps and Send Request. This tells us to delete the data we hold about you. Either way, we delete the data linked to your Facebook account and confirm the deletion. For questions about how we handle or delete your data, contact our Privacy Officer at [email protected].