This policy covers the ABAVault mobile app for iPhone, iPad and Android. The ABAVault website has its own policy, and it covers different things.
The app is a work tool for staff at ABA therapy practices. It holds client records so that therapists can do their jobs in homes and clinics, often with no signal. It sends that data to ABAVault and nowhere else. There is no advertising in it, no tracking, and no analytics company watching what you do. We do not sell anything to anyone.
The app is used by employees and contractors of practices that subscribe to ABAVault. It is not for the general public, and there is no way to sign up inside it. Your practice creates your account.
The client records in the app belong to the practice you work for. ABAVault stores and processes them on that practice’s behalf under our agreement with them. If you are a parent or client asking about your own records, contact the practice directly. We cannot release records to anyone but the practice that holds them.
Your name, work email address, phone number, job role and profile photograph if you add one. Your password is never stored in a form we can read.
Whatever your practice’s clinical work requires you to enter or look at. In practice that means client names, dates of birth, addresses, contacts, diagnoses, medications, behavior programs and targets, behavior data you collect during a session, session notes and the forms your practice uses. This is protected health information and it is treated as such.
See the section below. It is narrow and it is worth reading.
Messages you send colleagues in the app, files and photographs you attach, and any screenshot you choose to attach to a support ticket.
Your schedule, hours, time off requests, mileage, expense claims and receipts, and equipment assigned to you. We do not collect card or bank details in the app.
An identifier for your device so we can send you notifications, and your device platform and operating system version.
When the app hits an error it sends us the error message, the technical stack trace, the screen you were on, the app version and your operating system version. This is so we can fix it. It is capped at a few reports per launch and it is not used for anything else.
Location matters for Medicaid billing, so we are specific about it.
When you clock in to a session and when you clock out, the app records your position once, at that moment, and sends it to ABAVault as part of Electronic Visit Verification. That is the only location we receive.
We only do this after you have read and agreed to the notice the app shows you. If you decline, no location is captured.
Separately, the Locations screen reads your current position on your phone to sort your practice’s locations by how close they are. That reading stays on your phone. It is not sent to us, not saved, and gone as soon as you leave the screen.
The app never asks for background location and never tracks you continuously. It cannot see where you are between visits, after hours, or on a day off.
The app keeps a copy of your schedule, your clients and your sessions on the device so you can work without a signal. It also keeps changes you make offline until they can be sent.
That copy is stored using your phone’s own encrypted storage: the Keychain on iPhone and iPad, the Keystore on Android. It is protected by your device passcode and, if you turn it on, by Face ID, Touch ID or fingerprint.
Signing out clears it. If you lose your phone, tell your practice administrator, who can end your session.
The app also locks itself after a period of inactivity, and it can be set to require your fingerprint or face before it will open.
On Android the app blocks screenshots and screen recordings of client information. On iPhone and iPad, Apple does not give apps a reliable way to do this, so screenshots remain possible. Treat anything on your screen as you would a paper record.
Very few parties, and none of them for their own purposes.
Apple and Google deliver push notifications to your device. They handle the delivery, not the contents of your records.
Expo issues the token that identifies your device for notifications, and hosts the app updates described below.
Amazon Web Services hosts ABAVault. Your practice’s data lives there.
Nobody else receives data from the app.
Some updates reach the app directly rather than through the App Store or Play Store. When the app starts it checks Expo’s update service, which learns your device is asking for an update. Those updates change how the app behaves. They do not send your records anywhere new.
Client records are kept for as long as your practice needs them and as long as the law requires, which is set by your practice, not by us. Crash reports are kept while they are useful for fixing the problem. The copy on your phone lasts until you sign out or delete the app.
Everything the app sends travels over an encrypted connection. Sign in requires multi-factor authentication. The app locks itself when idle. Reads of client records are recorded in an audit log, so your practice can see who looked at what. Data on your device sits in the phone’s encrypted storage.
No system is perfect and anyone who tells you otherwise is selling something. If we ever have a breach affecting your information, we notify your practice as our agreement with them and the law require.
The app is a workplace tool for adults. We do not knowingly create accounts for anyone under sixteen. Records about children in the app are clinical records entered by staff, held on behalf of the practice, and governed by the practice’s agreements with the families it serves.
If you want to know what the app holds about you as an employee, or you want something corrected, ask your practice administrator first, since they control the account. If you cannot get an answer there, write to us at the address below.
If you are a parent or client asking about a child’s records, contact the practice that provides the therapy. We cannot answer those requests directly.
If we change what the app collects, we update this page and change the date at the top. If the change is significant, your practice will hear from us before it takes effect.
ABAVault Technologies LLC
hello@abavault.com
privacy@abavault.com for privacy requests
(888) VAULT-06 (888-828-5806)