This page covers what this website collects when you visit it, what the ABAVault platform does with the records our customers keep in it, and what the mobile app asks your phone for.
If you are a parent or a client of a therapy practice that already works with us, that practice decides what is stored about you and for how long, and their agreement with us governs it. Ask them, and they can ask us.
If you apply for the beta, you send us what the form asks for: your name, work email, phone number, your practice's name and website, your role, the state you work in, how many locations, clients and staff you have, how your services are funded, where sessions happen, what software you use today, when you would want to move, how you heard about us, and anything else you choose to write. We also record when you sent it, your IP address and your browser.
It goes into ABAVault itself, on the same servers as the platform, and not to a mailing list service. Our team uses it to review your application and to contact you about the beta. We do not add you to a newsletter and we do not sell or share it. The form asks you not to include any client's health information, and so do we. To have your application deleted, email privacy@abavault.com.
Every page loads a small script from our own servers that records that a page was viewed. It stores a count and nothing else: no IP address, no cookie, no query string, and nothing that could identify you or link one visit to another. It exists so we can tell whether anybody is reading the site.
This website uses Microsoft Clarity. Clarity makes a session recording of your visit: the pages you opened, where you moved the mouse, what you clicked, how far you scrolled, and how long you stayed. We watch those recordings to find out which parts of the page confuse people.
Clarity writes two cookies in your browser, _clck and _clsk, which is how it knows that several page views belong to one visit. It also collects your approximate location from your IP address, your browser, your operating system and your screen size.
This runs on this marketing website only. It is not on app.abavault.com or family.abavault.com, and it will not be, because those are behind a login and a recording of those screens would contain a real person's health information.
To switch it off, either block cookies for this site in your browser or turn on Do Not Track, which Clarity honours. Microsoft describes what Clarity collects in its own privacy statement.
This website uses Google Analytics 4. It records which pages you opened, roughly where in the world you were, which browser and device you used, and whether you arrived from a search, from a link somewhere else, or by typing the address in. It writes a cookie starting _ga, which is how it knows that several page views belong to one visit.
We use it to see which pages get read and which ones people leave. We have switched off the account settings that would let Google use this data for its own products and its own modelling.
This runs on this marketing website only, for the same reason as Clarity above. It is not on app.abavault.com or family.abavault.com.
To switch it off, block cookies for this site in your browser, or install Google's opt-out browser add-on. Google describes what Analytics collects in its own privacy policy.
The typefaces on this site are served by Google Fonts, so loading a page tells Google your IP address and browser. Nothing else about you is sent.
The ABAVault platform processes protected health information (PHI) on behalf of our customers, who are healthcare providers and HIPAA covered entities. In that relationship, our customers are the data controllers of client records, and ABAVault acts as a business associate under a signed Business Associate Agreement. We use PHI only to provide the contracted services, we apply administrative, technical and physical safeguards to it, and we never sell PHI or use it for advertising. Write to privacy@abavault.com for a copy of our BAA or a description of those safeguards.
The mobile app is for staff at a therapy practice. It asks for five permissions and every one of them is in the table below. If a permission is not listed here, the app does not ask for it.
The app also has its own privacy policy, which is the URL an app store listing points at. It is the longer version of this section: what the app collects, what it keeps on the phone, how long any of it lasts, and who else touches it.
| Permission | What it is for | When it is used |
|---|---|---|
| Location | Proving a visit happened where and when it was billed, which Medicaid requires as Electronic Visit Verification, and listing a practice's clinics nearest first. | Only while the app is open. At clock in, at clock out, and once when the Locations screen opens. There is no background location tracking, the app never asks for it, and it is switched off in the build. |
| Camera | Scanning QR tags when equipment is checked in or out, and taking a profile photo. | Only when you open the scanner or choose to take a new photo. The camera does not record video, and the app does not request the microphone at all. |
| Photo library | Choosing an existing photo as your profile picture. | Only the one image you pick. Nothing else in the library is read. |
| Face ID, Touch ID or fingerprint | Locking the app so it needs your face or fingerprint to reopen. | Checked on your device, which answers yes or no. Your face and fingerprint data never leave the phone and never reach us. Apple and Google do not make it available to apps. |
| Push notifications | Telling you about schedule changes, messages and approvals. | Only if you allow them. Each push notification is written to be generic on purpose, so a client's name does not appear on a lock screen. Delivery goes through Expo's push service and then Apple or Google. |
The app does not track your location in the background, does not record audio, and does not read your contacts, your calendar or any file you have not handed it. The microphone permission is stripped out of the build rather than merely left unused.
When something goes wrong in the platform, the web app, the mobile app or our servers send us a diagnostic report so we can find and fix the fault. A report contains the error and technical stack trace produced by our software, the screen or route pattern where it happened in a generic internal form such as /clients/:id rather than the address the person was actually on, the version of the application, the date and time, the user account and organization so we can follow up, and a short set of device details limited to platform, operating system version, application build, screen and which part of the app caught the error.
Reports do not include the web address being visited, the contents of any form, search terms, the records on screen, or any client information. Our servers discard anything else they receive. Error messages and stack traces are produced by the software rather than typed by anyone, and are not intended to contain personal or health information. If we find that any does, we remove it. Reports are stored on our own systems inside the same protected environment as the rest of the data, and are not sent to any third-party analytics or error-tracking service.
We use vetted infrastructure and service providers, covering cloud hosting, clearinghouse connectivity and AI inference, under agreements that include BAA coverage where PHI is involved. A current subprocessor list is available on request from privacy@abavault.com.
Customer data is retained for the duration of the customer agreement and for as long as healthcare record retention rules require. Customers can start a deletion request through the platform's controlled deletion workflow. Information you send us through this website is deleted on request.
Write to privacy@abavault.com if you want to know what we hold about you, correct it, or have it deleted. A person reads that mailbox.
If you are asking about records held by a therapy practice that uses ABAVault, tell us which practice, and we will point the request to them, because those records are theirs rather than ours.
When this page changes in a way that matters, the effective date at the top moves and the change is described in the release notes.