This is the agreement for the ABAVault platform. It is the same document shown in the app, and it includes the Privacy Policy for the platform in the same page.
For what this marketing website itself collects when you visit it, and what the mobile app asks your phone for, see Privacy.
Your agreement with ABAVault Technologies LLC for use of the platform.
As used in these Terms, the following terms have the meanings set out below:
By creating an account, logging in, or otherwise accessing or using the Platform, you accept these Terms, the Privacy Policy in Part II, and any additional policies or terms we post or provide in writing (together, the "Agreement"). If your Organization has signed a master subscription agreement, Order Form, Trial & Beta Addendum, or BAA with ABAVault, the master subscription agreement and Order Form control over these Terms for general commercial matters, the Trial & Beta Addendum controls only for the applicable trial or beta subject to those agreements, and the BAA controls for PHI, in each case to the extent of a conflict.
You access the Platform as an Authorized User of a Client. You understand that this Agreement binds both the Client and you, and that your use may affect separate agreements among you, the Client, and ABAVault. If you are accepting on behalf of an Organization, you represent and warrant that you have full legal authority to bind such Organization.
Subject to these Terms and payment of applicable fees, we grant you a personal, non-exclusive, non-transferable, revocable license to access and use the Platform solely for your own or your Client's internal practice-management purposes. This is a license only, not a transfer of title; all rights not expressly granted are reserved.
You agree not to, and will not permit others to:
The Platform is operated from within the United States; those who access it from other locations do so on their own initiative and are responsible for compliance with local law.
The Platform is intended for licensed, certified, or credentialed healthcare providers and practice-management staff operating in the field of Applied Behavior Analysis (ABA) therapy, and for family members and caregivers invited to the family portal (governed under a separate privacy policy describing access to and use of family/patient information). Use of the Platform by anyone under 18 years of age is not permitted.
Organizations must provide accurate, current, and complete registration information and keep it up to date. Each account is specific to one Organization and may not be shared across unaffiliated entities.
Organizations are solely responsible for all activity under their account, including actions by any User given access to the Platform by the Organization or one of its Users, and must ensure that all Users have read and agree to these Terms.
ABAVault is a cloud-based practice-management platform built for ABA therapy providers. The Services include, without limitation:
Where the Organization offers telehealth, the Platform supports telehealth scheduling and billing and surfaces meeting links; ABAVault does not host or provide the underlying video service, which is operated by the third-party platform the Organization uses. We may modify, enhance, suspend, or discontinue any feature at any time, with notice where commercially reasonable.
Access is offered on a subscription basis. Available features depend on the Subscription Plan selected in your Order Form or on the pricing page at sign-up. Fees are billed monthly in advance and are non-refundable except as expressly stated here or in your Organization's Order Form, or as required by law. You authorize us (or our payment processor) to charge your designated payment method.
Subscriptions run month to month, with no minimum term and no early termination fee, and renew each month at the then-current rate unless cancelled. We give at least 30 days' notice before a price change takes effect. Fees are exclusive of applicable taxes, which you are responsible for paying.
We may offer free trials and beta participation at our discretion, on the terms in your Organization's Order Form and any Trial & Beta Addendum; data entered during a trial is handled as those agreements and the BAA provide. Overdue amounts may result in suspension, and we may charge interest at 1.5% per month (or the maximum permitted by law, if less) plus reasonable collection costs.
The Platform includes optional tools that let an Organization collect self-pay balances from clients and families, including through the family portal. To use them, the Organization connects its own account with a supported third-party payment processor (for example, Stripe, Square, Authorize.net, or Adyen). The Organization is the merchant of record: payments flow to the Organization's processor account, and the Organization, not ABAVault, is responsible for its payment-processor agreement, the amounts it charges, receipts, refunds, chargebacks, disputes, and any applicable card-network, PCI-DSS, and surprise-billing or consumer-protection obligations. ABAVault provides the tooling and passes payment details to the connected processor; card and bank account numbers are handled by the processor, and ABAVault does not store full payment-card numbers. Fees charged by the payment processor are governed by the Organization's agreement with that processor.
ABAVault acts as a Business Associate under HIPAA when processing PHI on your behalf and as a service provider or contractor when processing other personal information in Client Data on the Organization's behalf. The BAA is incorporated by reference; to the extent of any conflict between the BAA and these Terms regarding PHI, the BAA controls.
We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI as required by the HIPAA Security Rule (45 CFR Part 164), and will report breaches of unsecured PHI as required by the HIPAA Breach Notification Rule and the applicable BAA. We use and disclose PHI only as needed to provide the Services or as required by law. We do not sell PHI or use it for marketing, and we do not use PHI to train AI models.
The Organization is responsible for ensuring its use complies with HIPAA and other healthcare laws; obtaining necessary authorizations and consents; configuring role-based access controls appropriately; ensuring only authorized workforce members access PHI; and providing required HIPAA training. Each User agrees to access only the minimum necessary PHI for their role.
The Platform includes an optional in-app messaging system. Messaging is enabled at each Organization's discretion and may be disabled, or restricted by role, group, or named individuals, at any time. This Section applies whenever messaging is enabled and is in addition to the obligations elsewhere in these Terms.
Messaging is provided for legitimate, work-related communication. Users must not send content that is unlawful, harassing, discriminatory, threatening, defamatory, or abusive, and must not share PHI beyond the minimum necessary or with anyone not authorized to receive it. Organizations configure who may create conversations, post, and delete messages, and are responsible for setting those controls appropriately.
An Organization's owners and administrators may configure a watchlist of words or phrases. When a message matches, the Platform creates a flag record and notifies owners/administrators; flagging is observational and the message is still delivered. Authorized reviewers may view a flagged message in full, including surrounding conversation context, even in conversations in which the reviewer is not a participant, and each such review is recorded in the audit log. Keyword monitoring is configured and operated by the Organization, not by ABAVault; we provide the tooling only.
Each Organization is solely responsible for disclosing monitoring to its workforce, for example, through an acceptable-use, communications, or employee-handbook policy, and for obtaining any notices, consents, or acknowledgments required by applicable federal, state, or local law (including state electronic-monitoring notice statutes) before enabling or relying on monitoring. ABAVault is responsible for maintaining reasonable security and privacy-by-design controls for the monitoring tools but does not provide legal advice regarding their use.
Deleting a message removes it from normal view, but the underlying record is retained (soft-deleted) for audit, compliance, and recordkeeping purposes consistent with Part II and your BAA,, unless a longer period is required by law, the BAA, or a documented legal hold. During any permitted retention, ABAVault restricts use and access to audit, security, compliance, and recordkeeping purposes. Keyword monitoring relies on literal text matching and will not detect every concerning communication; it may produce missed matches and false positives, and does not account for paraphrase, misspelling, abbreviation, images, or intent. Monitoring and flagging are supplemental safeguards only, not a guarantee of safety, compliance, or detection, and do not replace the Organization's own supervision, clinical judgment, mandatory-reporting obligations, and compliance program. ABAVault is not responsible for an Organization's configuration, for messages that are or are not flagged, or for actions taken (or not taken) in response to a flag, except to the extent caused by ABAVault's breach of this Agreement, negligence, or failure of the Platform to operate as documented.
Certain features may use artificial intelligence to generate draft content, for example, draft session-note narratives or progress summaries. AI features are disabled by default and operate on a bring-your-own-provider basis: they become available only after the Organization (a) selects an AI provider and supplies its own account credentials, and (b) attests that it has a signed BAA with that provider covering PHI and that model training and data retention are disabled on the account (a zero-data-retention or equivalent configuration).
When AI features are used, ABAVault transmits the relevant data to the Organization's chosen provider at the Organization's direction. The Organization is responsible for provider selection, its agreement with that provider, and the accuracy of its attestations; ABAVault will reasonably verify required settings before enabling the integration, transmit only data necessary for the requested feature, require available no-training and zero-retention controls, and disable or contain the integration if it presents a suspected security or privacy incident. AI providers must be bound by written confidentiality, security, incident-reporting, deletion, no-training, and applicable BAA obligations. Each party is responsible to the extent an AI-related claim or loss is caused by its breach, negligence, or violation of law. AI output is a draft only: it must be reviewed, edited as needed, and approved by a qualified member of the workforce before any clinical, billing, or other professional use. The Platform records the provenance of AI-generated drafts and logs every AI call for audit. AI output may contain errors and is not clinical, legal, billing, or other professional advice. As stated in Section 6, we do not use PHI to train AI models.
As between the parties, the Client retains all right, title, and interest in and to Client Data, including all PHI, client records, session notes, messages, and billing data. ABAVault does not claim ownership. The Client grants us a limited, non-exclusive license to host, store, transmit, display, and process Client Data solely to provide the Services and as described in this Agreement and the BAA.
You are solely responsible for the accuracy, quality, integrity, legality, and appropriateness of Client Data. You may export your Organization's data through the Platform's export features; upon written request made before termination, we will provide a data export in a mutually agreed format, and may apply a reasonable cost-based fee (consistent with HIPAA) for work beyond standard export features.
For Organizations that enable Electronic Visit Verification, the Platform records the device's geographic location at the two moments a user clocks in to and clocks out of a service session, together with date, time, service type, and the identities of the individuals providing and receiving care, as required by the 21st Century Cures Act and applicable state Medicaid programs. Those visit records, including both locations, may be submitted to the Electronic Visit Verification system the applicable state Medicaid program requires. Separately, the mobile app reads the device's location once when the Locations screen opens, to sort the Organization's locations by distance; that reading stays on the device and is not stored by ABAVault. Location is read only while the app is open, and the Platform does not track location continuously or in the background. Each Organization is responsible for informing personnel that clock-in and clock-out location is recorded, obtaining any required consent, and using the data solely for visit verification, billing, and compliance.
We may create and use de-identified and aggregated data derived from use of the Platform only if it satisfies applicable U.S. statutory deidentification standards, cannot reasonably be used to identify an Organization, User, or Client, and, if derived from PHI, is de-identified in accordance with HIPAA. We will not attempt to reidentify the data, will contractually prohibit recipients from reidentifying it, and will use it for product improvement, benchmarking, research, and analytics. Optional community-benchmarking features that use aggregated billing outcomes are off by default and require opt-in.
The Platform, including all software, code, interfaces, content, trademarks, service marks, logos, trade dress, and documentation, is and remains the exclusive property of ABAVault and its licensors. These Terms grant no rights to our intellectual property except the limited license expressly set forth. If you provide suggestions, ideas, bug reports, or other comments about the Platform ("Feedback"), you grant us a royalty-free, worldwide, perpetual, irrevocable license to use it without restriction. Copyright complaints may be sent to legal@abavault.com, Attention: DMCA Agent.
You agree to hold ABAVault's Confidential Information (including the Platform's code, technical characteristics, pricing, business information, and non-public materials) in trust and confidence for so long as it remains confidential or for five years from termination, whichever is longer; PHI is handled per HIPAA for as long as required by law, and trade secrets remain protected as long as they qualify. Confidential Information does not include information that is or becomes public through no breach by you, is lawfully obtained from a non-confidential source, was already in your possession, or was independently developed without reference to ABAVault's information.
The Platform may integrate with or link to third-party services, including insurance clearinghouses and eligibility services, payment processors (such as Stripe, Square, Authorize.net, and Adyen), identity providers, electronic-signature providers (such as DocuSign), telehealth/video platforms accessed through meeting links, communications (email/SMS) providers, and EHR systems, for your convenience. We do not control third-party services and are not responsible for their availability, accuracy, content, or practices; your use of them is subject to their own terms and privacy policies. All disclaimers and limitations of liability in these Terms inure to the benefit of ABAVault's third-party service providers. We may discontinue integrations at any time. Unless expressly stated, we do not guarantee the accuracy of information provided by third parties (for example, insurance-payer eligibility responses).
We strive for high availability but do not guarantee uninterrupted or error-free operation. The Platform may be unavailable due to scheduled or emergency maintenance, cyberattacks, infrastructure failures, or causes beyond our reasonable control. Any uptime commitments applicable to your plan will be set out in a separate Service Level Agreement.
Your user ID, password, multi-factor factors, and access rights ("Security Credentials") must be kept confidential and not shared. You are responsible for all activity conducted using your Security Credentials, and must notify us immediately at support@abavault.com of any suspected unauthorized use.
We strive to make the Platform accessible consistent with general web content accessibility guidelines and will make reasonable efforts to provide information in alternative formats where required by law. If you encounter accessibility barriers, contact support@abavault.com.
THE PLATFORM IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT; WARRANTIES THAT THE PLATFORM WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE; AND WARRANTIES THAT MONITORING, KEYWORD FLAGGING, OR REVIEW TOOLS WILL DETECT ANY OR ALL CONCERNING COMMUNICATIONS (EXCEPT AS EXPRESSLY REQUIRED BY THE HIPAA SECURITY RULE OR AN APPLICABLE BAA).
The Platform provides assistive tools for practice management only. It does not provide medical, clinical, legal, accounting, billing, coding, or other professional advice, and does not substitute for the judgment of a qualified professional. Use of the Platform does not create a provider-patient or clinician-client relationship with ABAVault; ABAVault is a software provider and does not provide healthcare services. All clinical decisions, billing submissions, and regulatory compliance remain the sole responsibility of the Organization and its qualified professionals.
TO THE MAXIMUM EXTENT PERMITTED BY LAW, ABAVAULT AND ITS AFFILIATES AND SUPPLIERS WILL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, GOODWILL, DATA, OR BUSINESS OPPORTUNITIES, ARISING OUT OF OR RELATING TO THE PLATFORM, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE AGGREGATE LIABILITY OF ABAVAULT FOR ALL CLAIMS ARISING OUT OF OR RELATING TO THESE TERMS OR THE PLATFORM WILL NOT EXCEED THE TOTAL FEES PAID BY THE ORGANIZATION TO ABAVAULT IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM. The foregoing exclusions and cap do not apply to a party's gross negligence; willful misconduct; or fraud, and any separate limitation or super-cap in the Organization's master subscription agreement controls where applicable. We are not liable for delays or failures resulting from causes outside our control. Nothing in this Section limits liability that cannot be limited under applicable law. Some jurisdictions do not allow certain limitations, so parts of the above may not apply to you.
You agree to indemnify, defend, and hold harmless ABAVault and its officers, directors, owners, agents, employees, contractors, affiliates, and licensors from and against third-party claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) to the extent arising from: your violation of these Terms or applicable law; Client Data you submit without lawful authority; your Organization's configuration or use of messaging, monitoring, keyword flagging, or message review, including a failure to provide legally required notices or obtain legally required consents; or your clinical decisions or billing submissions. This obligation does not apply to the extent a claim or loss is caused by ABAVault's breach, negligence, security failure, or violation of law. ABAVault will indemnify, defend, and hold harmless the Organization and its Authorized Users from third-party claims to the extent arising from ABAVault's breach of its confidentiality, privacy, or security obligations; its negligence or willful misconduct; or its violation of applicable law. Regulatory fines and penalties are included only to the extent legally indemnifiable and attributable to the indemnifying party.
You may cancel your subscription at any time via account settings or by contacting support@abavault.com; cancellation takes effect at the end of the current billing period, and no refunds are issued for unused portions unless required by law. We may suspend or terminate access, immediately and without prior notice to you, upon the occurrence of any one or more of the following events: (1) if you breach these Terms, (2) fail to pay fees, (3) pose a security, legal, or reputational risk, as determined by ABAVault in its sole and absolute discretion, or (4) as required by law. Upon termination your right to use the Platform ceases. A Client's subscription-termination rights and the disposition of Client Data are governed by the Client's master subscription agreement and the BAA, including applicable export, return, deletion, backup-cycle, and certification requirements. Sections that by their nature should survive, including 6, 7, 9, 10, 13, 14, 16, and Part II, will survive.
Before filing any formal claim, you agree to contact us at legal@abavault.com and allow 30 days to attempt an informal resolution. Nothing limits either party's ability to seek injunctive or equitable relief for intellectual-property or confidentiality matters.
We may modify these Terms from time to time. When we make material changes, we will notify you by email to the address on file and/or by a prominent notice within the Platform at least 30 days before the changes take effect, and you may be required to review and accept the updated Terms within the Platform. Continued use after the effective date constitutes acceptance; if you do not agree, you must stop using the Platform before the effective date.
These Terms may be accepted electronically. Your electronic acceptance, clicking "Accept," checking an acceptance box, or typing your name, has the same legal effect as a handwritten signature under the federal E-SIGN Act and applicable state law. ABAVault records the accepted version, your typed name, and the date, time, IP address, and device information of acceptance. You may request a copy of these Terms that you can print, at no charge, by emailing support@abavault.com. Paper copies of documents your Organization asks you to sign are provided by your Organization.
This Agreement, together with any master subscription agreement, Order Form, Trial & Beta Addendum, and BAA signed by your Organization, is the entire understanding between you and ABAVault regarding the Platform. In a conflict, the BAA controls for PHI; the master subscription agreement and Order Form control for general commercial matters; and the Trial & Beta Addendum controls only for the applicable trial or beta, subject to the master subscription agreement and BAA. If any provision of this Agreement or of any of those documents is held invalid, it will be modified to the minimum extent necessary and the remainder will stay in effect. Our failure to enforce a provision is not a waiver. You may not assign this Agreement without our prior written consent; we may assign it in connection with a merger, acquisition, reorganization, or sale of assets.
How ABAVault Technologies LLC collects, uses, shares, and protects information.
This Privacy Policy explains how ABAVault Technologies LLC collects, shares, and uses information in connection with our public website (abavault.com) and the ABAVault platform, including the web application, mobile applications, family portal, administrative portal, and API. It applies to three groups of people, and works differently for each:
This Policy does not cover the privacy practices of third parties we do not own or control. It is governed by the laws of the State of Colorado and applicable federal law, and disputes will be resolved in the courts located in El Paso County, Colorado.
Customer Organizations, ABA therapy practices that are healthcare providers, and "covered entities" under HIPAA, use the Platform to manage client records, clinical data, scheduling, and insurance billing. Those records contain PHI. The Customer Organization, not ABAVault, controls those records. ABAVault processes PHI only on the Organization's behalf, as its business associate under a signed BAA, and only as needed to provide the contracted services described in a master subscription agreement and related order forms.
We use and disclose PHI only as permitted by the BAA and HIPAA; we do not sell PHI or use it for advertising or marketing; and we do not use PHI to train AI or machine-learning models. AI-assisted features are off by default and operate on the bring-your-own-provider basis described in Section 8.
A Customer Organization's Notice of Privacy Practices is provided by that organization, not by ABAVault. If any law governing PHI conflicts with this Policy, that law controls; if this Policy conflicts with a BAA regarding PHI, the BAA controls.
Website visitors. You can browse without providing personal information. If you submit a demo-request or contact form, we collect the details you provide (such as name, work email, phone, organization name, and size) to respond to your inquiry.
Platform users. When an Organization creates staff accounts, or you activate an invited account, we collect account and profile information such as your name, work email, phone, role and credentials, and, for staff, employment-related information your organization manages in the Platform (certifications, licensure, HR records, timesheets, and payroll-related data). Family portal users provide name, email, and authentication information.
Content entered into the Platform. Organizations and their users enter client records, clinical program data, session documentation, schedules, billing and insurance information, messages, files, and form responses. This content generally includes PHI and is handled as described in Section 19.
We and our service providers use cookies, browser storage, and similar technologies to collect usage information: Device Information (operating system, hardware model, browser type/version, and device identifiers); Log Information (IP address, configuration, dates/times, features used, and, for the Platform, audit-trail records of who accessed which record and when, as healthcare regulations require); and Location Information. We may estimate general location from your IP address. In addition, if you are a staff member and your organization uses the mobile app's clock-in/clock-out or session-verification features, the app collects your device's precise (GPS) location at clock-in and at clock-out, with your device-level permission, to verify attendance and support payroll and EVV requirements. The app also reads your location once when you open the Locations screen, to sort your organization's locations by distance from you; that reading stays on your device and is not sent to ABAVault. Location is read only while the app is open and is never tracked in the background.
We may receive limited information from third parties: authentication information from our identity provider; insurance eligibility, claim, and remittance information from payers and clearinghouses in connection with billing services; and contact or firmographic information about prospects from public or licensed business sources.
When something goes wrong in the Platform, the web app, the mobile app, or our servers send us a diagnostic report so we can find and fix the fault. These reports are limited by design to what identifies the defect, and our servers discard anything else they receive.
A report contains: which application the fault occurred in; the screen or route pattern where it happened, in the generic internal form (for example /clients/:id) rather than the address you were actually on, so that no client or record identifier is included; the error message and technical stack trace produced by the software; the version of the application you were running; the date and time; your user account and organization, so that we can follow up with the person who encountered the problem; and a short set of device details limited to platform, operating system version, application build, screen, and which part of the application caught the error.
Reports do not include the web address you were visiting, the contents of any form, search terms, the records displayed on your screen, or any client information. Where the same fault occurs repeatedly, we count it rather than storing a further copy.
Error messages and stack traces are produced by the software rather than typed by you, and are not intended to contain personal or health information. If we find that any does, we remove it. We use these reports only to diagnose and repair faults and to monitor whether the Platform is functioning correctly. They are stored on our own systems inside the same protected environment as the rest of your data, and are not sent to any third-party analytics or error-tracking service.
20.5 Biometrics
The mobile app lets you unlock it with Face ID, Touch ID, or a fingerprint if you choose. That check is done by your device, which tells the app only whether it succeeded. ABAVault does not collect, receive, or store any fingerprint, face scan, or other biometric identifier; the app keeps only a setting on your device recording that you turned the feature on.
We use the information we collect to:
We do not sell your personal information, and we do not share it for targeted or cross-context behavioral advertising. This applies to everyone covered by this Policy, and with particular force to PHI, which we never use for advertising of any kind.
The website and Platform use cookies and similar technologies for limited purposes: keeping you signed in and maintaining your session securely, distinguishing you from other users, remembering preferences, and measuring in aggregate how the site and Platform are used so we can improve them. Our analytics serve these operational purposes, not advertising profiles. Most browsers accept cookies by default; you can reject or delete them, but some parts of the Platform (particularly signed-in areas) may not function properly. Cookie choices are browser- and device-specific and may be lost if you clear your cache.
We share information only as described here:
In every case we require the receiving party to use your information only for the purpose for which it was shared, apply equivalent privacy and security restrictions, report incidents promptly, and delete or return the information when no longer needed, and we share only what is necessary for that purpose.
You can manage communications preferences and unsubscribe from marketing email using the "unsubscribe" instructions in any marketing message. Transactional and account messages (such as security notices or terms updates) are not marketing and may still be sent.
Text messages. ABAVault does not send text messages today. The Platform reaches you in the app, by push notification if you have the mobile app installed, and by email. If text messaging is added in future, we will ask for your consent before sending anything and tell you what the messages cover. Consent will never be required to use the Platform, you will be able to opt out at any time by replying STOP, and message and data rates may apply. Until you are asked and agree, ABAVault will send you no text messages.
We maintain administrative, physical, and technical safeguards designed to comply with applicable law, including the HIPAA Security Rule, encryption in transit (TLS) and at rest (AES-256), role-based access controls, multi-factor authentication, audit logging, workforce confidentiality and security training, periodic risk assessments and security testing, vulnerability management and remediation, incident-response procedures, and backups and recovery testing. We limit access to sensitive information to personnel who need it. These safeguards are designed to reduce risk but cannot guarantee perfect security.
If ABAVault discovers actual or reasonably suspected unauthorized access, use, acquisition, disclosure, loss, or material compromise involving Client Data, we will notify the affected Customer Organization promptly and, where legally permitted, no later than 72 hours after discovery. We will provide rolling updates, preserve relevant evidence, cooperate with investigation and legally required notifications, mitigate harmful effects, and provide a root-cause and remediation summary when reasonably available. The Organization leads notices concerning PHI and Organization-controlled records. ABAVault will notify individuals or regulators directly only when legally required, after coordination with the Organization where permitted. For more information about how your Organization handles breaches of workforce PHI and your rights under HIPAA, contact your Organization's privacy officer or human resources representative.
Information we maintain is stored in the United States; if you access the Platform from outside the U.S., you agree your information will be transferred to and processed in the U.S. We retain Organization-controlled records according to the Organization's documented instructions, applicable agreements, and legal requirements. During any permitted retention, use and access remain restricted, and we will provide deletion certification to the Organization upon reasonable request.
For questions about security, please contact us at security@abavault.com.
The website and the staff-facing Platform are meant for adults, and portal accounts may only be activated by adults. We do not knowingly collect personal information directly from children under 13, consistent with COPPA. Separately, the Platform stores health records about children because Customer Organizations provide ABA therapy to children, pursuant to authorization by such children's guardians or other legal representatives; those records are PHI entered and controlled by the child's healthcare provider (not collected by us directly from children) and are protected under HIPAA and Section 19, not COPPA. Parents or guardians with questions about a child's records should contact the practice that provides care. If you believe a child under 13 has provided personal information directly to us, contact us marked "COPPA Information Request" and we will delete it.
Depending on where you live, U.S. state privacy laws (such as the Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq.) may give you rights over personal information we hold as a business, such as website-visitor, marketing, and account information. These rights generally do not apply to PHI or records we process on behalf of a Customer Organization; those are governed by HIPAA, and requests should go to your Organization, and we will assist it as required by applicable law and our agreements. Subject to applicable law, your rights may include: notice/access, deletion, correction, a portable copy, and the right to opt out of "sale," "sharing," targeted advertising, and certain profiling, though, as noted, we do not sell personal information or process it for targeted advertising. We do not discriminate against you for exercising your rights. Authorized agents may submit requests subject to legally permitted verification of their authority, and where required you may appeal a declined request and receive instructions for contacting the appropriate state regulator if the appeal is denied.
To submit a request or raise a complaint, email privacy@abavault.com. We will use information reasonably necessary to verify your identity or an authorized agent's authority, respond within the period required by applicable law (generally 45 days, with notice of any permitted extension), and process appeals within the applicable statutory period.
Records your Organization controls. Much of the information about you in the Platform, such as session records, timesheets, and HR records, is entered and controlled by your Organization, and ABAVault holds it as your Organization's service provider and, where it is PHI, as its business associate. If you ask ABAVault to access, correct, or delete information of that kind, we will refer your request to your Organization, and we will not change a record your Organization controls on your request alone. Within the Platform, changes to your own profile information are submitted as requests that your Organization approves, adjustments to session times are limited to supervisory roles your Organization designates, and those changes are recorded in the activity log.
If you have questions about these Terms or this Privacy Policy, contact us:
Accessibility and alternative formats: support@abavault.com
By clicking "Accept" (or an equivalent button or checkbox) and using the Platform, you agree to be bound by these Terms of Service and this Privacy Policy. This document was prepared as Version 0.50.