Privacy Policy

1. Introduction

Therapist Genie (“Therapist Genie,” “we,” “us,” or “our”) provides an electronic health record, practice management, billing, scheduling, messaging, and AI-assisted workflow platform for wellness, behavioral health, and other healthcare-related providers.

We are committed to protecting the privacy and security of personal information, including protected health information (“PHI”) handled through our platform

This Privacy Policy explains how we collect, use, disclose, and protect information when you use our website, platform, integrations, SMS/text messaging programs, and related services

This Privacy Policy should be read alongside our Terms of Service.

When Therapist Genie processes PHI on behalf of healthcare provider customers, Therapist Genie acts as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). In those cases, our use and disclosure of PHI is governed by our Business Associate Agreements, customer agreements, and applicable law

This Privacy Policy is not intended to replace the Notice of Privacy Practices provided by your healthcare provider. If you are a patient and have questions about your medical record or HIPAA rights, please contact your healthcare provider directly

2. Scope and Applicability

This Privacy Policy applies to:

Healthcare providers, wellness professionals, administrative staff, and other authorized users of Therapist Genie

Patients whose information is stored, processed, or transmitted through Therapist Genie by a healthcare provider

Visitors to our website and individuals who request demos, pricing, support, or other information

Individuals who provide contact information through forms, account setup, onboarding, or opt-in processes

Users of Therapist Genie’s SMS/text messaging programs

Information processed through Therapist Genie’s AI-assisted features and third-party integrations

3. Therapist Genie’s Privacy Roles

Therapist Genie handles information in different legal roles depending on the context.

Business Associate: For provider customers that are HIPAA covered entities, Therapist Genie generally acts as a Business Associate when we create, receive, maintain, or transmit PHI on behalf of the provider customer

Service Provider or Processor: When Therapist Genie processes personal information on behalf of a customer, we process that information under the customer’s instructions, our agreements, and applicable privacy laws

Independent Business: When Therapist Genie collects information directly from website visitors, sales prospects, demo requesters, job applicants, or provider account users for our own business operations, that information may be handled as business contact information or personal information under this Privacy Policy

Provider Responsibility: Provider customers are responsible for their own privacy notices, patient relationships, user permissions, record-retention choices, and legal obligations that apply to their practices

4. Information We Collect

We may collect and process the following categories of information:

Protected Health Information (PHI): Patient demographics, contact information, medical history, clinical notes, intake forms, assessments, diagnoses, treatment plans, appointments, billing information, insurance information, claims information, medication records, lab results, wellness assessments, and other information entered into or processed through the platform by provider customers

Provider and Account Information: Names, professional credentials, business contact information, organization information, account credentials, user roles, preferences, authentication data, payment and billing contact details, and support communications

Website, Sales, and Marketing Information: Information you provide through website forms, demo requests, pricing inquiries, newsletters, events, support requests, or similar interactions, including name, email address, phone number, company, role, and communication preferences.

Mobile Phone Numbers and SMS Consent Data: Mobile phone numbers, opt-in status, communication preferences, consent language, date and time of consent, source or method of consent, and opt-out records.

Technical and Usage Information: IP address, device information, browser type, operating system, log data, session activity, referring pages, pages viewed, approximate location derived from IP address, and usage patterns

Integration Data: Information received through integrations you enable, such as Microsoft 365 Calendar data, OAuth tokens, refresh tokens, webhook subscriptions, appointment data, scheduling information, clearinghouse data, billing tools, or other connected services

AI Processing Data: Information processed through AI-assisted features, such as clinical documentation, appointment context, billing codes, claim data, scheduling data, communication drafts, workflow history, and other information needed to provide AI-assisted functionality

5. How We Use Information

We use information to provide, secure, improve, and support Therapist Genie’s services. Depending on the type of information and our role, we may use information for the following purposes:

To provide the Therapist Genie platform and related services

To support treatment, payment, healthcare operations, care coordination, billing, credentialing, scheduling, documentation, claims processing, and practice management

To create, manage, secure, and support user accounts

To provide AI-assisted features such as documentation suggestions, transcription support, treatment plan drafts, clinical workflow suggestions, billing code suggestions, claim support, scheduling support, and operational insights

To send appointment reminders, confirmations, follow-up messages, account notices, operational updates, and support communications

To communicate with provider customers, prospects, and account users about Therapist Genie products, services, events, updates, offers, and educational content, subject to applicable consent and opt-out rights

To analyze and improve website performance, product functionality, security, reliability, and user experience

To detect, prevent, investigate, or respond to fraud, abuse, security incidents, legal claims, or violations of our terms

To comply with applicable laws, regulations, contractual obligations, and legal process

We do not use PHI from the Therapist Genie EHR for advertising or third-party marketing. We do not sell PHI

6. Marketing and Business Communications

Therapist Genie may use business contact information from website visitors, demo requesters, prospects, provider customers, and account users to market Therapist Genie’s own products and services.

We may send information about product updates, demos, events, educational content, or offers that may be relevant to a provider or practice

We do not use patient PHI from the EHR for marketing unless permitted by HIPAA, authorized by the patient where required, or directed by the applicable provider customer in accordance with law

You may opt out of marketing emails by using the unsubscribe link in our emails or contacting us at privacy@therapistgenie.com

Even if you opt out of marketing messages, we may still send transactional, operational, security, legal, billing, or account-related communications

7. AI Processing and Machine Learning

Therapist Genie provides AI-assisted features to help providers and practices reduce administrative burden and improve workflows.

AI-assisted features may help draft notes, summarize information, suggest billing codes, generate workflow recommendations, support scheduling, or assist with operational tasks

AI-generated outputs are suggestions only. Healthcare providers remain responsible for reviewing, editing, approving, and using any AI-generated content

Therapist Genie’s AI features do not make autonomous decisions about patient care, diagnosis, treatment, billing, or insurance claims

When PHI is processed by AI-assisted features, Therapist Genie applies privacy and security safeguards consistent with HIPAA, applicable Business Associate Agreements, and our customer agreements

Therapist Genie may use non-Microsoft third-party AI infrastructure or service providers to provide AI-assisted features. When those providers process PHI, they must be bound by appropriate contractual, confidentiality, security, and Business Associate obligations where required in compliance with Microsoft sub-processor agreements

Therapist Genie does not use identifiable patient PHI from customer EHR records to train third-party foundation models unless expressly authorized in writing by the applicable customer and permitted by law

Therapist Genie may use de-identified or aggregated data to improve our services and AI-assisted functionality, using methods intended to satisfy HIPAA de-identification requirements, such as the Safe Harbor method or expert determination method where appropriate and permitted by law and applicable agreements

Authorized Therapist Genie personnel may review limited AI inputs, outputs, metadata, or error logs when necessary to provide support, investigate abuse or security issues, debug product functionality, or meet legal obligations, subject to access controls and confidentiality obligations

Organizational data hosted in Microsoft 365 is not used to train AI models and is used only to provide calendar synchronization functionality

8. Information Sharing and Disclosure

We may share information as described below:

With Provider Customers: We make patient information available to the healthcare provider or organization responsible for that information

With Authorized Users: We share information with users authorized by the provider customer or account administrator

With Service Providers and Subprocessors: We may share information with vendors that help us provide hosting, infrastructure, security, analytics, SMS delivery, email delivery, support, billing, claims, integrations, AI-assisted features, and other services. Where required, these vendors are bound by appropriate contractual, confidentiality, security, and Business Associate obligations

With Healthcare Participants: We may process or disclose information to support treatment, payment, healthcare operations, claims processing, eligibility, medical clearinghouses and billing service providers, care coordination, or other healthcare-related purposes as directed by provider customers or permitted by law.

With Legal or Regulatory Authorities: We may disclose information when required by law, court order, subpoena, regulatory request, or other legal process, or when necessary to protect rights, safety, or security, or to prevent fraud or abuse.

In Business Transactions: If Therapist Genie is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be disclosed or transferred as part of that transaction, subject to applicable law and contractual protections

With Consent or Direction: We may share information when you or the applicable provider customer directs us to do so or gives appropriate consent

We do not sell PHI. We do not sell mobile phone numbers or SMS consent data. We do not share patient PHI with advertisers

9. Cookies and Tracking Technologies

We use cookies, pixels, local storage, and similar technologies for limited operational, analytics, security, and marketing-attribution purposes.

We use these technologies to maintain session state and authentication, remember preferences and settings, secure the website and platform, analyze website traffic and product usage, improve performance and user experience, support marketing attribution for our own services, and detect fraud, abuse, or security issues

We do not use cookies or tracking technologies to serve third-party advertising based on patient PHI

We do not intentionally place third-party advertising pixels or cross-site advertising trackers on authenticated EHR, portal, intake, invoice, or care-delivery pages where PHI is displayed

Analytics tools used in authenticated product areas, if any, are configured for product performance, reliability, security, and usage measurement rather than advertising or third-party marketing

You can control cookies through your browser settings. Disabling certain cookies may affect website or platform functionality

10. Data Security

Therapist Genie uses administrative, technical, and physical safeguards designed to protect information, including PHI, personal information, mobile phone numbers, and SMS consent records.

Safeguards may include encryption in transit and at rest, role-based access controls, authentication and access management, audit logging and monitoring, least-privilege access practices, secure backups, network and infrastructure safeguards, vendor and subprocessor review, workforce training, incident response procedures, security reviews, vulnerability management, and physical safeguards provided by secure data center and cloud infrastructure providers

No system can be guaranteed to be completely secure. If you believe your information or account may have been compromised, contact security@therapistgenie.com immediately

11. Breach and Incident Notification

Therapist Genie maintains incident response procedures designed to identify, investigate, mitigate, and respond to security incidents.

If Therapist Genie discovers a breach of unsecured PHI or another incident requiring notification, Therapist Genie will notify affected provider customers, individuals, regulators, or other parties as required by applicable law, Business Associate Agreements, and customer agreements

When Therapist Genie acts as a Business Associate, we will notify the affected covered-entity customer without unreasonable delay and provide information reasonably needed for the customer to meet its own investigation, mitigation, and notification obligations, subject to the applicable Business Associate Agreement and law

12. Minimum Necessary and Access Controls

Where HIPAA’s minimum necessary standard applies, Therapist Genie is designed to support reasonable limits on access, use, and disclosure of PHI based on role, purpose, and customer configuration.

Provider customers are responsible for configuring user access, permissions, workflows, and account settings appropriate for their organization and legal obligations

13. Data Retention, Export, and Deletion

We retain information for as long as necessary to provide services, comply with legal and contractual obligations, resolve disputes, maintain security, enforce agreements, and support legitimate business purposes.

PHI and clinical records are retained in accordance with provider customer instructions, customer agreements, Business Associate Agreements, and applicable federal and state healthcare record retention requirements

Provider customers may request export, return, deletion, or termination handling of customer data as described in their customer agreement, Business Associate Agreement, and applicable law

Patients should contact their healthcare provider to request access, amendment, transfer, deletion, or other handling of medical records maintained by that provider in Therapist Genie

Account data is retained while an account is active and for a reasonable period thereafter

SMS consent and opt-out records are retained while the applicable account remains active and as needed for legal, regulatory, compliance, audit, security, and dispute-resolution purposes.

Website, sales, and marketing data is retained as needed for business, legal, and compliance purposes, unless deletion is requested and required by applicable law

Backup copies may persist for a limited period before being overwritten or deleted according to our backup lifecycle

14. Your Rights and Choices

Depending on your relationship with Therapist Genie and applicable law, you may have rights to access, correct, delete, restrict, or receive a copy of certain personal information.

If you are a patient whose information is maintained in Therapist Genie by a healthcare provider, please contact your healthcare provider to exercise HIPAA rights such as access, amendment, restrictions, accounting of disclosures, or complaints regarding your medical record. Therapist Genie will assist provider customers as required by applicable Business Associate Agreements and law.

If you are a provider, account user, website visitor, or sales prospect, you may contact privacy@therapistgenie.com to request access, correction, deletion, or opt-out of certain uses of your personal information.

You may opt out of marketing emails by using the unsubscribe link or contacting us.

You may opt out of SMS messages by replying STOP.

You may request deletion of mobile phone number and SMS consent records by contacting privacy@therapistgenie.com, subject to legal, compliance, and audit retention requirements.

15. U.S. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state privacy laws.

Depending on your state and the nature of the information, these rights may include the right to access, correct, delete, or receive a portable copy of personal information, and the right to opt out of certain processing such as sale, sharing, targeted advertising, or profiling with legal or similarly significant effects.

Therapist Genie does not sell PHI or mobile phone numbers. Therapist Genie does not share patient PHI for cross-context behavioral advertising or third-party marketing.

If Therapist Genie processes your information on behalf of a provider customer, we may refer your request to that provider or assist the provider in responding as required by law and contract.

You may submit privacy requests by contacting privacy@therapistgenie.com. We may need to verify your identity or authority before fulfilling a request.

We will not discriminate against you for exercising applicable privacy rights.

16. Children’s Privacy

Therapist Genie’s website, platform, and SMS programs are not directed to children under 13, and our SMS program is intended for individuals 18 or older.

Because Therapist Genie is used by healthcare providers, patient records may include information about minors when entered or managed by a provider customer. In those cases, Therapist Genie processes the information on behalf of the provider customer under applicable agreements and law.

If you believe information has been submitted to Therapist Genie improperly, contact privacy@therapistgenie.com.

17. Sensitive Health Information

Therapist Genie may process sensitive health information on behalf of provider customers, including behavioral health information, mental health records, substance use-related information, reproductive health-related information, or other categories subject to special legal protections.

Provider customers are responsible for determining which laws apply to their practice and configuring their use of Therapist Genie accordingly.

Therapist Genie supports privacy and security safeguards for sensitive information as required by applicable agreements and law.

18. International Users

Therapist Genie is operated from the United States and is primarily intended for use by U.S.-based healthcare providers and organizations.

If you access Therapist Genie from outside the United States, your information may be processed in the United States or other jurisdictions where our service providers operate.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements, or business practices.

When we make material changes, we may notify users by updating the Last Updated date, posting notice on our website, sending an email, or providing an in-platform notice.

Your continued use of Therapist Genie after an updated Privacy Policy becomes effective means you acknowledge the updated Privacy Policy.

Questions? Email privacy@therapistgenie.com