Updated agreement effective September 11, 2026 at 12:00 PM Mountain Time (18:00 UTC). Current and previously accepted versions remain available in BxConnect’s legal settings.

BxConnect Privacy Policy

BxConnect, LLC ("BxConnect," "we," "us") operates the BxConnect platform — our web application, mobile applications, and related services (the "Service"). This policy explains what information we process, why, who we share it with, and the rights available to you. Because BxConnect serves three very different audiences, which rules protect your data depends on how you use BxConnect — Section 1 tells you which sections apply to you.

1. Who this policy covers — and which rules apply to you

Clinic users (CLINIC organizations). Patient data your clinic records is protected health information (PHI) under HIPAA. BxConnect processes it as a Business Associate under the Business Associate Agreement your organization executed; that agreement and HIPAA govern, and they control over this policy if they conflict. Your clinic — not BxConnect — decides how patient data is used. Patients: direct privacy questions and rights requests (access, amendment, accounting of disclosures) to your provider; we support your provider in fulfilling them.
School users (SCHOOL organizations). Student data your school records consists of education records governed by FERPA, processed under the Student Data Privacy Agreement, with BxConnect acting as a "school official" under the school's direct control. We do not sell student data, use it for targeted advertising, or build student profiles beyond the contracted purpose. Parents and eligible students: direct inspection, review, and correction requests to the school; we support the school in fulfilling them.
Family/individual users (HOME organizations). The data you record is consumer health data — not HIPAA PHI — protected by this policy, by the separate Privacy & Health Data Consent you accepted, and by state consumer-health-privacy laws (e.g., Washington's My Health My Data Act). You exercise your rights directly with us (Section 7).
BxConnect staff (ADMIN organizations). Internal use, governed by BxConnect's internal policies and the Terms.

2. Data we collect

Account and identity data — name, email address, role and permissions, and authentication records. Your password is held by our identity provider — Amazon Cognito (an Amazon Web Services service) or, until our sign-in migration completes, Okta, Inc. (Auth0) — and BxConnect does not store it (Section 4.1).
Organization data — organization name, type, contact details, and address.
Health, behavioral, and educational data entered by users — patients'/students'/ family members' behavioral observations, data points, sessions, goals, behaviors, ABC charts, incidents, and notes. This is the sensitive core of the Service; the rules of Section 1 govern it.
Billing data — subscription and payment records processed by Stripe. Payment card details go directly to Stripe; we keep patient, student, and family health data out of Stripe by design.
Technical and usage data — IP addresses, device/browser information, and security and audit logs.
Agreement-acceptance evidence — the exact text and version of each legal agreement accepted, who accepted it, when, and from where (IP/user agent), retained at least six (6) years and surviving account deletion, as legal evidence of execution.
Notification and delivery data — the notification preferences you set, the notification records shown in your in-app inbox, device push-registration tokens, and delivery records for push and email (including whether a message bounced or was reported as spam). For bounce and spam-report records, we keep a keyed cryptographic hash of the address rather than the address itself (Section 5.7).

3. How we use data

We use data to: provide and operate the Service; enforce security, tenant isolation, and auditing; provide support; administer subscriptions and billing; meet legal obligations; communicate service notices; and deliver the notifications you choose to turn on (Section 4.5). We do not: sell health or student data; use it for advertising; or use identifiable health or student data to train artificial-intelligence models. We may use de-identified or aggregated data that does not identify any person or organization to analyze and improve the Service, subject to the stricter limits of the BAA and Student Data Privacy Agreement where they apply, and we do not attempt to re-identify it.

4. How data is shared

Subprocessors. Amazon Web Services, Inc. processes data for us — cloud hosting and storage, sign-in and identity (Amazon Cognito), account and notification email delivery (Amazon Simple Email Service), and email delivery-event reporting (Amazon Simple Notification Service) — under contracts restricting its use of it; for clinic PHI, it operates under a business associate agreement. Sign-in migration: we are moving sign-in from Okta, Inc. (Auth0) to Amazon Cognito. During the transition both providers process account identity and authentication information: we transfer account identity information (name, email address, verification status) to Cognito and existing users set a new password; Auth0 may continue to support existing sessions and older app versions until it is retired. We will update this list when Auth0's processing and retention end. Stripe, Inc. processes payments — billing data only, never health data.
At your organization's (or your) direction. Cross-organization access happens only through the Service's assigned-user model, controlled by the data-owning organization (or by you, for HOME accounts).
Legal process. We disclose data when required by law (e.g., a valid subpoena or court order) and will notify the affected customer unless legally prohibited.
Business transfers. In a merger, acquisition, or asset sale, data remains protected by this policy and the governing agreements; we will provide notice of any change in control.
Notification transports. Optional activity alerts and summaries outside the app are off until you turn them on, and you control each channel in the app's notification settings. We omit patient, student, and family-member names, clinical content, and organization names from everything that leaves the app; the details are available only through authenticated access to the Service.
- Push notifications. If you turn on push, we send an opaque identifier and fixed, generic text (identical for every notification) through Apple Push Notification service and Google Firebase Cloud Messaging. Those providers process device and installation identifiers and delivery information, including the fact that your device receives BxConnect notifications and when. They are not business associates.
- Email notifications. If you turn on email, we send messages from a bxconnect.net address through Amazon Simple Email Service. Each message carries one of two fixed, generic subject lines (immediate alert or summary) and either a generic sentence or a count of new updates. Your email provider, and anyone with access to your inbox, can see that you use BxConnect and how often you receive alerts. Every message carries a one-click unsubscribe that stops all optional notification email; notification email is never used for marketing.
- Essential communications. These choices control optional alerts and summaries only. We separately send account verification, password-reset, security, billing, and legally required communications needed to operate your account or meet legal obligations; unsubscribing from optional notifications does not stop those.

We have no third-party advertising, ad-tech, or data-broker relationships, and we do not use third-party analytics on pages or screens that handle health or student data.

5. Data retention & deletion

Active accounts. We retain data while the account or organization is active. If a subscription is canceled without a deletion request, the account and data are retained so you can reactivate by resubscribing; to remove your data, use the account-deletion process below.
Requesting deletion. You can delete individual records in the app at any time. To delete your whole account, either (a) in the web app, go to Settings → Delete account, or (b) use our account-deletion page or email support@bxconnect.net from the email registered to your account (do not include patient information in the email).
What happens when you request deletion. Your account access ends immediately and you are signed out everywhere. A 30-day grace period follows, during which the deletion can still be canceled — contact support from your registered email before the cancellation deadline (5 days before the scheduled deletion date), quoting the request ID shown when you submitted it. After the grace period, your data is deleted from production systems (typically within one day), and backup copies are removed from our own backup systems within 7 days after that. Where a delivery provider holds a routing identifier for you (a push installation identifier at Apple/Google, or a suppressed address at Amazon SES — Section 5.7), we stop using it immediately and request its removal, but the provider's own retention schedule applies to its copy.
What is deleted, and what is retained.
- Personal and HOME accounts: the account, all patients, and all data are permanently deleted, subject only to the "Always retained" items below and Sections 5.5 and 5.7.
- Clinic and school accounts: your login, contact details, and profile are deleted; clinical or education records you authored — including your name as their author — are retained by your organization as part of its records, as healthcare and education record-keeping require. Return/destruction of clinic PHI and school student data otherwise follows the BAA and Student Data Privacy Agreement respectively.
- Always retained: routine encrypted backups (which expire in the ordinary course); records we are legally required to keep; and agreement-acceptance evidence (Section 2.6), kept at least six (6) years.
Records of disclosures. Where clinic or school records were made available to a user (including you), we retain a limited record of that disclosure — the recipient's name and email, what was disclosed, when, and on what basis — for as long as law and our agreements with the record-owning organization require (generally six years for clinic records; for school records, as long as the related education records). These compliance records survive account deletion, are encrypted, and are used for no other purpose. For records in Personal and HOME accounts (family-owned data), no such records are kept after account deletion; a record that a clinic or school made its records available to you is kept under this Section even if your own account was a Personal or HOME account. For the same clinic and school records we also keep the history of who was assigned to a patient or student and when that assignment ended, and evidence of what we attempted to deliver by push or email and whether it was sent; these are kept for security and compliance purposes on the same retention basis as the record-owning organization's records, and are not a statement that every such row is required by statute.
Organization data export. Export is available before termination and for thirty (30) days after, after which data is deleted in the ordinary course.
Email deliverability records. If email to your address bounces, or you report one of our messages as spam, we keep a keyed cryptographic hash of the address, the reason, and the date in our application so that we stop sending optional notification email to it. The hash is not the address, but we can match it to an address using a separately protected key, so it is pseudonymous rather than anonymous. Amazon SES also keeps suppressed addresses on its own account-level suppression list. We use these records only to enforce the delivery restriction and to show you the delivery status of your own address; we keep them for the period in our retention schedule, including after account deletion so the same address is not emailed again, subject to any deletion right applicable law gives you. A spam report turns optional email notifications off for the account permanently.

6. Security

Safeguards include: encryption of data in transit (TLS) and at rest, with column-level encryption of designated sensitive fields; tenant isolation enforced by PostgreSQL row-level security; authentication through a dedicated identity provider; tiered, role- and permission-based access controls (including per-patient assignment); audit logging; and least-privilege internal access. No system is perfectly secure; we describe our safeguards, and we do not promise that breach is impossible. If a breach occurs, we will notify affected parties as required by applicable law — HIPAA's Breach Notification Rule (through the affected clinic) for PHI, state law and contract for student data, and state law plus the FTC Health Breach Notification Rule for consumer (HOME) health data.

7. Your rights

Clinic patients: exercise HIPAA rights (access §164.524, amendment §164.526, accounting of disclosures §164.528) through your provider; we support your provider under the BAA.
School parents/eligible students: exercise FERPA inspection, review, and correction rights through your school; we support the school under the Student Data Privacy Agreement, including its disclosure-log and export commitments.
HOME users: you may access, export, correct, and delete your data, and withdraw consent, directly with us — in the app or via support@bxconnect.net — as described in the Privacy & Health Data Consent. We respond within the time your state's law requires (and in any case within 45 days), we do not discriminate against you for exercising rights, and you may appeal a denial by replying to our response.

8. Children's privacy

BxConnect accounts are held by adults (18+). We do not knowingly collect information directly from children. Information about children is entered and controlled by the responsible adults: by clinics (under HIPAA and parental/guardian consent obtained by the provider), by schools (which may consent on parents' behalf for the educational context under COPPA's school-consent framework), and by parents/guardians themselves for HOME accounts (whose consent under the Privacy & Health Data Consent is the verifiable parental consent where COPPA applies).

9. State-specific notices

Washington (My Health My Data Act): HOME-user health data is "consumer health data"; our collection and sharing practices, your rights, and how to exercise them are described in Sections 2–7 and the Privacy & Health Data Consent. We do not sell consumer health data and do not process it for advertising; we will not collect or share it for purposes beyond those consented to without a new, separate consent.
California: we do not "sell" or "share" (for cross-context behavioral advertising) personal information as the CCPA/CPRA defines those terms. California users may exercise access, correction, deletion, and portability rights per Section 7. Student data is additionally protected by SOPIPA: no targeted advertising, no profiling beyond the educational purpose, no sale.
New York (Education Law §2-d): for New York schools, the rider mechanics of the Student Data Privacy Agreement supply the required Parents' Bill of Rights and Data Privacy & Security Plan supplements before onboarding.
Other states: where another state grants you privacy rights in health or student data, we honor them per Section 7's mechanics.

10. Changes to this policy

This policy is versioned and published through BxConnect's agreement-document system; each version is immutable and the full history is retained. For material changes we provide email and in-app notice before the new version takes effect. Because this policy is a notice, changes to it do not trigger the acceptance gate — but material changes to the agreements that incorporate it (Terms, consent, BAA, SDPA) do require re-acceptance through the gate.

11. Contact

BxConnect, LLC — support@bxconnect.net. We respond to privacy inquiries within ten (10) business days.