Legal

Privacy Policy

Effective date: September 22, 2026

AbaVista, LLC ("AbaVista", "we", "us") makes practice-management software for applied behavior analysis (ABA) providers. This policy explains what information we collect from the people who use our website and our software, how we use it, and the choices you have.

1. Who this policy covers

This policy covers:

• Visitors to abavista.com, including anyone who requests a demo.
• Staff users: employees and contractors of an ABA practice (a "Practice") who sign in to the AbaVista application.
• People a Practice adds to AbaVista: job applicants a Practice tracks in its hiring pipeline, and staff whose details a Practice imports from its payroll, scheduling, or task systems.
• Prospects and business contacts we correspond with.

If you are a parent, patient, or family member of a Practice's client, this policy does not cover your information. The Practice you are working with controls that information, including anything you enter into an intake form, a chat, a consent form, or a message to the Practice through AbaVista, and anything the Practice's connected email and phone systems bring in. We process it only on the Practice's instructions, as its business associate under the Health Insurance Portability and Accountability Act (HIPAA) and a Business Associate Agreement. For questions about that information, or to exercise any rights over it, contact your Practice directly. Its Notice of Privacy Practices governs.

Two things do happen on our side when you use a Practice's intake form, chat, or signing page: our servers record the request, including your IP address, in the security logs described in Section 2, and your browser contacts Google to load fonts and, on address fields, to suggest addresses as you type. We do not run usage analytics on those pages.

2. Information we collect

Account and profile information. When a Practice creates your staff account we receive your name, work email address, role, and phone number. If you sign in with Google or Microsoft, we store the profile the provider returns at sign-in. From Google that is your name, email address, profile picture, language, and Workspace domain. From Microsoft it is your name, email address, job title, business and mobile phone numbers, office location, preferred language, company name, and Microsoft account and directory identifiers.

Information a Practice imports about its staff. A Practice can import staff records from its own systems: Viventium (payroll and HR), CentralReach (scheduling), and ClickUp (task boards). We receive the fields the Practice maps, typically name, contact details, role, credentials, license and certification numbers, and employment dates. A Practice that tracks hiring in AbaVista also stores applicant details it collects.

Connected mailboxes. A Practice can connect Google Workspace or Microsoft 365 so that email with families lands in the right client record. Here is exactly what that involves.

• Google. Each staff member connects their own Gmail account. We request the gmail.readonly and gmail.send permissions, plus openid, email, and profile, with offline access, and we store the refresh token so the connection keeps working when you are signed out. On an ongoing basis we retrieve and store messages from your Inbox and Sent folders. Messages exchanged with a client's family or contacts are attached to that client's record, where other staff at your Practice can see them. Other messages are stored but not attached to any record and are not shown to other users. Gmail notifies us of new mail through Google Cloud Pub/Sub.
• Microsoft. The Practice's Microsoft 365 administrator grants AbaVista an organization-level application permission. Using it, we read the Inbox and Sent folders of only the mailboxes the Practice puts on its allowlist, through Microsoft Graph and its change notifications, and attach messages the same way. Separately, signing in with Microsoft requests the Mail.Send and offline_access permissions so that the signed-in user can send mail from AbaVista.
• Sending for others. A Practice can designate one connected mailbox as its default outbound sender. That mailbox then sends intake invitations, records requests, and other family mail on behalf of staff who cannot send from their own account.
• Disconnecting. A Practice administrator can disconnect the mailbox integration for the whole Practice from Settings. When that happens we stop syncing. The Google and Microsoft tokens we hold stay stored, unused, until the Practice's data is deleted under Section 8; messages already synced remain part of the Practice's records until then. To withdraw AbaVista's access to your account itself, revoke it from your Google Account permissions page or your Microsoft account settings.

How we handle Google user data. AbaVista's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Gmail data only to provide the mailbox features described above; we do not use it for advertising; we do not use it to develop, improve, or train generalized artificial-intelligence or machine-learning models; and no person at AbaVista reads it except with your consent, to provide support you have asked for, for security or abuse investigation, to comply with law, or in aggregated form for internal operations.

Connected phone systems. A Practice can connect its RingCentral account so that calls and text messages between staff and families appear in the client's record, and its RingCentral or Zoom Phone account so that AbaVista can send the text messages the Practice configures. For calls we receive only the phone numbers, direction, timestamps, and duration, never a recording or transcript. For text messages we receive the numbers, timestamps, and message content. This is Practice data.

Usage information. When you use the signed-in application we record which pages and features are used and the actions taken, tied to your staff account and your Practice, using PostHog. In the browser we do not record your screen or session, text on the page is masked before it is sent, and we honor the browser "Do Not Track" setting. Our servers also send PostHog a small set of product events (for example, that a lead was created) keyed to your user id, and error reports tagged with your user and Practice; those are not affected by the browser setting. When you sign in, we send PostHog your email address, name, and role so that activity is readable by person. We do not run PostHog on the parent-facing intake, chat, form, or signing pages.

Access and audit logs. For every authenticated request we log your user account, email address, name, Practice, the path and method, the response status, the time, your IP address, and, if an AbaVista staff member was signed in as you, their identity. Every change made in the application is recorded with the account that made it and is visible to staff at your Practice who can view the affected record. These records exist to meet HIPAA's access-logging requirements and to investigate security incidents.

AI request traces. When you use an AI feature, the request and response text is recorded in our application traces in AWS so we can diagnose problems. Those traces can contain whatever you or the feature put in the conversation, including Practice data.

Platform support access. AbaVista staff can sign in to the application as any staff user to reproduce a problem or provide support. Every such session is recorded in the audit log with the AbaVista staff member's identity, and the access-log entries it produces carry both identities.

Demo requests and correspondence. If you request a demo on our website we collect your name, practice name, email address, phone number, and anything you write in the message box. If you email or call us, we keep the correspondence.

Billing. When a Practice subscribes, payment details are collected and stored by Stripe, our payment processor. We store the Stripe customer and subscription identifiers, plan, seat count, billing period, and payment status, not the card number or a billing contact.

We do not buy information about you from data brokers, and we do not collect information from advertising networks.

3. How we use information

We use the information above to:

• Provide, secure, and support the AbaVista service.
• Send transactional email about your account, such as invitations, notifications you have enabled, and security alerts.
• Respond to demo requests and other inquiries.
• Understand which features are used so we can improve the product.
• Detect, investigate, and prevent abuse, fraud, and security incidents.
• Meet our legal, contractual, and HIPAA obligations, including keeping audit records.
• Bill Practices for the service.

We may send occasional product-update email to staff users and to people who have asked about AbaVista. Every such message includes an unsubscribe link.

4. AI features

Some features use large language models to draft messages, summarize records, answer staff questions, and hold lead-capture conversations. The models run on Google Cloud Vertex AI, with Amazon Bedrock available as an alternative, each under a Business Associate Agreement with the provider. Voice dictation uses Amazon Transcribe. Prompts and responses are not used to train any model. We do not send production data to any AI provider that has not signed a Business Associate Agreement with us.

5. How we share information

We do not sell personal information, and we do not share it with advertisers. We share information only with:

• The Practice you belong to. Your Practice's administrators can see your profile, your activity within the application, and communications you send through it.
• Service providers that host or operate parts of the service on our behalf, listed in the first table below. Each is bound by contract to use the information only to provide its service to us, and each that can touch Practice data has signed a Business Associate Agreement with us.
• Systems the Practice connects, listed in the second table. Those are the Practice's own vendors, under the Practice's own agreements, and we send or receive data through them only as the Practice configures.
• Professional advisers and authorities when required by law, legal process, or to protect the rights, safety, or property of AbaVista, our customers, or others.
• A successor in a merger, acquisition, or sale of assets, under this policy or one at least as protective.

Service providers we use

Systems a Practice may connect

6. Cookies and browser storage

The application uses cookies that are strictly necessary to keep you signed in and to protect against cross-site request forgery, and PostHog sets a cookie in the signed-in application to recognize your browser across visits. The application also keeps interface preferences in your browser's local storage. The chat widget a Practice embeds on its website keeps the chat session in your browser's session storage on that site. We do not use advertising or cross-site tracking cookies. If you block cookies in your browser, you will not be able to sign in.

7. Security

We encrypt information in transit and at rest, limit access by role, keep the audit and access logs described above, and require multi-factor authentication for password sign-in where a Practice enables it (sign-in through Google or Microsoft is governed by those providers' policies). No system is perfectly secure. If we learn of a breach affecting your information we will notify you and your Practice as the law and our agreements require.

8. Retention

• Practice data, including staff account information, is kept while the Practice's subscription is active. For 30 days after it ends the Practice can ask us for an export; after that we delete or de-identify the data in our live systems. Encrypted database backups expire 90 days after they are taken.
• Trial (sandbox) Practices are deleted when the trial ends.
• Access logs are kept for one year in our operational logging and for seven years in a locked archive. Audit records of changes are kept for at least seven years, which exceeds HIPAA's six-year requirement.
• AI request traces and error reports are kept for a limited period for diagnostics.
• Demo requests and correspondence are kept for as long as we have a business reason to keep them.
• Information about families is Practice data and is returned or destroyed according to our agreement with the Practice.

9. Your choices and rights

• Access and correction. You can view and edit your profile in Settings. For anything else, email us at the address below.
• Connected accounts. A Practice administrator can disconnect the mailbox and phone integrations from Settings. You can revoke AbaVista's access to your own Google or Microsoft account at any time from that provider's account settings.
• Marketing email. Use the unsubscribe link in any message.
• Analytics. Enable "Do Not Track" in your browser to stop browser usage events. Server-side product events continue while you use the application.
• Deletion. Ask your Practice administrator to deactivate your account, or email us. Deactivation blocks sign-in; deletion or de-identification of your information is done by request, subject to the audit and legal retention above.

Residents of California and other U.S. states with privacy laws may have additional rights over their personal information. We do not sell or share personal information for advertising. To exercise a right, email us; if your request concerns information a Practice holds about you, we will forward it to the Practice, which controls that information.

10. Children

The application and website are intended for adults working at or with ABA practices. We do not knowingly collect personal information directly from children under 13. Information about children who receive services from a Practice is Practice data covered by Section 1.

11. Where information is processed

AbaVista is based in the United States and processes information there. We do not currently offer the service outside the United States.

12. Changes to this policy

We will post any changes here and update the effective date. For material changes we will also notify staff users in the application or by email. Our Terms of Service govern use of the service; this policy describes our practices.

13. Contact

AbaVista, LLC
2379 Forest Circle
Toms River, NJ 08755
hello@abavista.com