Privacy Policy

    Last updated: April 2026

    1. Introduction

    SessionABA ("we," "our," or "us") is committed to protecting the privacy and security of your information. This Privacy Policy describes how we collect, use, store, and share information when you use our ABA practice management platform.

    2. HIPAA Compliance

    SessionABA is designed to be fully HIPAA-compliant. We implement administrative, physical, and technical safeguards to protect Protected Health Information (PHI). We execute Business Associate Agreements (BAAs) with all covered entities.

    3. Information We Collect

    We collect information you provide directly: account information (name, email, role), client data entered during sessions, session notes and behavioral data, billing and authorization information, and usage data to improve our services.

    4. AI-Generated Content

    Our AI features generate session notes from data you collect. AI-generated content is always reviewed by qualified professionals before finalization. We do not use your client data to train AI models. All AI processing occurs within our HIPAA-compliant infrastructure.

    5. Data Sharing

    We do not sell your data. We share information only with: authorized members of your clinic, service providers under BAAs, and as required by law. Parent portal access is controlled by your clinic's settings.

    6. Security

    We use end-to-end encryption for data in transit and at rest, role-based access controls, audit logging of all data access, regular security assessments, and SOC 2 Type II compliance procedures.

    7. Data Retention

    We retain client data for the duration of your subscription and as required by applicable healthcare regulations (typically 7 years for medical records). You may request data export or deletion at any time, subject to legal retention requirements.

    8. Parent Portal

    Our parent portal allows families to view progress reports and session summaries shared by the clinic. Access is controlled entirely by the treating BCBA and clinic administrators.

    9. Children's Privacy

    Our platform is used by healthcare professionals to provide services to children. All children's data is protected under HIPAA and applicable state laws. We do not collect information directly from children.

    10. Your Rights

    You have the right to: access your data, request corrections, request deletion (subject to retention laws), receive a copy of your data in a portable format, and opt out of non-essential communications.

    11. Changes to This Policy

    We may update this policy from time to time. We will notify you of material changes via email and in-app notification at least 30 days before they take effect.

    12. Contact Us

    For privacy-related inquiries, contact us at privacy@sessionaba.com or by mail at SessionABA, Minneapolis, MN 55401.