Caregiver App Privacy Policy

Effective 25 October 2026 · Last updated 25 October 2026

This policy applies to accounts connected to a BCBA or clinic. Your clinician or clinic controls your child’s clinical record and FlourishBx handles it on their behalf, so requests about that record go to them. If nobody is connected to your account, the free-account policy applies instead.

Accounts Connected to a Provider

FlourishBx LLC d/b/a FlourishBx

Effective Date: 25 October 2026 Last Updated: 25 October 2026 Version: 3 Applies to: the FlourishBx Caregiver App for parents and caregivers, on iOS and Android, when a BCBA, therapist, or clinic is connected to your account.

WHICH POLICY APPLIES TO YOU

FlourishBx has two privacy policies for this app, because there are two very different situations and they deserve different answers.

This one applies to you if a provider is connected to your account — a BCBA, therapist, or clinic invited you, or you connected one yourself. They control your child's record, and this Policy explains what that means for you.

The other one applies if you set the app up on your own and no provider is connected. It is the FlourishBx Caregiver App Privacy Policy — Free Accounts, at https://getflourishbx.com/app-privacy-free.html. On a Free Account there is no clinician, FlourishBx holds your child's information directly, and the answers in Article 5 below are different.

Not sure which you are? Open Settings in the app. If it shows a provider, this Policy is yours. If it does not, the other one is.

NOTICE TO THE READER

This App holds health information about a child. This Policy explains what FlourishBx collects, who can see it, what FlourishBx will never do with it, and who to ask when you want something changed or removed.

It is not the FlourishBx website privacy policy, which covers getflourishbx.com and no health information. It is not the Clinician Dashboard policy, which covers the product your child's BCBA uses. It is not your clinician's Notice of Privacy Practices — they give you that separately, and it governs their handling of your child's record, not ours. And it is not the Free Account policy, which governs the app when no provider is connected.

THE SHORT VERSION (NON-BINDING)

Given for convenience. Where it differs from Articles 1 through 24, those Articles govern. See Section 23.9.

  • The App is free and stays free. No paid tier for families, no advertising, no upsell.
  • We never sell your information or your child's. Not identified, not de-identified, not ever. Article 10.
  • We do not use your child's information to train artificial intelligence. Section 10.2.
  • The App never asks for your camera, microphone, photos, or location. Article 7.
  • Reminders are built on your phone. No push token, no notification service, nothing sent to us. Article 6.
  • Your child's clinician reads everything you log. That is the point. Section 8.2.
  • Other caregivers do not. Each caregiver sees only their own logs. Section 8.4.
  • Your child's clinical record belongs to their clinician, not to us. We hold it for them. Article 5.
  • You can close your account whenever you want. Article 19.
  • If your provider discharges your child, the other policy may take over. Section 1.6.

ARTICLE 1 — WHO WE ARE AND WHAT THIS POLICY IS

1.1 The company

The FlourishBx Caregiver App is provided by FlourishBx LLC ("FlourishBx," "we," "us," "our"), a limited liability company organized under the laws of the State of North Carolina, with its principal place of business in North Carolina.

1.2 We make software; we are not a health care provider

FlourishBx does not provide therapy, diagnosis, treatment, clinical advice, or supervision, and does not employ or oversee anyone who does. FlourishBx is not a "health care provider" within the meaning of 45 C.F.R. § 160.103. Every clinical decision affecting your child is made by your child's clinician or clinic.

1.3 What this Policy governs

This Policy governs the App and only the App. It does not govern:

  • getflourishbx.com, the FlourishBx marketing website, which is governed by the FlourishBx Privacy Policy and handles no health information;
  • the FlourishBx Clinician Dashboard, used by BCBAs, clinicians and clinics, which is governed by the FlourishBx Clinician Dashboard Product Privacy Policy;
  • your child's clinician or clinic, who have their own privacy practices and their own Notice of Privacy Practices under 45 C.F.R. § 164.520 — ask them directly for it; or
  • Apple, Google, or any other party whose services you use to obtain or run the App, each of which has its own privacy practices.

1.4 What this Policy is not

This Policy is not a contract for services. Your right to use the App is set by the FlourishBx Terms of Use. This Policy is not a Business Associate Agreement and creates no relationship of that kind between you and FlourishBx. This Policy is not a Notice of Privacy Practices and does not replace the one your clinician must give you.

1.5 Incorporation

This Policy is incorporated by reference into the FlourishBx Terms of Use. Where the Terms of Use and this Policy conflict on a matter of privacy, this Policy governs, as provided at Section 23.2.

1.6 This Policy and the Free Account policy are mutually exclusive

1.6.1 Exactly one of the two policies governs your account at any moment, determined by whether a provider is connected. This one governs while one is.

1.6.2 If your provider discharges your child, or the connection otherwise ends, your account may revert to a Free Account and the Free Account policy at https://getflourishbx.com/app-privacy-free.html applies from that point. Information already in the Clinical Record remains the Clinician's responsibility, and Section 5.2 continues to govern it.

1.6.3 If you began on a Free Account and later connected a provider, this Policy took over at that moment, and information you recorded beforehand may have become part of the Clinical Record. Article 13 of the Free Account policy describes that change.

1.6.4 FlourishBx will not switch the governing policy silently. You will be told at the point of connecting or discharging.

ARTICLE 2 — WHO THIS POLICY IS FOR

2.1 You

This Policy is written for you: an adult who holds a FlourishBx Caregiver App account and uses it to record observations about a child receiving services from a FlourishBx clinician.

2.2 It is not written for children

Children do not hold FlourishBx accounts. See Article 15.

2.3 It is not written for clinicians

If you are a BCBA or clinic administrator, the document that concerns you is the FlourishBx Clinician Dashboard Product Privacy Policy.

ARTICLE 3 — DEFINITIONS

Words defined here have the same meaning wherever they appear in this Policy, whether or not capitalized in the sentence you are reading.

3.1 "App" means the FlourishBx mobile application for parents and caregivers, in all versions, on iOS and Android.

3.2 "Behavior Log" means a record you create in the App describing an observed behavior, and includes the behavior recorded, the strategy attempted, the outcome, the duration, any free-text note, any follow-up plan, the time recorded, and the identity of the account that recorded it.

3.3 "Business Day" means a day other than a Saturday, a Sunday, or a day on which national banking institutions in North Carolina are authorized or required to close.

3.4 "Caregiver" means an adult granted access to a Child's record in the App. The term includes you, and it includes any other adult approved for the same Child.

3.5 "Child" means the individual receiving services about whom a record is kept. A Child is a natural person and is usually a minor.

3.6 "Clinical Record" means the information about a Child that originates with, or is maintained on behalf of, the Clinician — including the Child's name, date of birth, diagnosis, clinical notes, behavior definitions, intervention strategies, session documentation, and the Behavior Logs contributed by Caregivers. The Clinician controls the Clinical Record. FlourishBx does not. See Article 5.

3.7 "Clinician" means the BCBA, clinician, or clinic responsible for the Child's care and for the Clinical Record, and includes the organization that employs or contracts with that individual.

3.8 "COPPA" means the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the rule at 16 C.F.R. Part 312.

3.9 "Device Data" means information that stays on your phone and is never transmitted to FlourishBx, including the nicknames and colors described at Section 8.3 and the reminder schedule described at Article 6.

3.10 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as amended by the HITECH Act, Pub. L. No. 111-5, and the regulations at 45 C.F.R. Parts 160, 162 and 164.

3.11 "Personal Information" means information that identifies, relates to, describes, or is reasonably capable of being linked to a particular individual or household. It does not include information that has been de-identified.

3.12 "PHI" means Protected Health Information as defined at 45 C.F.R. § 160.103. The Clinical Record is PHI.

3.13 "Primary Caregiver" means the Caregiver whom the Clinician has designated as able to invite and remove other Caregivers for a Child. There is normally one per Child.

3.14 "Process" and "Processing" mean any operation performed on information, including collection, recording, storage, organization, retrieval, consultation, use, disclosure, transmission, restriction, erasure and destruction.

3.15 "Security Incident" means the attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations, consistent with 45 C.F.R. § 164.304.

3.16 "Service Provider" means a third party that Processes information on FlourishBx's behalf and on FlourishBx's instructions only, and includes a "service provider" under Cal. Civ. Code § 1798.140(ag).

3.17 "Sell" and "Share" have the meanings given at Cal. Civ. Code § 1798.140(ad) and § 1798.140(ah) respectively. FlourishBx does neither. See Section 10.1.

3.18 "Terms of Use" means the FlourishBx Terms of Use applicable to the App, as amended.

3.19 "Your Account Information" means the information about you described in Article 7 — your name, email address, password hash, stated relationship to the Child, the invitation code you used, and your sign-in history. FlourishBx controls Your Account Information. See Section 5.1.

ARTICLE 4 — RULES OF CONSTRUCTION

4.1 Headings. Article and Section headings are for convenience only and do not affect interpretation.

4.2 "Including." "Including" and "includes" mean "including without limitation" and do not limit what precedes them.

4.3 "Or." "Or" is inclusive unless the context requires otherwise.

4.4 Number and gender. The singular includes the plural and the plural the singular. Words of one gender include every gender.

4.5 Statutes. A reference to a statute or regulation is a reference to it as amended, and to any successor provision.

4.6 Days. "Days" means calendar days unless "Business Days" is stated. A period ending on a day that is not a Business Day extends to the next Business Day.

4.7 Examples. An example given in this Policy illustrates the provision; it does not narrow it.

4.8 No construction against the drafter. Any rule of construction requiring an ambiguity to be resolved against the drafting party does not apply to this Policy. This rule does not apply where a consumer protection statute directs otherwise, and nothing in this Section limits any right you have under such a statute.

4.9 Bold and capitals. Emphasis marks passages FlourishBx considers important. It does not make a passage more or less binding than any other.

ARTICLE 5 — TWO KINDS OF INFORMATION, TWO DIFFERENT ANSWERS

This is the most important Article in this Policy, because it decides who you ask when you want something shown to you, corrected, or deleted.

5.1 Your Account Information — we are responsible

Your name, your email address, your password, your stated relationship to the Child, and your sign-in history are yours and ours. You gave them to us. We hold them. You can ask us directly to show them to you, correct them, give you a copy, or delete them. See Article 19.

5.2 The Clinical Record — the Clinician is responsible

The Child's name, date of birth, diagnosis, clinical notes, behaviors, strategies, session records — and the Behavior Logs you contribute to them — form the Clinical Record. Your Clinician decides what goes in it, why, and how long it is kept. FlourishBx stores and displays it on their behalf.

5.2.1 FlourishBx cannot change or delete the Clinical Record at your request. That request goes to the Clinician.

5.2.2 This is not FlourishBx avoiding responsibility. Altering or deleting a clinical record on the instruction of someone other than the record's custodian would interfere with obligations the Clinician is legally required to meet, including under 45 C.F.R. §§ 164.524, 164.526 and 164.530(j) and under state record-retention law.

5.2.3 Your rights in the Clinical Record are real. They just run against the Clinician. HIPAA gives a personal representative of a minor the right to inspect and obtain a copy of the record (45 C.F.R. § 164.524), to request that it be amended (§ 164.526), to receive an accounting of certain disclosures (§ 164.528), and to request restrictions on its use (§ 164.522). Ask your Clinician. FlourishBx is obliged to help them answer you, and does.

5.3 If you don't know who to ask, ask us

FlourishBx will not tell you it isn't our problem. If you send us a request we cannot decide, we will tell you who holds the Clinical Record, forward your request to them, and tell you that we did. See Section 19.4.

5.4 We have a direct relationship with you

Some companies in this field state that they have no direct relationship with the individuals whose information they Process. That is not true of FlourishBx and you. You hold credentials FlourishBx issued, you accepted FlourishBx's Terms of Use, and you deal with FlourishBx directly. FlourishBx does not disclaim that relationship and does not use it to refuse you an answer.

ARTICLE 6 — NOTIFICATIONS AND REMINDERS

6.1 The App can remind you to log. Every reminder is created and scheduled on your own phone.

6.2 FlourishBx does not send push notifications. FlourishBx does not create, collect, or store a push token. No notification service — Apple's, Google's, or any other — receives any information about you from FlourishBx.

6.3 To decide whether to remind you, the App checks on your device whether you have logged anything that day. That check creates no new record anywhere and transmits nothing.

6.4 If you decline the notification permission, the App works normally and you simply receive no reminders. Nothing else changes.

6.5 You can turn reminders off at any time in the App or in your phone's settings.

6.6 If FlourishBx ever adds server-sent notifications, this Article becomes false. FlourishBx will amend this Policy and give you notice under Article 22 before that happens, and the App Store privacy labels will change with it.

ARTICLE 7 — PERMISSIONS THE APP DOES NOT ASK FOR

As of the Effective Date, the App does not request, receive, or use:

  • your camera — you cannot and need not record video in the App;
  • your microphone;
  • your photo library;
  • your location, precise or approximate, foreground or background;
  • your contacts;
  • your calendar;
  • your health data from Apple Health, Google Fit, or any comparable service;
  • any biometric identifier, including face or fingerprint data used for anything beyond your phone's own unlock; or
  • any advertising identifier, including Apple's IDFA and Google's Advertising ID.

7.1 These are named explicitly because some platforms in this field do collect device location, including continuously during a visit. FlourishBx does not.

7.2 If FlourishBx ever adds a feature that needs one of these, FlourishBx will amend this Policy and give notice before the feature is used. Your phone will also ask you separately, and you can say no and keep using the App.

ARTICLE 8 — WHAT YOU RECORD, AND WHO SEES IT

When you log a behavior, the App records the behavior, the strategy you tried, how it went, how long it lasted, any note you write, any follow-up plan, the time, and that you were the one who recorded it.

8.1 Your notes are free text

Whatever you type is stored exactly as typed. FlourishBx does not read, filter, screen, moderate, or analyze it. Please do not put anything in a note that you would not want the Child's care team to read.

8.1.1 Because notes are free text, you control what goes in them. If you include information about another person, you are choosing to place it in a clinical record you do not control. Consider whether it belongs there.

8.2 Your Clinician sees everything you log

That is the purpose of the App: your observations at home inform the treatment plan. Assume your BCBA will read every note you write.

8.2.1 The Clinician also sees which Caregiver wrote each log — that you were the one who recorded it, not merely that someone did.

8.3 Your personalization stays on your phone

If you give the Child a nickname or choose a color for their card, that stays on your device and is never sent to FlourishBx. Your Clinician always sees the Child's real name. Uninstalling the App erases these choices, and they cannot be recovered.

8.4 Other Caregivers do not see your logs

If more than one Caregiver is approved for a Child, each of you sees only your own logs. Another Caregiver cannot read your notes, and you cannot read theirs.

8.4.1 This is enforced in the database, not merely hidden in the App's screens. A request for another Caregiver's logs returns nothing, whoever makes it and however it is made.

8.4.2 The Clinician sees every Caregiver's logs, including yours, as Section 8.2 states. The isolation described in this Section 8.4 runs between Caregivers, not between you and the care team.

8.4.3 Who is approved to see a Child's record is decided by the Primary Caregiver and the Clinician — not by FlourishBx. See Article 11.

8.4.4 So, plainly: a note you write reaches your Child's clinical team and no other family member or Caregiver.

8.4.5 This isolation depends on each adult using their own account. See Section 9.5.

8.5 What FlourishBx personnel can see

FlourishBx personnel do not browse Clinical Records. Access is limited to the smallest number of people needed to run and support the service, is granted only for a specific operational or support purpose, and is logged. See Section 16.2.

ARTICLE 9 — YOUR ACCOUNT

9.1 Information FlourishBx collects about you

What Why
Your name To address you, and so the Clinician knows who logged what
Your email address To sign you in, send account emails, and let you recover your account
Your password Stored only as a cryptographic hash. FlourishBx never sees it
Your relationship to the Child (for example parent, grandparent, respite worker) Clinical context — a behavior can look different at school than at home
The invitation code you used To link you to the right Child
Your sign-in history, including failed attempts To protect your account. See Section 16.1

9.2 It comes from you

FlourishBx collects this information because you typed it in. FlourishBx does not buy information about you, and does not obtain it from data brokers, social media, credit bureaus, public records, or any other outside source.

9.3 You must be an adult

You must be 18 or older to hold an account. See Article 15.

9.4 Keep your credentials to yourself

You are responsible for keeping your password confidential and for what happens under your account. Tell FlourishBx at contact@getflourishbx.com immediately if you believe someone else has access to it.

9.5 One account per adult — do not share a login

Each adult who logs for a Child must have their own account. Sharing one login between two people is prohibited by the Terms of Use, and it is not merely a rule: every protection in Section 8.4 is keyed to who is signed in. If two people share an account, they see each other's notes, the Clinician cannot tell who observed what, and the clinical value of the record is degraded.

9.5.1 Inviting an additional Caregiver costs nothing. The App is free and there is no limit on the number of Caregivers a Child may have. There is never a financial reason to share a login.

ARTICLE 10 — HOW INFORMATION IS USED, AND WHAT IS NEVER DONE WITH IT

10.1 Permitted purposes

FlourishBx Processes information only to: sign you in and keep your account secure; show you the Child's information; save what you log and make it available to the Child's care team; remind you to log; answer you when you contact FlourishBx; operate, maintain, monitor, secure, back up and troubleshoot the service; and comply with law.

10.2 Purposes expressly excluded

FlourishBx does not, and will not:

  • Sell or Share your information, or the Child's — not for money, not for anything else of value, and not within the meaning of Cal. Civ. Code § 1798.140(ad) or § 1798.140(ah);
  • use it for advertising or marketing of any kind, or allow any other party to;
  • use it to develop, train, fine-tune, evaluate, or improve any artificial intelligence or machine learning model, whether FlourishBx's own or anyone else's;
  • create de-identified or aggregated datasets from the Clinical Record for research, benchmarking, publication, or sale;
  • profile you or the Child for any purpose beyond delivering the App; or
  • make any automated decision that produces a legal or similarly significant effect concerning you or the Child.

10.2.1 The exclusions in Section 10.2 are commitments, not current practice statements. FlourishBx cannot begin any of these activities without amending this Policy and giving notice under Article 22, and where consent is required by law, obtaining it first.

10.3 Aggregate operational metrics

FlourishBx may count things that contain no information about you or the Child — for example, how many logs were recorded across the whole service in a month, or how often a screen fails to load. This never involves the content of a log or any identifier, and the result cannot be traced back to you.

ARTICLE 11 — WHO CONTROLS ACCESS TO THE CHILD'S RECORD

11.1 Access to a Child's record is granted by invitation. The Primary Caregiver and the Clinician decide who is invited and who is removed. FlourishBx does not make that decision and does not adjudicate disputes about it.

11.2 Accepting an invitation creates a FlourishBx account for the invited adult, governed by this Policy and by the Terms of Use.

11.3 FlourishBx will not add a Caregiver at the request of someone who is not the Primary Caregiver or the Clinician, whatever relationship to the Child that person asserts.

11.4 Disputes about who should have access are family and clinical matters, not FlourishBx matters. If custody, guardianship, or a protective order affects who may see a Child's record, that must be raised with the Clinician, who controls the record. Where FlourishBx receives a court order directed to it, Section 18.2 applies.

ARTICLE 12 — WHEN ACCESS ENDS

Version 1 did not address this. It matters, so it is set out plainly.

12.1 Removal by the Primary Caregiver or Clinician

Either the Primary Caregiver or the Clinician can remove your access to a Child's record at any time and without FlourishBx's involvement or agreement.

12.2 What happens immediately

When your access is removed, you can no longer see that Child's record — including the logs you wrote yourself. The App will show you no data for that Child.

12.3 Your logs stay in the Clinical Record

The Behavior Logs you already contributed remain part of the Child's Clinical Record. They were clinical documentation from the moment you saved them. FlourishBx cannot remove them at your request, and Section 5.2 explains why. If you want them removed, ask the Clinician, who decides.

12.4 Your account survives

Removing your access to one Child does not delete your FlourishBx account. If you are approved for another Child, that access is unaffected. If you are not, your account remains, empty, until you close it under Article 19.

12.5 FlourishBx will not tell you why

FlourishBx is not told the reason for a removal and will not speculate about it. That conversation is with the Primary Caregiver or the Clinician.

12.6 Getting a copy first

If you want a copy of what you wrote, ask before your access ends — FlourishBx cannot restore access after the fact. If access has already ended, the Clinician can provide the record.

ARTICLE 13 — WHEN THE CHILD BECOMES AN ADULT

13.1 Most Children in the App are minors. When a Child reaches the age of majority in their state — 18 in North Carolina, N.C. Gen. Stat. § 48A-2 — the legal position changes. In general, the individual, not a parent, then holds the HIPAA rights in their own record, and a parent's authority as personal representative under 45 C.F.R. § 164.502(g) ends unless a guardianship or other legal authority continues it.

13.2 The Clinician, not FlourishBx, determines who holds those rights and whether a Caregiver's access should continue. FlourishBx acts on the Clinician's instruction.

13.3 What you should do. If the Child you log for is approaching 18, raise it with the Clinician before the birthday. Whether your access continues is a decision for the Clinician and the now-adult client, not for FlourishBx.

ARTICLE 14 — MORE THAN ONE CHILD

14.1 One account can be approved for more than one Child — siblings, or children in the same foster or respite placement.

14.2 Each Child's record is separate. Being approved for one Child gives you no access to another, and each approval is granted and removed independently under Article 11.

14.3 Your Account Information is shared across them — you have one name, one email address, one password, and one sign-in history, whatever number of Children you are approved for.

14.4 Each Child normally has a different Clinician, and each Clinician sees only their own Child's record, including only the logs you wrote about that Child.

ARTICLE 15 — CHILDREN AND THE APP

15.1 The App is for adults

You must be 18 or older to hold a FlourishBx account. Children do not hold FlourishBx accounts, and the App has no child-facing mode, no child login, and no feature directed to a child user.

15.2 Information about a child, not from a child

The App contains information about a Child, entered by adults — by you and by the care team. FlourishBx does not knowingly collect Personal Information from a child.

15.3 COPPA

COPPA (15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312) governs the online collection of personal information from children under 13. FlourishBx collects no information from children and operates no service directed to children within the meaning of 16 C.F.R. § 312.2.

Consent to your child's treatment, and to the Clinician's use of FlourishBx in delivering it, is obtained by the Clinician, who is required to obtain it. FlourishBx does not obtain treatment consent and does not rely on having done so.

15.6 If a child has an account

If you believe a person under 18 has created a FlourishBx account, contact contact@getflourishbx.com. FlourishBx will investigate and delete the account and its Account Information promptly.

ARTICLE 16 — SECURITY

16.1 Safeguards

FlourishBx maintains administrative, physical and technical safeguards designed to protect information, including: encryption in transit using TLS 1.2 or higher; encryption at rest; access controls enforced in the database itself, so that a request for a Child you are not approved for returns nothing regardless of how it is made; automatic session expiry; and throttling of repeated failed sign-in attempts.

16.2 Access logging

Reads of a Child's record made through the Application or the Dashboard are logged, including reads by FlourishBx personnel. The log records who read what, and when.

16.2.1 What that log does and does not cover. It is kept by the Application, so it records access that happens through the Application. It is not a record of every conceivable route to the underlying database — for example, access by a database administrator acting outside the Application would be governed by the controls in Section 16.1 and by FlourishBx's internal procedures rather than captured in this log. FlourishBx states this plainly rather than describe the log as complete.

16.3 No guarantee

NO SYSTEM IS COMPLETELY SECURE. FlourishBx does not guarantee, warrant, or promise that information will never be accessed, disclosed, altered or destroyed without authorization, and no statement in this Policy should be read as such a promise.

16.4 If a Security Incident affects you

16.4.1 If a Security Incident compromises the security or confidentiality of Your Account Information, FlourishBx will notify you without unreasonable delay and within the time any applicable law requires, including N.C. Gen. Stat. § 75-65 and the breach notification statute of your state of residence.

16.4.2 The notice will describe, so far as then known: what happened, when, what categories of information were involved, what FlourishBx has done in response, what you can do, and how to reach a person about it.

16.4.3 If a Security Incident affects the Clinical Record, the notice required by HIPAA is given by the Clinician to the affected individual under 45 C.F.R. § 164.404. FlourishBx is required to notify the Clinician without unreasonable delay and in no case later than sixty (60) days after discovery (45 C.F.R. § 164.410), and does so under its Business Associate Agreement with them. FlourishBx may also contact you directly where doing so helps you protect yourself and the Clinician does not object.

16.4.4 FlourishBx will not delay a notice in order to complete an investigation, and will supplement a notice as more becomes known.

16.5 Reporting a concern

Report a suspected vulnerability or Security Incident to contact@getflourishbx.com. FlourishBx will not pursue a good-faith security researcher who reports a vulnerability to that address, does not access more information than is needed to demonstrate it, and does not disclose it publicly before FlourishBx has had a reasonable opportunity to fix it.

16.6 Do not put PHI in an email to support

Email is not a secure channel. Do not include the Child's name, diagnosis, or clinical details in an email or support message. Describe the problem and FlourishBx will ask for what it needs through a secure route.

ARTICLE 17 — INFORMATION COLLECTED AUTOMATICALLY

17.1 FlourishBx's hosting provider records standard server logs when the App communicates with FlourishBx's servers: the IP address the request came from, the request made, the response, and the time. These exist to keep the service running and secure, and for no other purpose.

17.2 FlourishBx records sign-in attempts, including failed attempts, to protect your account.

17.3 The App contains no advertising, no cross-app or cross-site tracking, no advertising identifier, no social media pixel, and no third-party analytics software development kit.

17.4 The App does not track you across other companies' apps or websites and does not respond to, or need, an App Tracking Transparency prompt for that purpose.

17.5 FlourishBx operates its own crash reporting. Diagnostic reports are stripped of personal information on your device before they are sent, and stripped again when they arrive. They are stored on infrastructure FlourishBx controls. No third-party crash reporting service is used, so there is no additional recipient of your information to disclose here.

ARTICLE 18 — DISCLOSURE

18.1 Categories of recipient

Who What for
The Child's Clinician and clinic The entire purpose of the App
Other Caregivers approved for the Child Limited — see Section 8.4
Google LLC (Google Cloud Platform) Runs FlourishBx's servers, database, file storage and sign-in, in the United States
Google LLC (Google Workspace) Sends and receives account email such as invitations, password resets and support
Supabase, Inc. Being retired. Nothing flows to Supabase any more - FlourishBx's servers, database, sign-in and email all moved to Google in September and October 2026. The project is suspended and still holds records created before that move, pending their deletion. It is listed because it holds data, not because it receives any
Crash diagnostics Processed on FlourishBx's own servers and scrubbed of personal information before they are sent. No third-party crash reporting service is used
Professional advisors under a duty of confidentiality Legal and accounting advice

18.1.1 Each Service Provider Processes information on FlourishBx's instructions only, is contractually prohibited from using it for its own purposes, from selling it, and from retaining it after the engagement ends. Where a Service Provider handles PHI, it does so under a Business Associate Agreement satisfying 45 C.F.R. §§ 164.504(e) and 164.314(a).

18.1.2 FlourishBx remains answerable to you for what its Service Providers do with your information. Pointing at a vendor is not an answer FlourishBx will give.

18.2 Other disclosures

FlourishBx may disclose information:

  • when required by law — a subpoena, court order, warrant, or other lawful government demand. FlourishBx will produce only what the demand requires, will notify the Clinician where the Clinical Record is involved, and will notify you where it is lawful and practical to do so before producing Your Account Information;
  • to prevent serious harm — where FlourishBx reasonably believes disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person, limited to what is necessary and to those able to prevent or lessen the threat, consistent with 45 C.F.R. § 164.512(j);
  • to establish or defend a legal claim, limited to what is necessary; and
  • in a merger, acquisition, financing or sale of assets, in which case the acquirer must assume this Policy as to information already collected, and FlourishBx will post notice before information transfers.

18.2.1 A change of ownership does not lower the protections in this Policy. Section 10.2 binds any successor as to information collected before the change.

18.3 The App is not an emergency service

THE APP IS NOT MONITORED IN REAL TIME AND IS NOT AN EMERGENCY SERVICE. Recording a crisis behavior in the App does not summon help, does not alert anyone immediately, and does not create any duty on FlourishBx to act. If a child is in danger, call 911 or your local emergency number.

18.4 Location of data

FlourishBx's servers are located in the United States, and information is stored and Processed there. The App is intended for use in the United States, and FlourishBx makes no representation that it is appropriate or lawful for use elsewhere.

ARTICLE 19 — YOUR CHOICES AND RIGHTS

19.1 Rights you exercise against FlourishBx

For Your Account Information, write to contact@getflourishbx.com. You may:

  • know what FlourishBx holds about you and where it came from;
  • get a copy of it in a portable, readable format;
  • correct it;
  • delete it, subject to Section 19.8;
  • withdraw consent where FlourishBx relies on consent; and
  • object to a use you disagree with, and receive a reasoned answer.

19.2 Rights you exercise against the Clinician

For the Clinical Record, ask the Clinician. See Section 5.2. Those rights are set out at 45 C.F.R. §§ 164.524, 164.526, 164.528 and 164.522, and the Clinician's Notice of Privacy Practices explains how to use them.

19.3 FlourishBx honors these for everyone

FlourishBx honors the rights in Section 19.1 for every Caregiver, wherever you live, whether or not a statute in your state requires it. FlourishBx does not condition a privacy right on residency.

19.4 Requests FlourishBx cannot decide

19.4.1 FlourishBx will acknowledge your request within 10 Business Days.

19.4.2 If FlourishBx cannot decide it, FlourishBx will forward it to whoever can, and tell you who that is and when it was forwarded.

19.4.3 FlourishBx will not simply close your request as out of scope.

19.5 Timing

FlourishBx will substantively respond within 45 days of receiving a verifiable request. Where more time is reasonably needed, FlourishBx will tell you within the first 45 days, explain why, and respond within a further 45 days. This mirrors Cal. Civ. Code § 1798.130(a)(2).

19.6 Verification and authorized agents

19.6.1 FlourishBx will take reasonable steps to verify that a request comes from you, because acting on an unverified request would itself be a privacy failure. Verification is normally a confirmation sent to the email address on your account.

19.6.2 FlourishBx will not ask you for a government identification document in order to answer an ordinary request about your own account.

19.6.3 An authorized agent may act for you where the law allows, on written proof of authority. FlourishBx may still verify with you directly.

19.7 If FlourishBx says no

19.7.1 FlourishBx will tell you why, in writing, and identify the exception it relies on.

19.7.2 You can appeal by replying with the word "Appeal." A different person will review it, and FlourishBx will respond within 45 days of the appeal.

19.7.3 If the appeal is denied, FlourishBx will tell you how to complain, and you may complain regardless of whether you appealed. Depending on your situation, the right body is:

  • the U.S. Department of Health and Human Services, Office for Civil Rights, for a complaint about handling of the Clinical Record (45 C.F.R. § 160.306);
  • your state Attorney General;
  • the California Privacy Protection Agency, if you are a California resident; or
  • the Federal Trade Commission, at reportfraud.ftc.gov.

19.7.4 FlourishBx will not require you to waive a right, sign a release, or agree to arbitration as a condition of answering a privacy request.

19.8 Closing your account

19.8.1 You can close your account at any time from Settings in the app, or by writing to contact@getflourishbx.com. Both routes do the same thing, and that thing is described in 19.8.2 and 19.8.3.

19.8.2 Closing your account deletes Your Account Information and ends your access to every Child's record.

19.8.3 It does not delete the Behavior Logs you contributed. Those are part of a Clinical Record the Clinician is required to keep, for the reasons at Section 5.2. FlourishBx will say so plainly in the deletion flow itself, not only here.

19.8.4 FlourishBx retains a minimal record that a deletion request was made and honored — the date, and the fact of it — because a regulator may ask FlourishBx to prove it. See Article 21.

19.9 No retaliation

FlourishBx will never deny you the App, charge you, delay you, degrade the service, or treat you differently because you exercised a right under this Article. This is consistent with Cal. Civ. Code § 1798.125. The App is free and stays free, so there is no price to raise.

ARTICLE 20 — ACCESSIBILITY

20.1 FlourishBx works toward conformance with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA in the App, and supports the accessibility features of iOS and Android, including system text sizing and screen readers.

20.2 If you cannot use the App or read this Policy because of a disability, write to contact@getflourishbx.com and FlourishBx will provide the information in another format and will help you exercise any right in Article 19 by another route, at no charge.

ARTICLE 21 — HOW LONG INFORMATION IS KEPT

What How long
Your Account Information Until you close your account, or 24 months after your last sign-in, whichever comes first
Behavior Logs you wrote Part of the Clinical Record. Retention is controlled by the Clinician — see Section 5.2
Server logs 90 days
Sign-in and access logs 12 months
Records of privacy requests and their outcomes 24 months, to demonstrate compliance
Nicknames and colors (Device Data) On your phone only; erased when you uninstall

21.1 FlourishBx does not keep Your Account Information longer than the period stated merely because it might be useful later.

21.2 Where a legal hold, an investigation, or an unresolved dispute requires it, FlourishBx may retain information beyond these periods for that purpose only, and will delete it when the reason ends.

21.3 Backups are cycled on a rolling basis. Information deleted from the live service may persist in an encrypted backup until that backup expires, and is not restored to the live service except as part of a general disaster recovery.

ARTICLE 22 — CHANGES TO THIS POLICY

22.1 FlourishBx may amend this Policy. The "Last Updated" date shows when it last changed, and the version number changes with it.

22.2 Material changes. A change is material if it adds a category of information collected, adds a permission the App requests, adds a category of recipient, adds a purpose of use, materially reduces a right in Article 19, or would make Section 10.2 untrue.

22.3 For a material change, FlourishBx will give notice in the App and by email to the address on your account before the change takes effect, and not less than 30 days before, except where a shorter period is required by law or necessary to address a security risk.

22.4 FlourishBx will not apply a materially different Policy to information already collected without your consent where consent is required by law.

22.5 A prior version of this Policy is available on request from contact@getflourishbx.com, and FlourishBx retains prior versions for six (6) years.

22.6 Continuing to use the App after a material change takes effect indicates acceptance of the amended Policy. If you do not accept it, you may close your account under Section 19.8.

ARTICLE 23 — GENERAL

23.1 Entire statement on privacy. This Policy is FlourishBx's entire statement of its privacy practices for the App and supersedes every prior statement about them, including Version 1.

23.2 Precedence. Where this Policy conflicts with the Terms of Use on a matter of privacy, this Policy governs. Where either conflicts with a Business Associate Agreement between FlourishBx and a Clinician as to PHI, the Business Associate Agreement governs as between those parties, and nothing in it reduces a right you have under this Policy.

23.3 Severability. If any provision of this Policy is held invalid or unenforceable, it is modified to the minimum extent necessary to make it enforceable, or if it cannot be, severed. The remainder stays in force.

23.4 No waiver. FlourishBx's failure to enforce a provision is not a waiver of it or of any other provision. A waiver is effective only in writing.

23.5 Survival. Articles 3, 4, 5, 12, 16, 19, 21 and 23 survive the closure of your account, as to information FlourishBx still holds.

23.6 No third-party beneficiaries. This Policy creates no rights in any person other than you, except that the Child is an intended beneficiary of Articles 8, 10, 16 and 18 and may enforce them through their personal representative.

23.7 Assignment. FlourishBx may assign this Policy in connection with a merger, acquisition or sale of assets, subject to Section 18.2. You may not assign it.

23.8 Notices. FlourishBx gives notice to the email address on your account and, for material changes, in the App as well. Keep your email address current — a notice sent to the address on your account is effective when sent. You give notice to FlourishBx at contact@getflourishbx.com or the address in Article 24.

23.9 Summaries are not binding. "The Short Version" and every table in this Policy are given for convenience. Where they differ from an Article, the Article governs.

23.10 Language. This Policy is written in English. Any translation is provided for convenience, and the English version governs in the event of a conflict, except where a law applicable to you provides otherwise.

23.11 Governing law. This Policy is governed by the laws of the State of North Carolina, without regard to conflict of laws principles. Nothing in this Section deprives you of the protection of a mandatory consumer privacy law of your state of residence.

23.12 No legal or clinical advice. Nothing in this Policy is legal or clinical advice. FlourishBx is neither your lawyer nor your child's clinician.

ARTICLE 24 — CONTACT

FlourishBx LLC d/b/a FlourishBx Attention: Privacy

Purpose Address
Privacy requests and questions contact@getflourishbx.com
Security reports contact@getflourishbx.com
General support contact@getflourishbx.com

24.1 FlourishBx will acknowledge a privacy request within 10 Business Days. See Article 19.

24.2 If you are not satisfied with FlourishBx's response, Section 19.7.3 lists where to complain.