Free Accounts (no provider connected)

FlourishBx LLC d/b/a FlourishBx

---

Effective Date: 25 October 2026 Last Updated: 25 October 2026 Version: 1 Applies to: the FlourishBx Caregiver App, when you are using it on your own and have not connected a provider.

---

WHICH POLICY APPLIES TO YOU

FlourishBx has two privacy policies for this app, because there are two very different situations and they deserve different answers.

This one applies to you if you set the app up yourself — you created your child's profile, you chose the behaviors to track, and no BCBA, therapist, or clinic is connected to your account.

The other one applies if a provider invited you, or you have since connected one. It is the FlourishBx Caregiver App Privacy Policy — Accounts Connected to a Provider, at https://getflourishbx.com/app-privacy-connected.html.

Not sure which you are? Open Settings in the app. If it shows a provider, the other policy applies. If it does not, this one does.

If you connect a provider later, the other policy takes over for your child's record from that moment. Article 13 explains exactly what changes, and FlourishBx will tell you before it happens.

---

NOTICE TO THE READER

Read Article 5 first. On a Free Account, FlourishBx holds your child's information directly. There is no clinician standing between you and us, and no clinician for us to point you to. That makes us answerable to you for all of it — and this policy is written on that basis.

HIPAA does not apply to a Free Account, because HIPAA reaches health care providers and their vendors, and on a Free Account there is no provider. That does not make your child's information less sensitive, and FlourishBx does not treat it as though it does. Article 11 explains the laws that do apply and the protections FlourishBx commits to regardless.

---

THE SHORT VERSION (NON-BINDING)

For convenience. Where it differs from Articles 1 through 22, those Articles govern. See Section 21.9.

• The app is free and stays free. No paid tier for families, no advertising.
• We never sell your information or your child's. Article 10.
• We never share it for advertising, and we will not use it to train artificial intelligence. Article 10.
• Nobody outside FlourishBx sees your child's record — there is no clinician on a Free Account. Article 8.
• The app never asks for your camera, microphone, photos, or location. Article 7.
• Reminders are built on your phone. No push token, nothing sent to a notification service. Article 6.
• You can delete everything, including the behavior logs. That is a real difference from a connected account. Section 18.6.
• We are the ones you ask. For everything. Article 18.

---

ARTICLE 1 — WHO WE ARE AND WHAT THIS COVERS

1.1 The company

The FlourishBx Caregiver App (the "App") is provided by FlourishBx LLC ("FlourishBx," "we," "us," "our"), a limited liability company organized under the laws of the State of North Carolina.

1.2 We make software; we are not a health care provider

FlourishBx does not provide therapy, diagnosis, treatment, clinical advice, or supervision. FlourishBx is not a "health care provider" within the meaning of 45 C.F.R. § 160.103.

1.2.1 On a Free Account this matters more, not less. There is no professional overseeing what you record or what you do about it. The app is a place to write things down and look things up. It is not a substitute for assessment or treatment by a qualified professional, and the Terms of Use say so at Article 10.

1.3 What this Policy governs

This Policy governs the App while your account has no provider connected. It does not govern:

• the App once you connect a provider — see Article 13 and the connected policy at https://getflourishbx.com/app-privacy-connected.html;
• getflourishbx.com, the FlourishBx marketing website, which has its own privacy policy and handles no health information;
• the FlourishBx Clinician Dashboard, used by providers; or
• Apple, Google, or any other party whose services you use to obtain or run the App.

1.4 What this Policy is not

This Policy is not a contract. Your right to use the App is set by the FlourishBx Caregiver App Terms of Use. It is not a Notice of Privacy Practices — that is a HIPAA document, and HIPAA does not apply here. It is not a Business Associate Agreement, and there is no covered entity for FlourishBx to be a business associate of.

1.5 Incorporation

This Policy is incorporated by reference into the Terms of Use. Where the Terms of Use and this Policy conflict on a matter of privacy, this Policy governs.

---

ARTICLE 2 — WHO THIS POLICY IS FOR

2.1 This Policy is written for you: an adult who set the App up on your own to record observations about a child, with no provider connected.

2.2 Children do not hold FlourishBx accounts. See Article 14.

2.3 If a provider invited you, or you connect one later, the connected policy is yours instead. See Article 13.

---

ARTICLE 3 — DEFINITIONS

Words defined here carry the same meaning wherever they appear, whether or not capitalized in the sentence you are reading.

3.1 "App" means the FlourishBx mobile application for parents and caregivers, in all versions, on iOS and Android.

3.2 "Behavior Log" means a record you create describing an observed behavior, including the behavior, the strategy attempted, the outcome, the duration, any free-text note, any follow-up plan, the time, and the account that recorded it.

3.3 "Business Day" means a day other than a Saturday, a Sunday, or a day on which national banking institutions in North Carolina are authorized or required to close.

3.4 "Child" means the individual whose behavior you record. A Child is a natural person and is usually a minor.

3.5 "Child Record" means everything in the App about the Child — name, date of birth if you enter one, the behaviors you define, your Behavior Logs, and any notes. On a Free Account, FlourishBx holds the Child Record and no other organization has any right to it. Contrast the "Clinical Record" in the connected policy, which a provider controls.

3.6 "Connected Account" means an account linked to a provider. This Policy does not apply to one. See Article 13.

3.7 "Consumer Health Data" means personal information linked or reasonably linkable to a consumer that identifies past, present or future physical or mental health status, as defined at RCW 19.373.010(8) and in the comparable statutes described at Article 11. The Child Record is Consumer Health Data.

3.8 "COPPA" means the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the rule at 16 C.F.R. Part 312.

3.9 "Device Data" means information that stays on your phone and is never sent to FlourishBx, including nicknames, color choices, and the reminder schedule at Article 6.

3.10 "Free Account" means a FlourishBx Caregiver App account with no provider connected. This Policy governs a Free Account.

3.11 "MHMDA" means the Washington My Health My Data Act, RCW 19.373.

3.12 "Personal Information" means information that identifies, relates to, describes, or is reasonably capable of being linked to a particular individual or household. It excludes information that has been de-identified.

3.13 "Process" and "Processing" mean any operation performed on information, including collection, recording, storage, organization, retrieval, use, disclosure, transmission, restriction, erasure and destruction.

3.14 "Provider" means a BCBA, clinician, or clinic using the FlourishBx Clinician Dashboard. On a Free Account there is none.

3.15 "Security Incident" means the attempted or successful unauthorized access, use, disclosure, modification or destruction of information, or interference with system operations.

3.16 "Sell" and "Share" have the meanings given at Cal. Civ. Code § 1798.140(ad) and § 1798.140(ah), and, as to Consumer Health Data, at RCW 19.373.010(26). FlourishBx does none of these. Section 10.2.

3.17 "Service Provider" means a third party that Processes information on FlourishBx's behalf and on FlourishBx's instructions only, and includes a "service provider" under Cal. Civ. Code § 1798.140(ag) and a "processor" under the State statutes at Article 11.

3.18 "Terms of Use" means the FlourishBx Caregiver App Terms of Use, as amended.

3.19 "Your Account Information" means your name, email address, password hash, stated relationship to the Child, and your sign-in history.

---

ARTICLE 4 — RULES OF CONSTRUCTION

4.1 Headings are for convenience and do not affect interpretation.

4.2 "Including" means "including without limitation."

4.3 "Or" is inclusive unless the context requires otherwise.

4.4 Number and gender. The singular includes the plural and the plural the singular; words of one gender include every gender.

4.5 Statutes. A reference to a statute or regulation is to it as amended, and to any successor.

4.6 Days means calendar days unless "Business Days" is stated. A period ending on a day that is not a Business Day extends to the next Business Day.

4.7 Examples illustrate a provision; they do not narrow it.

4.8 No construction against the drafter. Any rule requiring an ambiguity to be resolved against the drafting party does not apply. This does not limit any right you have under a consumer protection statute.

4.9 Emphasis marks what FlourishBx considers important. It does not make a passage more or less binding.

---

ARTICLE 5 — FLOURISHBX IS RESPONSIBLE FOR ALL OF IT

This is the most important Article in this Policy, and it is the one thing that is genuinely different from a connected account.

5.1 There is no one else

On a Free Account, there is no clinician, no clinic, and no covered entity. Nobody else holds your child's record, decides what goes in it, or has any say in how long it is kept.

5.2 So FlourishBx answers for it

FlourishBx is the controller of everything in your account — Your Account Information and the Child Record alike. Every request in Article 18 is addressed to us, and we cannot refer you to anyone else, because there is no one else.

5.3 What that gets you

5.3.1 You can have it all deleted, including the Behavior Logs. On a connected account those are clinical documentation the provider must keep. Here they are not. See Section 18.6.

5.3.2 You can correct anything, because nobody else's professional judgment is recorded in it.

5.3.3 You can export all of it at any time, at no charge.

5.4 HIPAA does not apply, and that changes less than you might think

5.4.1 HIPAA regulates health care providers, health plans, clearinghouses and their vendors. On a Free Account FlourishBx is none of those, so HIPAA does not reach this information.

5.4.2 FlourishBx does not treat that as permission to do less. The security measures in Article 15, the limits in Article 10, and the rights in Article 18 apply to a Free Account whether or not any statute compels them.

5.4.3 And other laws do reach it. Information about a child's mental or behavioral health, collected outside HIPAA, is exactly what the consumer health data statutes were written for. Article 11.

5.5 We have a direct relationship with you

Some companies in this field state they have no direct relationship with the individuals whose information they Process. On a Free Account that is not merely untrue — it is the opposite of the truth. You are our user, you hold our credentials, and we hold your child's information ourselves.

---

ARTICLE 6 — NOTIFICATIONS AND REMINDERS

6.1 The App can remind you to log. Every reminder is created and scheduled on your own phone.

6.2 FlourishBx does not send push notifications, does not create or store a push token, and no notification service — Apple's, Google's, or any other — receives any information about you from FlourishBx.

6.3 To decide whether to remind you, the App checks on your device whether you logged anything that day. That check creates no record and transmits nothing.

6.4 Declining the notification permission changes nothing else about the App.

6.5 You can turn reminders off at any time, in the App or in your phone's settings.

6.6 If FlourishBx ever adds server-sent notifications this Article becomes false, and FlourishBx will amend this Policy and give notice under Article 20 before that happens.

---

ARTICLE 7 — PERMISSIONS THE APP DOES NOT ASK FOR

As of the Effective Date, the App does not request, receive, or use:

• your camera;
• your microphone;
• your photo library;
• your location, precise or approximate, foreground or background;
• your contacts;
• your calendar;
• health data from Apple Health, Google Fit, or any comparable service;
• any biometric identifier; or
• any advertising identifier, including Apple's IDFA and Google's Advertising ID.

7.1 These are named because some platforms in this field do collect device location. FlourishBx does not.

7.2 FlourishBx does not and will not use a geofence around any health care facility, provider's office, pharmacy, or similar location. This is prohibited by RCW 19.373.100 and FlourishBx commits to it everywhere, not only in Washington.

7.3 If FlourishBx ever adds a feature needing one of these permissions, it will amend this Policy, give notice, and obtain your consent before the feature is used. Your phone will ask you separately, and you can say no and keep using the App.

---

ARTICLE 8 — WHAT YOU RECORD, AND WHO SEES IT

8.1 What a Behavior Log contains

The behavior, the strategy you tried, how it went, how long it lasted, any note you write, any follow-up plan, the time, and that you recorded it.

8.2 Nobody outside FlourishBx sees it

On a Free Account there is no provider, so nothing you record is shared with any clinician, clinic, school, agency, insurer, or other organization. It is held by FlourishBx for you, and Article 17 states the only circumstances in which it goes anywhere else.

8.3 Your notes are free text

Whatever you type is stored exactly as typed. FlourishBx does not read, filter, screen, moderate, or analyze it.

8.3.1 Because it is free text, you decide what goes in. If you record information about another person, consider whether it belongs there.

8.4 Your personalization stays on your phone

Nicknames and color choices stay on your device and are never sent to FlourishBx. Uninstalling the App erases them, and they cannot be recovered.

8.5 More than one caregiver

8.5.1 A Free Account is created by one adult. Where the App permits a second adult to be added, each caregiver sees only their own Behavior Logs, enforced in the database rather than in the interface.

8.5.2 This depends on each adult having their own login. Sharing one account defeats it entirely. The Terms of Use prohibit sharing at Section 8.2.

8.5.3 On a Free Account, one caregiver invitation per child is permitted. This limit is enforced by the database itself, not only by the app. A second caregiver cannot be invited on a Free Account, so the separation described in this Section applies between the clinician and the one invited caregiver.

8.6 What FlourishBx personnel can see

FlourishBx personnel do not browse Child Records. Access is limited to the fewest people needed to run and support the service, is granted only for a specific operational or support purpose, and is logged. See Section 15.3.

---

ARTICLE 9 — YOUR ACCOUNT

9.1 What FlourishBx collects about you

What	Why
Your name	To address you
Your email address	To sign you in, send account emails, and let you recover your account
Your password	Stored only as a cryptographic hash. FlourishBx never sees it
Your relationship to the Child	Context for your own records
Your sign-in history, including failed attempts	To protect your account

9.2 What you enter about the Child

The Child's first name, and a date of birth if you choose to give one; the behaviors you define; and your Behavior Logs. You decide what to enter. Nothing about the Child is required beyond a name to label the record.

9.3 It comes from you

FlourishBx collects this because you typed it in. FlourishBx does not buy information about you or the Child, and does not obtain it from data brokers, social media, credit bureaus, public records, or any other outside source.

9.4 You must be an adult

You must be 18 or older to hold an account. See Article 14.

9.5 Keep your credentials to yourself

You are responsible for keeping your password confidential. Tell FlourishBx at contact@getflourishbx.com immediately if you believe someone else has access.

---

ARTICLE 10 — HOW INFORMATION IS USED, AND WHAT IS NEVER DONE WITH IT

10.1 Permitted purposes

FlourishBx Processes information only to: sign you in and keep your account secure; show you what you recorded; save what you log; remind you; answer you when you make contact; operate, maintain, monitor, secure, back up and troubleshoot the service; and comply with law.

10.2 Purposes expressly excluded

FlourishBx does not, and will not:

• Sell or Share your information or the Child's — not for money, not for anything else of value, and not within the meaning of Cal. Civ. Code § 1798.140(ad), § 1798.140(ah), or RCW 19.373.010(26);
• use it for advertising or marketing of any kind, or allow any other party to;
• use it to develop, train, fine-tune, evaluate, or improve any artificial intelligence or machine learning model, whether FlourishBx's own or anyone else's;
• create de-identified or aggregated datasets from the Child Record for research, benchmarking, publication, or sale;
• profile you or the Child for any purpose beyond delivering the App; or
• make any automated decision producing a legal or similarly significant effect concerning you or the Child.

10.2.1 These are commitments, not descriptions of current practice. FlourishBx cannot begin any of them without amending this Policy, giving notice under Article 20, and — where the law requires consent, which for Consumer Health Data it does — obtaining your consent first. See Article 12.

10.2.2 A sale of Consumer Health Data additionally requires a signed authorization meeting RCW 19.373.110, separate from any consent. FlourishBx does not sell and does not intend to seek such an authorization.

10.3 Aggregate operational metrics

FlourishBx may count things containing no information about you or the Child — how many logs were recorded across the whole service in a month, or how often a screen fails to load. This never involves the content of a log or any identifier, and the result cannot be traced back to you.

---

ARTICLE 11 — CONSUMER HEALTH DATA

HIPAA does not apply to a Free Account. These laws do, and they are the reason this Article exists.

11.1 What is covered

Information about a child's behavior, mental health, or developmental condition is Consumer Health Data. The Child Record is Consumer Health Data in its entirety, and FlourishBx treats it as such regardless of where you live.

11.2 Washington My Health My Data Act

11.2.1 MHMDA, RCW 19.373, applies to Consumer Health Data of Washington residents and to such data collected in Washington. FlourishBx complies with it for every user, wherever resident.

11.2.2 Under MHMDA you have the right to know what Consumer Health Data FlourishBx collects and shares, to withdraw consent, and to have it deleted — including from backups, subject to Section 19.3. Article 18 states how to exercise each, and Section 18.5 states the timing.

11.2.3 FlourishBx does not share Consumer Health Data other than as Article 17 describes, and collects it only with your consent under Article 12.

11.2.4 MHMDA is enforceable by individuals through the Washington Consumer Protection Act, RCW 19.86.090, in addition to enforcement by the Attorney General.

11.2.5 The geofencing prohibition at RCW 19.373.100 is observed everywhere. See Section 7.2.

11.3 Nevada

Nevada SB 370, codified at NRS 603A.400 et seq., imposes materially similar obligations for consumer health data concerning Nevada residents. FlourishBx's practices are the same in Nevada as everywhere else.

11.4 State comprehensive privacy statutes

Under the comprehensive privacy statutes now in force in California, Connecticut, Colorado, Virginia, Texas, Oregon and other States, health data and information concerning a known child are "sensitive data," and processing sensitive data requires opt-in consent and, in several States, a data protection assessment. FlourishBx obtains consent under Article 12 and applies these protections to every user.

11.5 California

For California residents, the Child Record is sensitive personal information under Cal. Civ. Code § 1798.140(ae). FlourishBx uses it only for the purposes at Section 10.1, which are within the permitted purposes at § 1798.121(a), and does not use or disclose it for any other purpose. Accordingly no "Limit the Use of My Sensitive Personal Information" link is required, and none is offered, because there is no additional use to limit.

11.6 This Article is not a limit

Nothing in this Article limits Article 10. FlourishBx's commitments there exceed what any of these statutes require, and are given to every user rather than to the residents of the States that compel them.

11.7 A separate consumer health data notice

Washington's My Health My Data Act requires a Consumer Health Data Privacy Policy that is a separate document, separately linked, and not folded into a general privacy notice. FlourishBx publishes one for the Application: the App Consumer Health Data Privacy Policy. It covers both Free and connected accounts, and it is linked from the App Store listing and from the Settings screen of the Application alongside this Policy.

---

ARTICLE 12 — CONSENT

12.1 FlourishBx collects the Child Record because you chose to enter it, having accepted the Terms of Use and this Policy at signup, where both were linked and had to be affirmatively agreed to before an account could be created.

12.2 That consent covers the purposes at Section 10.1 and nothing else. It is not consent to any purpose at Section 10.2.

12.3 You may withdraw consent at any time by writing to contact@getflourishbx.com or by deleting your account. Withdrawal is as easy as giving consent was, and FlourishBx will not obstruct it or make you explain.

12.4 Withdrawing consent stops future Processing. It does not make past Processing unlawful. If you also want what was already collected deleted, say so — or delete your account, which does both. See Section 18.6.

12.5 FlourishBx will not ask you to consent to anything as a condition of using the App, beyond what is necessary to provide it. There is no bundled consent, and no consent to marketing, profiling, or data sharing anywhere in the signup flow.

12.6 A new purpose requires new consent. FlourishBx will not rely on the consent you gave at signup to justify a use you were not told about.

---

ARTICLE 13 — IF YOU CONNECT A PROVIDER LATER

This Article describes the single most consequential change that can happen to your account.

13.1 What connecting does

If you connect a BCBA or clinic and they accept, your account becomes a Connected Account. From that moment the provider — not FlourishBx — controls your child's record.

13.2 What changes

	Before connecting	After connecting
Who controls the Child's record	FlourishBx	The provider
Who you ask to delete it	FlourishBx	The provider
Can the Behavior Logs be deleted on request	Yes	No — clinical documentation
Who reads your notes	Nobody outside FlourishBx	The provider reads all of them
Governing policy	This one	The connected policy
Governing law	Consumer health data statutes	HIPAA, plus a Business Associate Agreement

13.3 It is your decision

FlourishBx does not connect a provider to your account without action by you, and no provider can attach themselves to your child's record unilaterally.

13.4 What happens to what you already recorded

13.4.1 Information you recorded before connecting may become part of the clinical record the provider controls.

13.4.2 That means logs you could previously have deleted may become logs you cannot. This is the practical consequence most easily missed, and it is why this Article exists.

13.4.3 Information recorded before the connection transfers with the rest. FlourishBx will say so at the point of connecting, before you confirm it, so that the change is a choice rather than a surprise.

13.5 You will be told first

FlourishBx will make the change of policy clear at the point of connecting, and will not switch the governing policy silently.

13.6 If a provider later discharges your child, your account may revert to a Free Account and this Policy applies again. Information already in the clinical record remains the provider's responsibility. See Section 7.3.2 of the Terms of Use.

---

ARTICLE 14 — CHILDREN AND THE APP

14.1 The App is for adults

You must be 18 or older to hold a FlourishBx account. Children do not hold accounts. There is no child-facing mode, no child login, and no feature directed to a child user.

14.2 Information about a child, not from a child

FlourishBx does not knowingly collect Personal Information from a child. Everything about the Child is entered by you.

14.3 COPPA

COPPA governs the online collection of personal information from children under 13. FlourishBx collects none, and operates no service directed to children within the meaning of 16 C.F.R. § 312.2.

14.4 You must have authority

By creating a Child in the App you represent that you are the Child's parent or legal guardian, or an adult authorized by one. The Terms of Use say so at Article 4, and FlourishBx cannot verify it.

14.5 When the Child becomes an adult

14.5.1 When the Child reaches the age of majority — 18 in North Carolina, N.C. Gen. Stat. § 48A-2 — the information is about an adult, and that adult generally has the right to decide who holds it.

14.5.2 On a Free Account there is no clinician to make that determination, so it falls to you. FlourishBx asks that you either close the account, or continue only with the now-adult person's agreement.

14.6 If a child has an account

If you believe someone under 18 has created an account, contact contact@getflourishbx.com and FlourishBx will investigate and delete it promptly.

---

ARTICLE 15 — SECURITY

15.1 The standard FlourishBx holds itself to

15.1.1 HIPAA does not apply to a Free Account, and FlourishBx does not claim that it does. HIPAA reaches covered entities — providers, health plans and clearinghouses — and the business associates who handle protected health information for them. On a Free Account there is no clinician and no covered entity, as Article 5 explains. The Child Record here is consumer health data, not HIPAA protected health information, and it is governed by the statutes named in Article 11.

15.1.2 That is a point about which law applies. It is not a difference in how carefully the information is handled. A child's health information is the same information whether or not a clinician is in the picture, and FlourishBx does not operate two standards of care for it.

15.1.3 So FlourishBx commits, as a term of this Policy, to apply to the Child Record on a Free Account the same safeguards it applies to a clinical record under its Business Associate obligations. Those safeguards are the ones the HIPAA Security Rule requires at 45 C.F.R. Part 164 Subpart C, and they are set out concretely at Sections 15.2 to 15.5. This is enforceable against FlourishBx as a promise in this Policy, which is a different legal route to the same protection.

15.1.4 Two things this does not do. It does not make FlourishBx a covered entity or a business associate, and it does not import clinical record retention. On a Free Account you keep the deletion rights in Articles 18 and 19, which a connected account does not have. Holding the information to a clinical standard of care is not the same as holding it for a clinical retention period.

15.2 Safeguards

FlourishBx maintains administrative, physical and technical safeguards including: encryption in transit using TLS 1.2 or higher; encryption at rest; access controls enforced in the database itself, so a request for a record you are not entitled to returns nothing however it is made; automatic session expiry; and throttling of repeated failed sign-in attempts.

15.2.1 Only what is needed. FlourishBx uses and discloses the least information necessary for the purpose at hand, and does not grant broader access because broader access is convenient.

15.2.2 The people who can reach it. Every person with access to the Child Record is bound in writing to keep it confidential, is given access only where their work requires it, and has that access withdrawn when it no longer does. Misuse is a matter for sanction and, where the law requires, for notification to you.

15.2.3 Service providers. FlourishBx will not place a Child Record with a service provider that has not committed in writing to protect it to a standard no lower than this Article, and to use it for no purpose of its own.

15.3 Access logging

Reads of a Child Record made through the Application are logged, including reads by FlourishBx personnel. The log records who read what, and when.

15.3.1 What that log does and does not cover. It is kept by the Application, so it records access that happens through the Application. It is not a record of every conceivable route to the underlying database — access by a database administrator acting outside the Application is governed by the controls in Section 15.2 and by FlourishBx's internal procedures rather than captured in this log. FlourishBx states this plainly rather than describe the log as complete.

15.4 No guarantee

NO SYSTEM IS COMPLETELY SECURE. FlourishBx does not guarantee that information will never be accessed, disclosed, altered or destroyed without authorization.

15.5 If a Security Incident affects you

15.5.1 FlourishBx will notify you without unreasonable delay, and in no case later than sixty (60) days after discovery — the outer limit HIPAA sets for a covered entity at 45 C.F.R. § 164.404, adopted here under Section 15.1.3 — and sooner where N.C. Gen. Stat. § 75-65 or the breach notification statute of your State requires it.

15.5.2 There is no clinician to notify you on FlourishBx's behalf. On a connected account HIPAA puts that duty on the provider. Here it is FlourishBx's, directly and without intermediary, and the sixty-day limit runs against FlourishBx itself rather than against anyone it reports to.

15.5.3 The notice will describe, so far as then known: what happened, when, what categories of information were involved, what FlourishBx has done, what you can do, and how to reach a person about it.

15.5.4 FlourishBx will not delay a notice to complete an investigation, and will supplement it as more becomes known.

15.6 Reporting a concern

Report a suspected vulnerability to contact@getflourishbx.com. FlourishBx will not pursue a good-faith researcher who reports to that address, accesses no more than needed to demonstrate the issue, and does not disclose publicly before FlourishBx has had a reasonable opportunity to fix it.

15.7 Do not email details to support

Email is not secure. Do not put the Child's name or health details in an email or support message. Describe the problem and FlourishBx will ask for what it needs through a secure route.

---

ARTICLE 16 — INFORMATION COLLECTED AUTOMATICALLY

16.1 FlourishBx's hosting provider records standard server logs when the App contacts FlourishBx's servers: IP address, the request, the response, and the time. These exist to keep the service running and secure, and for nothing else.

16.2 FlourishBx records sign-in attempts, including failures, to protect your account.

16.3 The App contains no advertising, no cross-app or cross-site tracking, no advertising identifier, no social media pixel, and no third-party analytics software development kit.

16.4 The App does not track you across other companies' apps or websites.

16.5 FlourishBx operates its own crash reporting. Diagnostic reports are stripped of personal information on your device before they are sent, and stripped again when they arrive. They are stored on infrastructure FlourishBx controls. No third-party crash reporting service is used, so there is no additional recipient of your information to disclose here.

---

ARTICLE 17 — DISCLOSURE

17.1 Categories of recipient

Who	What for
Google LLC (Google Cloud Platform)	Runs FlourishBx's servers, database, file storage and sign-in, in the United States
Google LLC (Google Workspace)	Sends and receives account email such as invitations, password resets and support
Supabase, Inc.	Being retired. Nothing flows to Supabase any more - FlourishBx's servers, database, sign-in and email all moved to Google in September and October 2026. The project is suspended and still holds records created before that move, pending their deletion. It is listed because it holds data, not because it receives any
Crash diagnostics	Processed on FlourishBx's own servers and scrubbed of personal information before they are sent. No third-party crash reporting service is used
Professional advisors under a duty of confidentiality	Legal and accounting advice

17.1.1 There is no provider or clinic on this list, because on a Free Account there is none.

17.1.2 Each Service Provider Processes information on FlourishBx's instructions only, is contractually prohibited from using it for its own purposes, from selling it, and from retaining it after the engagement ends.

17.1.3 FlourishBx remains answerable to you for what its Service Providers do. Pointing at a vendor is not an answer FlourishBx will give.

17.2 Other disclosures

FlourishBx may disclose information:

• when required by law — a subpoena, court order, warrant, or other lawful demand. FlourishBx will produce only what the demand requires and will notify you where it is lawful and practical before producing anything;
• to prevent serious harm — where FlourishBx reasonably believes disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person, limited to what is necessary and to those able to help;
• to establish or defend a legal claim, limited to what is necessary; and
• in a merger, acquisition, financing or sale of assets, in which case the acquirer must assume this Policy as to information already collected, and FlourishBx will post notice before information transfers.

17.2.1 A change of ownership does not lower the protections here. Section 10.2 binds any successor as to information already collected.

17.2.2 Where Consumer Health Data is involved, the restrictions of RCW 19.373 apply to a transfer under the corporate-transaction limb as they do to any other sharing, and FlourishBx will obtain consent where that statute requires it.

17.3 The App is not an emergency service

THE APP IS NOT MONITORED IN REAL TIME AND IS NOT AN EMERGENCY SERVICE. Recording a crisis behavior does not summon help and does not alert anyone. On a Free Account there is not even a clinician who might later read it. If a child is in danger, call 911 or your local emergency number.

17.4 Where your information is

FlourishBx's servers are in the United States, and information is stored and Processed there. The App is intended for use in the United States.

---

ARTICLE 18 — YOUR RIGHTS

18.1 Everything is addressed to us

On a Free Account every right below is exercised against FlourishBx. Write to contact@getflourishbx.com. There is no clinician for FlourishBx to refer you to, and FlourishBx will not tell you a request is out of its hands.

18.2 What you can ask for

• Know what FlourishBx holds about you and the Child, and where it came from;
• Get a copy in a portable, readable format;
• Correct anything inaccurate;
• Delete it — see Sections 18.6 and 18.7;
• Withdraw consent — see Article 12;
• Object to a use you disagree with, and get a reasoned answer.

18.3 FlourishBx honors these for everyone

Wherever you live, and whether or not a statute in your State requires it. FlourishBx does not condition a privacy right on residency.

18.4 Verification and authorized agents

18.4.1 FlourishBx will verify a request comes from you, because acting on an unverified request would itself be a privacy failure. Verification is normally a confirmation to the email address on your account.

18.4.2 FlourishBx will not ask for a government identification document to answer an ordinary request about your own account.

18.4.3 An authorized agent may act for you on written proof of authority. FlourishBx may still verify with you directly.

18.5 Timing

18.5.1 FlourishBx acknowledges within 10 Business Days.

18.5.2 FlourishBx responds substantively within 45 days, and where more time is reasonably needed will say so within the first 45 days and respond within a further 45. This mirrors Cal. Civ. Code § 1798.130(a)(2).

18.5.3 A deletion request under MHMDA is honored within thirty (30) days, consistent with RCW 19.373.080(4), which is shorter than the general period above and governs where it applies.

18.6 Deletion on a Free Account

18.6.1 There is no clinician and no clinical retention duty standing in the way of deletion on a Free Account. This is a real difference from a connected account, where the logs are clinical documentation the provider must keep.

18.6.2 In the app, from Settings, or on a written request to contact@getflourishbx.com, FlourishBx will delete the Behavior Logs, the Child Record and Your Account Information from the live service and, on a request under RCW 19.373, from backups in accordance with RCW 19.373.080, subject to Section 19.3. Both routes do the same thing.

18.6.2.1 What "Your Account Information" means here. Your name, the caregiver role you chose, your email address and your sign-in identity are erased, and the account can no longer be signed in to. The record itself is not removed from the database, because of what 18.6.3 describes; it is emptied of anything that identifies you.

18.6.3 Two things are kept, and FlourishBx would rather say so than let you discover it. The guardian attestation — the statement you made that you have legal authority in respect of the Child, in the words you were shown, with its date and version — and the record that you accepted these terms, also with its date and version. Both are kept for the retention period at Article 21, which for an attestation is the longer of six years from when it was made or six years after the Child turns eighteen. The link from those records to the Child Record is removed when the Child Record is deleted.

18.6.3.1 The attestation contains the Child's given name, because the sentence you agreed to named them. That name therefore outlives the deletion of the Child Record.

18.6.3.2 Why they are kept. They are the only evidence that an adult ever asserted authority over that Child, and they are what FlourishBx would be asked to produce if that were ever disputed. Deleting them would leave nobody — including you — able to show what was agreed, or when.

18.7 What the in-app delete control does, and what it does not

This Section describes the control as it behaves today. Read it with Section 18.6: the control and a written deletion request are not the same thing.

18.7.1 The "Delete Account" control in the app does each of the following: it ends your access immediately, so you can no longer sign in; it erases your name and your stated relationship to the child from your profile; it severs the link between your account and the child's record; and it marks the profile closed, with the date.

18.7.2 It does not do the following. It does not remove the underlying sign-in record, so your email address and password credential are retained. It does not delete the Behavior Logs.

18.7.3 Before anything is closed, the app offers you a copy. The control offers to save the child's full logged history to your device as a spreadsheet file, and you may take that copy and then cancel without closing anything.

18.7.4 To have the Behavior Logs and the retained sign-in record erased as well, make the request under Section 18.6. Writing to contact@getflourishbx.com reaches a person; the in-app control does not.

18.8 If FlourishBx says no

18.8.1 FlourishBx will tell you why, in writing, and identify the exception relied on.

18.8.2 You can appeal by replying with the word "Appeal." A different person reviews it, and FlourishBx responds within 45 days.

18.8.3 If the appeal is denied, FlourishBx will tell you how to complain, and you may complain whether or not you appealed:

• your State Attorney General — for Washington residents, the Attorney General enforces MHMDA;
• the California Privacy Protection Agency, if you are a California resident;
• the Federal Trade Commission, at reportfraud.ftc.gov.

18.8.4 The HHS Office for Civil Rights is not the right body for a Free Account, because it enforces HIPAA and HIPAA does not apply here. It is the right body for a connected account.

18.8.5 FlourishBx will not require you to waive a right, sign a release, or agree to arbitration as a condition of answering a privacy request.

18.9 No retaliation

FlourishBx will never deny you the App, charge you, delay you, degrade the service, or treat you differently because you exercised a right. Consistent with Cal. Civ. Code § 1798.125. The App is free and stays free.

---

ARTICLE 19 — HOW LONG INFORMATION IS KEPT

What	How long
Your Account Information	Until you close your account, or 24 months after your last sign-in, whichever is first
The Child Record, including Behavior Logs	Until you delete it, or the account is closed — there is no clinical retention duty on a Free Account
Server logs	90 days
Sign-in and access logs	12 months
Records of privacy requests and outcomes	24 months, to demonstrate compliance
Nicknames and colors (Device Data)	On your phone only; erased when you uninstall

19.1 FlourishBx does not keep information longer than stated merely because it might be useful later.

19.2 Where a legal hold, investigation, or unresolved dispute requires it, FlourishBx may retain information beyond these periods for that purpose only, and will delete it when the reason ends.

19.3 Backups cycle on a rolling basis. Information deleted from the live service may persist in an encrypted backup until that backup expires, and is not restored to the live service except as part of a general disaster recovery. On an MHMDA deletion request, FlourishBx will also delete from backups in accordance with RCW 19.373.080.

---

ARTICLE 20 — CHANGES TO THIS POLICY

20.1 FlourishBx may amend this Policy. The "Last Updated" date shows when, and the version number changes with it.

20.2 Material changes. A change is material if it adds a category of information collected, adds a permission the App requests, adds a category of recipient, adds a purpose of use, materially reduces a right in Article 18, or would make Section 10.2 untrue.

20.3 For a material change FlourishBx will give notice in the App and by email before it takes effect, and not less than 30 days before, except where a shorter period is required by law or necessary to address a security risk.

20.4 FlourishBx will not apply a materially different Policy to information already collected without your consent where consent is required — and for Consumer Health Data it generally is. See Article 12.

20.5 Prior versions are available on request from contact@getflourishbx.com, and FlourishBx retains them for 24 months.

20.6 Continuing to use the App after a material change takes effect indicates acceptance. If you do not accept it, you may close your account.

---

ARTICLE 21 — GENERAL

21.1 Entire statement on privacy. This Policy is FlourishBx's entire statement of its privacy practices for a Free Account.

21.2 Precedence. Where this Policy conflicts with the Terms of Use on a matter of privacy, this Policy governs.

21.3 Relationship to the connected policy. The two policies are mutually exclusive. Exactly one governs your account at any moment, determined by whether a provider is connected. See Article 13.

21.4 Severability. If any provision is held invalid or unenforceable, it is modified to the minimum extent necessary to make it enforceable, or if it cannot be, severed. The remainder stays in force.

21.5 No waiver. A failure to enforce a provision is not a waiver of it. A waiver is effective only in writing.

21.6 Survival. Articles 3, 4, 5, 15, 18, 19 and 21 survive the closure of your account, as to information FlourishBx still holds.

21.7 No third-party beneficiaries. This Policy creates no rights in any person other than you, except that the Child is an intended beneficiary of Articles 8, 10, 11, 15 and 17 and may enforce them through their personal representative.

21.8 Assignment. FlourishBx may assign this Policy in a merger, acquisition or sale of assets, subject to Section 17.2. You may not assign it.

21.9 Summaries are not binding. "The Short Version" and every table are for convenience. Where they differ from an Article, the Article governs.

21.10 Language. Written in English. Any translation is for convenience and the English version governs, except where a law applicable to you provides otherwise.

21.11 Governing law. Governed by the laws of the State of North Carolina, without regard to conflict of laws principles. Nothing here deprives you of the protection of a mandatory consumer privacy law of your State of residence — including MHMDA, which applies of its own force.

21.12 No legal or clinical advice. Nothing here is legal or clinical advice.

---

ARTICLE 22 — CONTACT

FlourishBx LLC d/b/a FlourishBx Attention: Privacy

Purpose	Address
Privacy requests and questions	contact@getflourishbx.com
Security reports	contact@getflourishbx.com
General support	contact@getflourishbx.com

22.1 FlourishBx acknowledges a privacy request within 10 Business Days.

22.2 If you are not satisfied, Section 18.8.3 lists where to complain.

---