FlourishBx LLC d/b/a FlourishBx

---

Effective Date: 25 October 2026 Last Updated: 25 October 2026 Version: 2 Applies to: the FlourishBx Clinician Dashboard at app.getflourishbx.com.

---

NOTICE TO THE READER

THE DASHBOARD PROCESSES PROTECTED HEALTH INFORMATION ABOUT CHILDREN.

This Policy states how FlourishBx LLC handles information in the Dashboard, the capacity in which it does so, and what rights exist against whom.

IT IS NOT THE FLOURISHBX WEBSITE PRIVACY POLICY, which governs getflourishbx.com and states that no health information is handled there. IT IS NOT A BUSINESS ASSOCIATE AGREEMENT. See Section 1.4.

IF YOU ARE A PARENT OR CAREGIVER, the document that concerns you is the FlourishBx Caregiver App Privacy Policy, not this one.

---

SUMMARY (NON-BINDING)

Furnished for convenience. Where it differs from Articles 1 through 24, those Articles govern. See Section 23.8.

• FlourishBx is software. It is not a health care provider and renders no clinical judgment.
• You decide what goes in. The clinical record you build is yours. FlourishBx holds it for you.
• FlourishBx does not sell Personal Information, does not advertise, and does not use your clinical data to train artificial intelligence. Article 16.
• FlourishBx does not monetize de-identified clinical data. A deliberate departure from common practice in this market. Section 16.2.
• Every read of a Client record is logged, including reads by FlourishBx personnel. Section 11.4.
• You can export everything, at any time, at no charge — including while suspended for non-payment. Article 13.
• FlourishBx will help you answer an individual's HIPAA access, amendment and accounting requests. Article 9.

---

ARTICLE 1 — SCOPE AND RELATIONSHIP TO OTHER AGREEMENTS

1.1 The product this Policy governs

This Product Privacy Policy (this "Policy") governs the FlourishBx Clinician Dashboard (the "Dashboard"), through which Board Certified Behavior Analysts, clinic administrators and authorized staff manage Client records, behavior definitions, intervention strategies and session documentation.

1.2 What this Policy does not govern

1.2.1 The marketing website at getflourishbx.com, governed by the separate Website Privacy Policy. That site handles no health information.

1.2.2 The Caregiver App, governed by its own policy. Data flows between the two products; the policies do not merge.

1.2.3 Anything a Clinician does with information outside the Dashboard, including exported files once they leave FlourishBx's systems.

1.2.4 A Covered Entity's own obligations under HIPAA, which are not delegated to FlourishBx by this Policy or by any BAA.

1.3 Incorporation

This Policy is incorporated by reference into the Subscription Agreement.

1.4 This Policy is not a Business Associate Agreement

THIS POLICY DOES NOT CONSTITUTE, SUBSTITUTE FOR, OR SATISFY THE REQUIREMENT FOR A BUSINESS ASSOCIATE AGREEMENT under 45 C.F.R. §§ 164.502(e) and 164.504(e). A BAA must be separately executed. Where a BAA is in force, it prevails over this Policy as to PHI to the extent of any conflict. See Section 23.8.

---

ARTICLE 2 — DEFINITIONS

2.1 "Applicable Privacy Law" means each federal, state and local statute, regulation, rule and binding regulatory guidance of the United States governing the Processing of Personal Information or PHI in connection with the Dashboard.

2.2 "BAA" means a Business Associate Agreement satisfying 45 C.F.R. §§ 164.504(e) and 164.314(a).

2.3 "Breach" has the meaning given at 45 C.F.R. § 164.402.

2.4 "Business Associate" has the meaning given at 45 C.F.R. § 160.103.

2.5 "Business Day" means a day other than a Saturday, Sunday or day on which national banking institutions in North Carolina are authorized or required to close.

2.6 "Caregiver" means an individual granted access to a Client's record through the Caregiver App.

2.7 "Caregiver App" means the FlourishBx mobile application for parents and caregivers.

2.8 "Client" means an individual receiving services about whom a record is maintained in the Dashboard. A Client is a natural person and is usually a minor.

2.9 "Clinic Account" means a Dashboard account established for an organization under a written order form, with multiple Clinician users.

2.10 "Clinician" means a BCBA, clinic administrator or other individual holding Dashboard credentials.

2.11 "Controller" means the person that determines the purposes and means of Processing, and includes a "business" under Cal. Civ. Code § 1798.140(d).

2.12 "Covered Entity" has the meaning given at 45 C.F.R. § 160.103.

2.13 "Customer Record" means all information a Clinician enters into, uploads to, or generates within the Dashboard concerning a Client, including identifiers, dates of birth, diagnoses, clinical notes, behavior definitions, intervention strategies, behavior logs, session documentation and uploaded media.

2.14 "De-Identified Information" means information meeting the standard at 45 C.F.R. § 164.514(b) and, where applicable, Cal. Civ. Code § 1798.140(m).

2.15 "Designated Record Set" has the meaning given at 45 C.F.R. § 164.501.

2.16 "Electronic PHI" or "ePHI" has the meaning given at 45 C.F.R. § 160.103.

2.17 "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as amended by the HITECH Act, and the regulations at 45 C.F.R. Parts 160, 162 and 164.

2.18 "Independent Practitioner Account" means a Dashboard account held by an individual Clinician on the Free, Pro or Caseload plan, not established under an organizational order form.

2.19 "Personal Information" means information that identifies, relates to, describes, or is reasonably linkable to a particular individual or household. Excludes De-Identified Information.

2.20 "PHI" or "Protected Health Information" has the meaning given at 45 C.F.R. § 160.103.

2.21 "Process" or "Processing" means any operation performed on Personal Information or PHI, including collection, storage, use, disclosure, transmission, alteration and deletion.

2.22 "Processor" means a person that Processes on behalf of and at the direction of a Controller, and includes a "service provider" under Cal. Civ. Code § 1798.140(ag).

2.23 "Required by Law" has the meaning given at 45 C.F.R. § 164.103.

2.24 "Security Incident" has the meaning given at 45 C.F.R. § 164.304.

2.25 "Sensitive Personal Information" has the meaning given at Cal. Civ. Code § 1798.140(ae) and includes information concerning health.

2.26 "Subprocessor" means a third party engaged by FlourishBx to Process Personal Information or PHI in connection with the Dashboard. A Subprocessor that handles PHI is a subcontractor within 45 C.F.R. § 164.308(b)(2).

2.27 "Unsecured PHI" has the meaning given at 45 C.F.R. § 164.402.

2.28 "Workforce" has the meaning given at 45 C.F.R. § 160.103.

2.29 "You" or "Your" means the Clinician or organization holding the account.

---

ARTICLE 3 — RULES OF CONSTRUCTION

3.1 "Include," "includes" and "including" are followed by "without limitation."

3.2 "Or" is not exclusive. "Shall" and "will" are mandatory; "may" is permissive.

3.3 References to statutes and regulations include amendments, recodifications and implementing regulations.

3.4 Headings are for convenience and do not affect interpretation.

3.5 Where a term is defined by Applicable Privacy Law, that statutory definition governs as applied to Processing subject to that law.

3.6 This Policy shall not be construed against FlourishBx by reason of authorship.

3.7 Each obligation in this Policy operates independently; the unenforceability of one does not impair another. See Section 23.1.

---

ARTICLE 4 — RECORDS AND TRANSPARENCY

4.1 Records of Processing. FlourishBx maintains a written record of the categories of Processing it carries out on Your behalf, the Subprocessors engaged, and the security measures applied, and makes that record available to You on reasonable written request.

4.2 Cooperation with regulators. FlourishBx will make its internal practices, books and records relating to the use and disclosure of PHI available to the Secretary of Health and Human Services as 45 C.F.R. § 164.504(e)(2)(ii)(I) requires.

4.3 Your inspection rights. On reasonable notice, not more than once in any twelve (12) month period absent a Security Incident, and subject to confidentiality, FlourishBx will respond to a written security questionnaire or provide then-current third-party assessment documentation.

---

ARTICLE 5 — THE CAPACITY IN WHICH FLOURISHBX ACTS

THIS ARTICLE DETERMINES WHO A REQUEST IS ADDRESSED TO. READ IT BEFORE ARTICLE 17.

FlourishBx's role is not uniform. It depends on how the account was established. Policies in this market commonly assert one blanket role; that assertion would be inaccurate here, because FlourishBx sells to individuals as well as organizations.

5.1 Clinic Accounts — Processor and Business Associate

5.1.1 The organization is the Controller of the Customer Record and, where it is a Covered Entity, remains responsible for its own HIPAA obligations.

5.1.2 FlourishBx acts as a Processor and, where a BAA is executed, as a Business Associate, Processing only on the organization's documented instructions.

5.1.3 FlourishBx does not determine what is collected about a Client, why, or for how long.

5.1.4 A request from a Client, Caregiver or staff member concerning the Customer Record is directed to the organization. Section 17.4 states what FlourishBx does when such a request arrives at FlourishBx instead.

5.1.5 Unlawful instructions. Where FlourishBx reasonably believes an instruction from the Controller violates Applicable Privacy Law, it will inform the Controller and may suspend that instruction pending resolution.

5.2 Independent Practitioner Accounts — the Clinician is the Controller

5.2.1 There is no organization. The individual Clinician is the Controller, and where that Clinician is a Covered Entity, FlourishBx acts as their Business Associate on the terms of Section 5.1.2.

5.2.2 Section 5.1.4 applies, reading "the Clinician" for "the organization."

5.2.3 If You practise on Your own, this allocation makes You the Controller of the Customer Record. It is stated here plainly because it is easy to miss: the obligations that attach to a Controller are Yours, not FlourishBx's, and they do not change because the practice is a small one.

5.3 Account and billing data — FlourishBx is the Controller

Irrespective of Sections 5.1 and 5.2, FlourishBx is the Controller of: Clinician account data; subscription and billing records (Article 10); security and audit records (Section 11.4); and support correspondence. No Customer Record is Processed under this Section 5.3.

5.4 Caregivers

FlourishBx issues credentials directly to Caregivers through the Caregiver App and is the Controller of a Caregiver's own account data. The Client record a Caregiver sees remains under the Controller identified in Section 5.1 or 5.2.

5.5 No blanket disclaimer of relationship

FlourishBx does not assert that it has no direct relationship with the individuals whose data it Processes. As to Clinician and Caregiver account data it plainly does. Where FlourishBx can act on a request itself, it will.

---

ARTICLE 6 — INFORMATION IN THE DASHBOARD

6.1 The Customer Record — entered by You

Category	Items	PHI
Client identity	First and last name, date of birth, case or record number	Yes
Clinical	Diagnosis, clinical notes, client status including documented service holds	Yes
Behavior definitions	Behavior name, icon, crisis-protocol designation, active status	Yes
Intervention strategies	Strategy text, associated media, plan designation	Yes
Behavior logs	Behavior, strategy applied, outcome, duration, free-text notes, timestamp, author, author's caregiver role	Yes
Session documentation	Session records and amendments	Yes
Relationships	Links between a Client, their Clinician, organization and Caregivers	Yes
Uploaded media	Video and files uploaded to a Client's record	Yes

6.1.1 Free-text fields carry whatever You put in them. FlourishBx does not inspect, filter or restrict their content, and they must be treated as capable of containing PHI in every case.

6.1.2 Behavior logs may be authored by Caregivers in the Caregiver App and appear in the Dashboard, with authorship and the author's stated caregiver role recorded.

6.2 Clinician account data

Name, email address, authentication credentials, role and permissions, organization membership, plan, and any professional credential identifier submitted for verification.

6.3 Collected automatically

Server log data (IP address, browser type and version, operating system, resource requested, timestamp); authentication events including failed sign-in attempts; and access records under Section 11.4.

6.4 Not collected

As of the Effective Date the Dashboard collects no precise geolocation, no biometric identifiers, no audio recordings and no advertising identifiers, and deploys no advertising or cross-site tracking technology.

6.4.1 This differs from several competing platforms, some of which collect precise device location for electronic visit verification. If FlourishBx adds such a feature, this Policy will be amended before it ships (Section 22.2).

6.5 Do not place PHI in support channels

You shall not include PHI in support tickets, email to FlourishBx, chat messages or bug reports. Where PHI is nonetheless received through such a channel, FlourishBx will handle it under the BAA and delete it once the matter is resolved.

---

ARTICLE 7 — HIPAA

7.1 FlourishBx is not a Covered Entity. It is a software company, renders no clinical judgment and provides no treatment.

7.2 Business Associate status. Where You are a Covered Entity, FlourishBx acts as Your Business Associate, governed by the executed BAA together with 45 C.F.R. Parts 160 and 164.

7.2.1 No PHI may be placed in the Dashboard before a BAA is executed.

7.3 Use and disclosure limits. FlourishBx uses and discloses PHI only as the BAA permits, as Required by Law, and as necessary for the Dashboard's functions and its own proper management and administration. It does not use PHI for marketing, does not sell PHI, and does not use PHI for advertising.

7.4 Subcontractors. Each Subprocessor that creates, receives, maintains or transmits PHI is bound by written agreement to restrictions no less protective than those applying to FlourishBx, as 45 C.F.R. § 164.308(b)(2) requires.

7.5 Minimum necessary. FlourishBx requests and uses the minimum PHI necessary, consistent with 45 C.F.R. § 164.502(b).

7.6 Mitigation. FlourishBx will mitigate, to the extent practicable, any harmful effect known to it of a use or disclosure of PHI in violation of the BAA, as 45 C.F.R. § 164.504(e)(2)(ii)(F) requires.

7.7 Reporting. FlourishBx will report to You any use or disclosure of PHI not permitted by the BAA, and any Security Incident of which it becomes aware, in accordance with Article 12.

---

ARTICLE 8 — PURPOSES OF PROCESSING

8.1 Enumerated purposes

8.1.1 to make the Dashboard's functions available to You; 8.1.2 to authenticate You and administer Your account and permissions; 8.1.3 to synchronize the Client record with the Caregiver App for authorized Caregivers; 8.1.4 to generate reports and exports You request; 8.1.5 to provide support at Your request; 8.1.6 to detect, investigate, prevent and respond to fraud, abuse, Security Incidents and technical malfunction; 8.1.7 to administer billing under Article 10; and 8.1.8 to comply with law and to establish, exercise or defend legal claims.

8.2 Purposes expressly excluded

FlourishBx does not:

8.2.1 sell Personal Information or PHI; 8.2.2 use them for advertising, cross-context behavioral advertising or targeted advertising; 8.2.3 subject any person to a decision producing legal or similarly significant effects based solely on automated Processing; 8.2.4 use the Customer Record to develop, train, fine-tune or evaluate artificial intelligence or machine learning models, identified or de-identified, its own or a third party's (Section 16.3); or 8.2.5 Process the Customer Record for its own purposes beyond what Sections 8.1.1–8.1.8 require.

8.3 Secondary use

FlourishBx shall not Process the Customer Record for a purpose not enumerated in Section 8.1 without the Controller's documented instruction, and shall not Process account data under Section 5.3 for a new purpose without notice under Section 22.2.

---

ARTICLE 9 — SUPPORTING INDIVIDUAL RIGHTS UNDER HIPAA

This Article was absent from Version 1. It is the most significant addition.

A Covered Entity cannot satisfy an individual's HIPAA rights if its Business Associate will not help. FlourishBx commits to the following.

9.1 Access — 45 C.F.R. § 164.524

Where PHI in the Dashboard forms part of a Designated Record Set, FlourishBx will make it available to You, in the time and manner You reasonably require, so that You can respond to an individual's request for access. The export facility in Article 13 is the ordinary means. FlourishBx will not charge for this.

9.2 Amendment — 45 C.F.R. § 164.526

FlourishBx will make PHI available for amendment and will incorporate any amendment You direct, in the time and manner You reasonably require. Where the Dashboard records an amendment, the original entry and the amendment are both retained, so the clinical record shows what changed and when.

9.3 Accounting of disclosures — 45 C.F.R. § 164.528

FlourishBx will document disclosures of PHI it makes, and information related to them, and will make that documentation available to You so that You can provide an individual with an accounting. Section 11.4 access records are the primary source.

9.4 Restriction requests — 45 C.F.R. § 164.522

Where You agree to a restriction on the use or disclosure of an individual's PHI and notify FlourishBx in writing, FlourishBx will give effect to that restriction to the extent the Dashboard is technically capable, and will tell You promptly where it is not.

9.5 Timing

FlourishBx will respond to a request under this Article within 10 Business Days, or sooner where You state that a statutory deadline requires it.

9.6 No independent determination

FlourishBx does not decide whether an individual is entitled to access, amendment or an accounting. That determination is the Covered Entity's. FlourishBx supplies the information and the mechanism.

---

ARTICLE 10 — BILLING DATA

10.1 Subscriptions are transacted through Stripe, Inc.. FlourishBx does not receive or store full payment card numbers.

10.2 No PHI is transmitted to the payment processor. Billing carries plan, quantity and billing contact only. Client names, dates of birth, diagnoses and record identifiers are never included in payment metadata.

10.3 Billing records are retained under Section 14.4.

---

ARTICLE 11 — SECURITY

11.1 Safeguards

FlourishBx implements administrative, physical and technical safeguards appropriate to the nature of the information, consistent with 45 C.F.R. Part 164 Subpart C, including:

11.1.1 encryption in transit and at rest; 11.1.2 row-level authorization enforced in the database, so a request exceeding a user's permissions returns nothing rather than relying on the interface to hide it; 11.1.3 role-based access and per-organization scoping; 11.1.4 automatic session expiry; 11.1.5 lockout and throttling on repeated failed authentication; and 11.1.6 multi-factor authentication available to clinician accounts.

11.2 Workforce

11.2.1 Access by FlourishBx Workforce members is restricted to those whose role requires it and is subject to written confidentiality obligations.

11.2.2 Training. Workforce members with access to PHI receive privacy and security training before access is granted and at least annually thereafter, consistent with 45 C.F.R. § 164.308(a)(5).

11.2.3 Sanctions. FlourishBx maintains and applies a written sanction policy for Workforce members who violate this Policy or the BAA, as § 164.308(a)(1)(ii)(C) requires.

11.2.4 Termination. Access is revoked on the same Business Day a Workforce member's role ends.

11.3 Subprocessors and change notice

11.3.1 The Subprocessors engaged as at the Effective Date are listed in Section 18.1.

11.3.2 Advance notice. FlourishBx will give You not less than 30 days' written notice before engaging a new Subprocessor that will Process PHI, and will identify it by name and function.

11.3.3 Objection. Where You object on reasonable data-protection grounds within that period, FlourishBx will work with You in good faith and, failing resolution, You may terminate the affected subscription without penalty and receive a pro rata refund of prepaid fees.

11.4 Access logging

Reads of Client records are logged, recording who accessed which record and when. This applies to FlourishBx Workforce members as well as Your users.

11.4.1 Scope limitation, stated plainly. Logging is presently implemented at the application layer — it records access performed through the Dashboard's screens. Exhaustive query-level database auditing is planned and is not yet in place.

11.4.2 Access records are retained for 24 months and are available to You through the Dashboard.

11.5 Data location

Personal Information and PHI are stored and Processed in the United States. FlourishBx will not transfer them outside the United States without amending this Policy under Section 22.2 and, where a BAA requires it, obtaining Your consent.

11.6 Uploaded media

11.6.1 Media You upload — for example a short video demonstrating a strategy — is stored in private storage and is never served from a public address. It is delivered only through short-lived links that expire.

11.6.2 Writing is restricted to You. No other user can add to or alter the media You upload.

11.6.3 Reading is not yet restricted to a named list of viewers. Strategy media exists in order to be shared from Clinician to Caregiver, and the per-viewer read restriction is a control FlourishBx is building rather than one it has. FlourishBx states this rather than describe reads as restricted when they are not. Until that control is in place, treat uploaded media as visible to users of the service holding a current link, and do not upload media containing information You would not wish a Caregiver connected to the service to see.

11.7 No guarantee

NO METHOD OF TRANSMISSION OR STORAGE IS COMPLETELY SECURE. FLOURISHBX DOES NOT GUARANTEE ABSOLUTE SECURITY AND MAKES NO SUCH WARRANTY. This Section does not limit any obligation in Article 12.

---

ARTICLE 12 — SECURITY INCIDENTS AND BREACH NOTIFICATION

12.1 Discovery and notice

FlourishBx will notify You of a Breach of Unsecured PHI without unreasonable delay and in no case later than sixty (60) days after discovery, as 45 C.F.R. § 164.410 requires. Where the BAA specifies a shorter period, the shorter period governs.

12.1.1 FlourishBx will use reasonable efforts to notify You within 5 Business Days of discovery, ahead of the statutory outer limit.

12.2 Contents of the notice

To the extent known, and supplemented as further information becomes available: the individuals affected; the nature of the PHI involved; what occurred and when; what FlourishBx has done to investigate, mitigate and remediate; and a contact for further information.

12.3 Unsuccessful Security Incidents

Routine unsuccessful attempts — pings, port scans, failed sign-in attempts and similar events that do not result in unauthorized access — are logged and are reported in aggregate on request rather than individually.

12.4 Cooperation

FlourishBx will cooperate with Your investigation and with any notification You are required to make under 45 C.F.R. §§ 164.404–164.408 or state law. FlourishBx will not make notification to affected individuals on Your behalf unless You direct it in writing, since the Covered Entity controls that communication.

12.5 Reporting to FlourishBx

Security concerns may be reported to contact@getflourishbx.com.

---

ARTICLE 13 — YOUR DATA IS YOURS

13.1 Ownership. As between FlourishBx and You, the Customer Record is Yours. FlourishBx claims no ownership and acquires no licence beyond what Article 8 requires.

13.2 Export. You may export the Customer Record at any time, at no charge, in a usable format — while active, while suspended for non-payment, and for ninety (90) days after closure. Timings are in the Pricing and Billing Policy, Article 12, the single source of truth for them.

13.3 Format. Exports are provided as comma-separated values (CSV). Uploaded media are not included in an export and must be downloaded from the relevant record or requested separately.

13.4 Why. Clinicians and clinics bear professional and regulatory record-retention duties. A software vendor should never be the reason its customer cannot meet them. FlourishBx does not withhold records to compel payment and charges no fee to return them.

---

ARTICLE 14 — RETENTION, RETURN AND DELETION

14.1 The Customer Record is retained while the account remains open, plus the post-closure window in Section 13.2.

14.2 You control deletion within the Dashboard, subject to Your own retention obligations. FlourishBx will not delete a Client record on a Caregiver's instruction; that instruction goes to the Controller.

14.3 Return or destruction on termination. On termination, and at Your election, FlourishBx will return the Customer Record to You or destroy it, as 45 C.F.R. § 164.504(e)(2)(ii)(J) contemplates.

14.3.1 Certification. Where destruction is elected, FlourishBx will certify the destruction in writing within 30 days.

14.3.2 Where return or destruction is infeasible — for example in immutable backups — FlourishBx will extend the protections of the BAA to that PHI and limit further use and disclosure to the purposes making return or destruction infeasible, for as long as it is retained.

14.4 Account, billing, security and audit records under Section 5.3 are retained for seven (7) years for legal, tax and security purposes, and are not deleted by a request to delete a Customer Record.

14.5 FlourishBx may retain information where Required by Law, or where necessary to establish, exercise or defend a legal claim, and only while that basis subsists.

14.6 Backups. Deleted data persists in encrypted backups for up to 30 days and is not restored to production after a deletion request.

---

ARTICLE 15 — CAREGIVER ACCESS

15.1 Caregiver access to a Client record is granted and revoked by the Controller and, where the Controller permits, by the primary caregiver. FlourishBx does not decide who may see a Client's record.

15.2 Caregivers cannot read one another's behavior logs. That restriction is enforced in the database, not in the interface. Clinicians see all logs for their Clients, together with who authored each and that author's stated caregiver role.

15.3 On revocation, access ends immediately. Logs a Caregiver already contributed remain part of the Client's clinical record, under the Controller's retention decision.

---

ARTICLE 16 — DE-IDENTIFIED DATA AND ARTIFICIAL INTELLIGENCE

This Article states a position that differs from prevailing practice in this market. It is a commitment, not a description of present inability.

16.1 Aggregate operational metrics. FlourishBx uses aggregate, non-identifying operational metrics — counts of active accounts, feature usage, error rates — to operate and improve the Dashboard. These contain no Personal Information and are not derived from the clinical content of any Customer Record.

16.2 No commercialization of de-identified clinical data. FlourishBx does not create De-Identified Information from the Customer Record for research, benchmarking, publication, licensing, sale or any other commercial purpose, and does not disclose De-Identified clinical information to any third party.

16.2.1 Where FlourishBx Processes De-Identified Information for any purpose, it maintains the safeguards required by Cal. Civ. Code § 1798.140(m) and shall not attempt, and shall contractually prohibit others from attempting, to re-identify it.

16.3 No AI training on client data. FlourishBx does not use the Customer Record to develop, train, fine-tune or evaluate artificial intelligence or machine learning models, and does not transmit the Customer Record to any third-party model provider for any purpose.

16.3.1 Should FlourishBx offer a feature that Processes Client information through an artificial intelligence service, it will be optional, described in this Policy before it is made available, and not enabled by default.

16.3.2 FlourishBx intends to be held to Sections 16.2 and 16.3. Several comparable services take the opposite approach, reserving customer data for artificial intelligence services and placing the burden of obtaining consents on the customer. FlourishBx does not, and the commitment in those Sections is given deliberately.

---

ARTICLE 17 — RIGHTS, AND WHO TO ADDRESS THEM TO

17.1 About the Customer Record — direct to the Controller identified in Article 5. FlourishBx does not decide what is in a Client's clinical record and cannot lawfully alter or release it on a third party's instruction.

17.2 About Your own Clinician account data — direct to FlourishBx, Controller under Section 5.3. Access, correction, deletion, portability and restriction. contact@getflourishbx.com.

17.3 Rights FlourishBx honors for everyone, irrespective of residence and to the extent it is the Controller: access, correction, deletion, portability, withdrawal of consent, and appeal. FlourishBx does not sell or share Personal Information, so no opt-out of sale is required and none is provided.

17.4 Requests that arrive at the wrong place. Where a request concerning a Customer Record reaches FlourishBx, FlourishBx shall within 10 Business Days: (a) acknowledge it; (b) forward it to the Controller; and (c) tell the requester it has done so and who the Controller is.

17.4.1 FlourishBx will not simply decline such a request and let it fall. A person told only to "contact the Customer" may have no way to identify or reach that Customer.

17.5 Verification. FlourishBx verifies identity before acting, requests no more than necessary, and does not Process verification information for any other purpose.

17.6 Timing. Acknowledgment within 10 Business Days; substantive response within 45 days, extendable once by 45 days on notice within the first period.

17.7 Appeal. Where FlourishBx declines, it will say why, and You may appeal by replying "Appeal." Response within 45 days; on denial, a route to complain to the relevant Attorney General.

17.8 Non-discrimination. No denial of service, different price or degraded service for exercising a right.

---

ARTICLE 18 — DISCLOSURE AND STATE LAW

18.1 Categories of recipient

Recipient	Purpose	Receives PHI
Google LLC (Google Cloud Platform)	Application hosting, database, media storage, authentication	Yes — Business Associate Agreement in place
Google LLC (Google Workspace)	Transactional email: invitations, resets, notices	Yes — Business Associate Agreement signed 2 October 2026
Supabase, Inc.	Being retired. No current data path; the suspended project still holds records created before the move to Google Cloud, pending deletion	Yes, for records it still holds
Stripe, Inc.	Payment processing	No — Section 10.2
the NPPES NPI Registry (a public United States government registry; no contract and no disclosure of Protected Health Information)	Professional credential verification	No — Clinician data only
FlourishBx Workforce	Support and operations, per Section 11.2	Yes, logged

18.1.1 Each Subprocessor acts on documented instructions, is contractually barred from using the information for its own purposes, and where it touches PHI is bound under Section 7.4. Changes are notified under Section 11.3.

18.2 Other disclosures

18.2.1 Legal process — where Required by Law, and as the BAA permits. FlourishBx will, where not legally prohibited, notify You before disclosing so You may seek protective relief.

18.2.2 Safety — where FlourishBx reasonably believes the safety or vital interests of any person, particularly a child, are at risk, limited to what is reasonably necessary and consistent with the BAA. THE DASHBOARD IS NOT AN EMERGENCY SERVICE AND IS NOT MONITORED IN REAL TIME.

18.2.3 Corporate transactions — on a merger, acquisition, financing or sale of assets, subject to the acquirer assuming this Policy and the BAA, with notice posted before any Personal Information becomes subject to a materially different policy.

18.3 State privacy statutes

Residents of states with comprehensive privacy statutes — the CCPA as amended by the CPRA, Cal. Civ. Code § 1798.100 et seq.; the Virginia Consumer Data Protection Act, Va. Code § 59.1-575 et seq.; the Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq.; the Connecticut Data Privacy Act; the Texas Data Privacy and Security Act; and the comparable statutes of Utah, Oregon, Montana and Delaware — hold rights of access, correction, deletion and portability.

18.3.1 Most of these statutes exempt PHI held by a Business Associate under HIPAA. Where an exemption applies, HIPAA and the BAA govern. Where it does not, Article 17 applies.

18.3.2 Consumer health data. RCW 19.373 and Nev. Rev. Stat. § 603A.400 et seq. contain their own HIPAA exemptions. Where a Clinician on an Independent Practitioner Account is not a Covered Entity, FlourishBx does not rely on those exemptions, and Article 17 applies in full.

18.4 International

FlourishBx is established in the United States and the Dashboard is intended for use there. See Section 11.5.

---

ARTICLE 19 — CHILDREN

19.1 The Dashboard is used by adult professionals. It is not directed to children and children do not hold Dashboard accounts.

19.2 Client records concern children. That information is entered by Clinicians under the Controller's authority and the consent the Controller has obtained. FlourishBx does not collect it from children directly.

19.3 COPPA, 15 U.S.C. §§ 6501–6506, governs collection from children. FlourishBx does not collect information from children through the Dashboard.

19.4 Obtaining and documenting parental or guardian consent is the Controller's responsibility.

19.5

---

ARTICLE 20 — ACCESSIBILITY

FlourishBx works toward conformance with WCAG 2.1 Level AA. Accessibility is continuing work and no complete conformance is represented. Difficulty using any part of the Dashboard may be reported to contact@getflourishbx.com.

---

ARTICLE 21 — NOTICES

21.1 Notices to You may be given by electronic mail to Your account or billing contact address, or by in-product message, and are effective when sent.

21.2 Notices to FlourishBx must be given in writing at the address in Article 24.

21.3 You shall maintain a current contact address. A notice sent to a stale address on file is effective.

---

ARTICLE 22 — AMENDMENT

22.1 FlourishBx may amend this Policy. The "Last Updated" date shows when it last changed.

22.2 Material amendments. Where an amendment is material — including any change to Article 16, a new category of Subprocessor, a new category of information collected, or any transfer outside the United States — FlourishBx will notify account holders directly and post notice in the Dashboard before it takes effect.

22.3 Continued use is not treated as acceptance where the change concerns PHI; the BAA's amendment provisions govern instead.

---

ARTICLE 23 — GENERAL

23.1 Severability. An invalid provision is modified to the minimum extent needed or severed; the remainder stands, and invalidity in one jurisdiction does not affect another.

23.2 No waiver. Failure to enforce waives nothing; no waiver is effective unless in writing; partial exercise does not preclude further exercise.

23.3 Survival. Articles 7, 9, 11, 12, 13, 14, 16, 17 and 23 survive termination, for as long as FlourishBx retains any information.

23.4 No third-party beneficiaries, save that Clients and Caregivers may rely on Sections 16.2, 16.3, 17.4 and 15.2.

23.5 Assignment. You may not assign without FlourishBx's written consent. FlourishBx may assign in connection with a corporate transaction, subject to Section 18.2.3.

23.6 Language. The English text governs.

23.7 Relationship. Nothing creates a partnership, joint venture, agency or employment relationship.

23.8 Order of precedence. Highest to lowest: mandatory Applicable Privacy Law; the BAA as to PHI; a signed order form or written agreement; the Subscription Agreement; Articles 1–24 of this Policy; the non-binding Summary.

---

ARTICLE 24 — CONTACT

FlourishBx LLC Attention: Privacy Officer Privacy: contact@getflourishbx.com · Security: contact@getflourishbx.com

Response to privacy inquiries within 45 days, or sooner where law requires.

---