Privacy Policy

Reinfora("Reinfora," "we," "us," or "our") provides clinical operations software for ABA and behavioral health organizations. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information—including protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA")—when you visit our website, use our platform, or communicate with us.

When Reinfora processes PHI on behalf of a covered entity or business associate customer, we do so as a business associate under a Business Associate Agreement ("BAA"). This policy supplements, and does not replace, the BAA or your organization's own privacy practices.

We collect information in the following categories:

• Account and profile information: name, email address, phone number, job title, organization affiliation, authentication credentials, and preferences you provide when registering or using the platform.
• Clinical and operational data: client demographics, care team assignments, session notes, program data, schedules, time entries, documents, tasks, and other information your organization enters into Reinfora. Much of this data may constitute PHI.
• Usage and device information: IP address, browser type, device identifiers, log data, feature usage, and diagnostic information collected to secure and improve the service.
• Communications: messages you send to support, demo requests, and feedback.
• Payment information: billing contact details and transaction records. Payment card data is processed by our payment processor and is not stored by Reinfora.

We use collected information to:

• Provide, maintain, and improve the Reinfora platform;
• Authenticate users and enforce role-based access controls;
• Process PHI only as permitted by our BAA and your organization's instructions;
• Respond to support requests and communicate about the service;
• Monitor security, detect fraud, and investigate incidents;
• Comply with legal obligations and respond to lawful requests;
• Analyze aggregated, de-identified usage trends to improve product quality.

We do not sell PHI or personal information. We do not use PHI for marketing without appropriate authorization where required by law.

We may disclose information to:

• Service providers and subprocessors that host infrastructure, provide email delivery, analytics, or customer support, bound by confidentiality and data protection obligations consistent with HIPAA where applicable;
• Your organization, as directed by administrators and permitted by role assignments;
• Legal and safety recipients when required by law, court order, or to protect rights, safety, and security;
• Business transfers in connection with a merger, acquisition, or asset sale, subject to continued protection of PHI as required by law and contract.

A current list of subprocessors material to PHI processing is available upon request to celoeman@gmail.com.

We implement administrative, physical, and technical safeguards designed to protect PHI and personal information, including encryption in transit, access controls, audit logging, workforce training, and incident response procedures. Details are described in our Security & Compliance document.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your credentials and for configuring your organization's access policies appropriately.

We retain information for as long as your organization maintains an active subscription and as required to provide the service, comply with law, resolve disputes, and enforce agreements. Upon termination, we handle PHI according to the BAA—including return or secure destruction of PHI where applicable and permitted.

Depending on your role and applicable law, you may have rights to access, correct, or delete certain personal information. Requests regarding PHI in a clinical record should generally be directed to your organization, which is the covered entity or business associate responsible for the record.

Individuals with rights under HIPAA (such as access, amendment, and accounting of disclosures) should contact their provider organization's privacy officer. Reinfora assists our customers in fulfilling such requests as required by the BAA.

California and other state privacy laws may provide additional rights for non-PHI personal information. Contact celoeman@gmail.com to submit a request.

If we discover a breach of unsecured PHI, we will notify affected customers without unreasonable delay and in accordance with HIPAA and our BAA, including information necessary for customers to meet their own notification obligations. Report suspected incidents immediately to celoeman@gmail.com.

Reinfora is intended for use by U.S. healthcare organizations. Information is processed and stored in the United States unless otherwise agreed in writing. If you access the service from outside the United States, you consent to transfer and processing in the U.S.

Reinfora is a business service not directed to children under 13. Client records may include information about minors receiving clinical services; such PHI is processed solely on behalf of our healthcare customers under appropriate agreements and authorizations.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated effective date. Continued use of the service after changes become effective constitutes acceptance where permitted by law.

Privacy inquiries: celoeman@gmail.com

General contact: celoeman@gmail.com

Reinfora Privacy Officer
Reinfora
Available via email at celoeman@gmail.com