Privacy Policy

LunABA Health (“LunABA”, “we”, “us”) provides a practice-management platform for Applied Behavior Analysis (ABA) therapy clinics. Clinics use it to manage client records, treatment plans, scheduling, session documentation, billing and secure messaging.

We play two roles. For the clinical and billing records a clinic keeps about its clients, the clinic is in control and we act as its service provider — its “business associate” under HIPAA — processing that information only on the clinic's instructions. For the accounts of clinic staff who sign in to LunABA, we are responsible for how that information is handled.

• Account and profile data. Name, work email, phone number, profile photo, role and clinic membership. Passwords are never stored — only a one-way hash of them.
• Client and clinical records. Entered by clinic staff: identity details such as name, date of birth and gender; contact and guardian information; diagnoses, allergies and medical alerts; treatment plans, goals, behavior and assessment data; and session and SOAP notes.
• Insurance and billing information. Payer, plan, member and group numbers, policy holder details, authorizations and approved units, and the procedure codes used to bill for care.
• Documents and messages. Files uploaded to a client's record — such as assessment reports, consent forms and insurance cards — and messages and attachments exchanged through the platform.
• Security and activity data. Sign-in times, the IP address used to sign in, and an audit trail of changes to records, including who made each change and the values before and after.

We collect only what a clinic needs to deliver, document and bill for care. We do not gather information about you from advertising networks, data brokers or social media.

• To provide the service. Letting authorized clinic staff record, schedule, document and bill for care.
• To keep accounts secure. Verifying sign-ins, sending one-time verification codes, emailing you when your account is signed in to, and investigating misuse.
• To keep an audit trail. Recording access and changes so clinics can meet HIPAA accountability requirements and review activity.
• To communicate with you. Sending service emails such as invitations, password resets and security alerts. We never send marketing to clinics' clients or their families.
• To support and improve LunABA. Troubleshooting problems you report and improving reliability, using the least information needed.
• To meet legal obligations. Complying with applicable laws, regulations and valid legal requests.

Health information is shared only as your clinic directs and as the law allows. We share information in these limited cases:

• Within your clinic. Role-based permissions set by your clinic decide which staff members can see and change which records.
• With our service providers. Hosting, database, file storage and email delivery providers that process information on our behalf. They are bound by confidentiality and security obligations, and by business associate agreements wherever health information is involved.
• When the law requires it. In response to a court order, subpoena or other legal requirement, or to protect someone's safety. Where we are allowed to, we will tell the affected clinic first.
• In a business transfer. If LunABA is involved in a merger or acquisition, information would transfer only under the same protections described in this policy.

• Encryption. Information is encrypted in transit, and uploaded files are encrypted at rest.
• Access controls. Each clinic's data is kept separate, access follows the roles your clinic assigns, and suspended accounts are signed out and lose access immediately.
• Credential protection. Passwords are stored as Argon2 hashes, and verification codes expire after 15 minutes and work only once.
• Monitoring. Changes to records are written to a read-only audit log, and you receive an email alert when your account is signed in to.

No system can be perfectly secure. If we learn of a breach affecting information we hold, we will notify the affected clinic — and individuals or regulators where the law requires — without unreasonable delay.

LunABA uses a small number of strictly necessary cookies and browser storage. We don't use advertising cookies, third-party analytics or cross-site tracking.

• Session cookies. Keep you signed in. They end when you close your browser, or after 30 days if you choose “Keep me signed in”.
• Access cookie. Remembers which areas of LunABA your role can open, so pages load correctly.
• Local storage. Keeps your basic profile and display preferences, such as color theme and navigation layout, on your own device.

Signing out removes your session cookies. Because they are needed for LunABA to work, they can't be switched off while you are signed in.

Clinical and billing records are kept for as long as the clinic's agreement with us requires, and for at least as long as health-record retention laws apply to that clinic. Audit logs cannot be edited and are kept for the clinic's compliance period.

When a clinic's agreement ends, we return or delete its information as the agreement specifies, unless the law requires us to keep it. Staff account information is deleted or anonymized once it is no longer needed.

Depending on where you live and the laws that apply, you may have the right to:

• Access. Get a copy of the information held about you.
• Correction. Ask for inaccurate or incomplete information to be fixed.
• Restriction or deletion. Ask for your information to be used less or deleted, subject to record-keeping laws.
• An accounting of disclosures. Receive a list of certain disclosures of your health information.

Clinic staff can update their own profile details at any time from their account page. You will never be treated differently for exercising your rights.

ABA therapy often serves children, so clinics may keep records about minors. That information is entered by clinic staff with the authorization of a parent or legal guardian, and requests about it are handled through them. LunABA accounts are for clinic staff only, and we do not knowingly create accounts for anyone under 18.

When we change this policy, we update the “Last updated” date at the top of this page. For material changes, we notify clinic administrators by email or in the app before the change takes effect.

Questions about this policy or how your information is handled? Our privacy team is happy to help. If your question is about a specific client's record, your clinic administrator is usually the fastest route.