BehaviorLabs AI (“BehaviorLabs,” “we,” “us,” or “our”) provides AI-assisted clinical documentation tools for Board Certified Behavior Analysts (BCBAs), BCBA-Ds, BCaBAs, and Clinical Directors. This Privacy Policy explains what information we collect through our website and platform (the “Service”), how we use it, and the choices you have.
By creating an account or using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
Account information. When you sign up, we collect your name, email address, password (stored securely by our authentication provider, Amazon Cognito — we never see your plain-text password), credential type (BCBA / BCBA-D / BCaBA / Clinical Director), BCBA certification number, and agency/clinic name.
Clinical documentation content. To generate documents, our agents collect information you choose to enter, which may include: client initials, client date of birth, diagnosis information, session notes, behavioral data, assessment scores, treatment goals, and — for reports supporting insurance authorization — clinical details required by payers (see Section 4 for how we handle this).
Uploaded files. Some agents let you upload supporting files — progress graphs, images, assessment scoring sheets, or other documents — which we process to generate your report.
Usage information. We collect standard technical information such as IP address, browser type, device information, and how you interact with the Service, to keep it secure and functioning correctly.
- To generate the clinical documents you request
- To maintain continuity across your documentation for a given client — for example, so a Behavior Intervention Plan can reference a prior Functional Behavior Assessment for the same client
- To let the Service adapt to your individual clinical documentation style over time, if you use this feature
- To provide, maintain, and improve the Service, including troubleshooting and security
- To communicate with you about your account, including service updates and, where applicable, billing
- To comply with legal obligations
We do not sell your personal information or your clients’ information to third parties.
The Service is built on infrastructure provided by Amazon Web Services (AWS), including hosting, data storage, and AI model access through Amazon Bedrock. When you generate a document, the information you enter is processed by an AI model (via Amazon Bedrock) to produce your draft. This processing happens within AWS’s infrastructure.
We use the following categories of third-party service providers:
- Amazon Web Services (AWS) — application hosting, data storage, and AI model processing
- Authentication provider (Amazon Cognito) — account creation, login, and password security
- Payment processor — for paid subscriptions, a third-party payment processor handles billing information; we do not store your full payment card details ourselves
These providers process information on our behalf and are contractually restricted from using it for their own purposes.
Because the Service is used to generate clinical documentation, it may involve Protected Health Information (PHI) as defined under HIPAA. We run on HIPAA-eligible AWS infrastructure with encryption and access controls in place. A Business Associate Agreement (BAA) is available upon request for accounts that require one.
Generated documents are drafts. You are responsible for reviewing and approving every document before clinical use or submission to an insurer.
We retain client session and document history for 6 months to allow the Service to maintain clinical continuity across documents for the same client. Generated documents remain available for download during this window.
The Service is a documentation aid, not your official system of record. We recommend downloading and retaining your own copies of generated documents in line with your license board’s record-retention requirements. After the 6-month window, it is your responsibility to have retained the records you need.
Account information is retained for as long as your account is active, and for a reasonable period afterward as needed for legal, accounting, or security purposes.
We use industry-standard safeguards to protect your information, including encryption of data in transit and at rest, access controls limiting who can view stored data, and secure authentication through Amazon Cognito. No system is completely secure, and we cannot guarantee absolute security, but we work to protect your information using practices appropriate to the sensitivity of clinical data.
Beyond the service providers described in Section 3, we may share information:
- With your Clinical Director or agency administrator, if you are part of an agency account, for legitimate team-management purposes (such as approving your access or overseeing generated documents)
- If required by law, subpoena, or other legal process
- To protect the rights, property, or safety of BehaviorLabs AI, our users, or others
- In connection with a merger, acquisition, or sale of assets, with notice to you where required
You can access, update, or delete your account information by contacting us at support@behaviorlabsai.com. You may request a copy of your data or ask us to delete your account, subject to any legal or contractual obligations that require us to retain certain records.
Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA) or other applicable state privacy laws. Contact us to make a request, and we will respond consistent with applicable law.
The Service uses cookies for authentication purposes — specifically, to keep you securely logged in to your account between visits. These cookies are necessary for the Service to function and are not used to track you across other websites.
As of the effective date of this policy, we do not use third-party analytics or advertising tracking tools. If this changes in the future, we will update this policy accordingly (see Section 11).
You can control cookies through your browser settings, though disabling authentication cookies will affect your ability to stay logged in to the Service.
The Service is intended for use by licensed and credentialed behavior analysts and is not directed at children. We do not knowingly collect personal information directly from children. Client information entered into the Service by a clinician is entered in that clinician’s professional capacity, subject to their own obligations under HIPAA and applicable law.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or how we handle your information, contact us at:
Email: support@behaviorlabsai.com