Privacy Policy & HIPAA Compliance

HIPAA Compliance Statement

◆

HIPAA Compliant — Protected Health Information (PHI) Safeguards

TheraSignal is designed and operated in compliance with HIPAA regulations

TheraSignal is a clinical-grade measurement instrument designed for use in therapeutic settings. We are committed to full compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including the Privacy Rule, Security Rule, and Breach Notification Rule.

As a Business Associate under HIPAA, TheraSignal implements administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of all Protected Health Information (PHI) processed through our platform.

Business Associate Agreement (BAA)

TheraSignal executes Business Associate Agreements with all covered entities (healthcare providers, clinics, and practices) prior to processing any PHI. View BAA templates and vendor compliance checklist → Or contact us at compliance@therasignal.com to initiate a custom agreement.

Data We Collect

TheraSignal collects and processes the following categories of data to deliver clinical intelligence to licensed practitioners:

Data Category	What We Collect	Purpose
Session Recordings	Video and audio captured during therapy sessions with patient consent	Multimodal affect analysis, micro-expression detection, prosody analysis
Sensor Data	Physiological signals: heart rate variability (HRV), galvanic skin response (GSR), skin conductance	Arousal and autonomic response tracking during and between sessions
Derived Metrics	Computed affect valence, engagement scores, arousal indices, risk assessments	Clinical dashboard intelligence, progress tracking, intervention mapping
Clinical Notes	Clinician-entered session notes and treatment observations	Contextual enrichment of automated analyses
Account Data	Clinician name, email, practice information, credentials	Account management, authentication, compliance verification
Usage Data	Feature usage patterns, session frequency, dashboard interactions	Platform improvement, performance optimization

Derived Metrics, Not Raw Data

Whenever possible, TheraSignal processes raw sensor data in real-time and stores only derived metrics (affect scores, engagement indices, risk flags). Raw video and audio recordings are processed and can be configured for automatic deletion after analysis, per your practice's data retention policy.

Data Encryption & Security

TheraSignal implements industry-leading encryption and security measures across all layers of the platform:

Encryption at Rest

AES-256-GCM encryption for all stored PHI, including session data, clinical notes, and derived metrics
Database-level encryption with per-tenant key isolation
Encrypted backups with separate key management
Hardware Security Module (HSM)-backed key storage

Encryption in Transit

TLS 1.3 for all data transmission between clients and servers
Certificate pinning for mobile and sensor device connections
End-to-end encryption for real-time session data streams
Encrypted API communications for all third-party integrations

Access Controls

Role-based access control (RBAC) with principle of least privilege
Multi-factor authentication (MFA) required for all clinician accounts
Session-based tokens with automatic expiration
Audit logging of all PHI access and modifications
IP allowlisting available for enterprise deployments

Infrastructure Security

SOC 2 Type II compliant hosting environment
Automated vulnerability scanning and penetration testing
Network segmentation isolating PHI processing environments
24/7 security monitoring and intrusion detection

Data Retention & Deletion

TheraSignal provides configurable data retention policies aligned with clinical and legal requirements:

Data Type	Default Retention	Configurable
Raw session recordings	30 days after processing	Yes — 0 to 365 days, or indefinite per practice policy
Derived clinical metrics	Duration of patient treatment + 7 years	Yes — aligned with state medical records retention laws
Clinical notes	Duration of patient treatment + 7 years	Yes — per practice policy
Account data	Duration of active subscription + 90 days	Deleted upon account termination request
Audit logs	6 years (HIPAA requirement)	No — regulatory minimum

When data reaches the end of its retention period, it is permanently and irreversibly deleted using cryptographic erasure (destroying encryption keys) and physical media overwrite where applicable.

Patient Rights

Patients whose data is processed through TheraSignal have the following rights under HIPAA and applicable state law:

Right to Access

Patients may request access to their PHI held by TheraSignal, including all derived metrics, session summaries, and clinical notes. Requests are fulfilled within 30 days as required by HIPAA. Access requests are coordinated through the treating clinician.

Right to Amendment

Patients may request correction or amendment of their PHI if they believe information is inaccurate or incomplete. The treating clinician reviews and processes amendment requests in accordance with the HIPAA amendment standard.

Right to Restriction

Patients may request restrictions on certain uses or disclosures of their PHI. This includes the ability to opt out of specific data collection modalities (e.g., video recording, physiological monitoring) while maintaining access to other platform features.

Right to Accounting of Disclosures

Patients may request an accounting of disclosures of their PHI made by TheraSignal in the preceding six years. Our audit logging system maintains comprehensive disclosure records.

Right to Deletion

Patients may request deletion of their PHI, subject to legal retention requirements. Upon a verified deletion request, TheraSignal permanently removes all patient data within 30 days, except where retention is required by law.

Right to Revoke Consent

Patients may revoke consent for data collection at any time. Upon revocation, TheraSignal immediately ceases collecting new data and processes deletion of existing data per the patient's instructions and applicable retention laws.

Exercising Patient Rights

To exercise any of these rights, patients should contact their treating clinician, who will coordinate with TheraSignal. Clinicians can submit requests through the platform or by contacting privacy@therasignal.com.

Third-Party Data Sharing

TheraSignal maintains strict limitations on third-party data sharing:

We Do NOT

Sell patient data to any third party, under any circumstances
Share PHI with advertising networks or data brokers
Use patient data for purposes unrelated to clinical care
Provide data to insurance companies without explicit authorization
Train general-purpose AI models on patient-specific PHI

Limited Sharing Under BAA

TheraSignal shares data only with the following categories of Business Associates, each bound by a BAA:

Cloud infrastructure providers — encrypted data storage and processing
Security and monitoring services — threat detection and incident response
Backup and disaster recovery providers — encrypted data redundancy

All Business Associates undergo security review and must demonstrate HIPAA compliance before gaining access to any PHI.

De-identified Data

TheraSignal may use de-identified data (stripped of all 18 HIPAA identifiers) for platform improvement, research collaboration, and aggregate clinical insights. De-identification follows the HIPAA Safe Harbor method and is verified before any use.

Breach Notification

In the event of a breach of unsecured PHI, TheraSignal will:

Notify affected covered entities within 24 hours of discovery (exceeding the HIPAA 60-day requirement)
Provide detailed breach analysis including scope, affected data types, and remediation steps
Cooperate fully with covered entities in notifying affected patients
Report breaches affecting 500+ individuals to the HHS Secretary and media as required by HIPAA
Conduct root cause analysis and implement preventive measures

Cookies & Analytics

The TheraSignal marketing website uses minimal analytics to understand visitor traffic. This data is completely separate from the clinical platform and contains no PHI.

Essential cookies — Required for authentication and session management on the clinical platform
Analytics — Anonymous visitor counting on the marketing website only
We do not use third-party advertising cookies
We do not use social media tracking pixels

State & International Compliance

In addition to HIPAA, TheraSignal is designed to comply with:

California Consumer Privacy Act (CCPA/CPRA) — California residents' privacy rights
State medical records retention laws — configurable retention periods per jurisdiction
State telehealth regulations — compliance with state-specific telehealth data requirements
42 CFR Part 2 — additional protections for substance use disorder treatment records where applicable

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes:

We will notify all active clinician accounts via email at least 30 days before changes take effect
We will post the updated policy with a new "Last Updated" date
We will maintain an archive of previous policy versions available upon request