Privacy Policy

1. Who we are

PsychSuite ("PsychSuite", "we", "us") provides a practice management, patient care and growth platform for mental health clinics, including ketamine, TMS, Spravato and psychiatry practices. Contact: support@psychsuite.com. Our mailing address is available on request at the same email.

2. Information we collect

• Account information: name, email address, clinic name and role.
• Career applications: name, contact details, selected role, résumé, and any portfolio link or message you submit. We use this information to evaluate applications and communicate with applicants. Applications and résumés are stored privately and accessible to authorized staff. To request correction or deletion, email support@psychsuite.com.
• Clinic operational data: information clinics enter into the platform, such as scheduling, billing, SOP and reporting data.
• Protected health information (PHI): PsychSuite processes PHI on behalf of clinics as a Business Associate under HIPAA. This processing is governed by a Business Associate Agreement (BAA). PHI is never used for advertising or marketing.
• Website visitor data from the attribution pixel: clinics may optionally install the PsychSuite attribution pixel on their own website. It collects the page visited, referrer, UTM/campaign parameters and form submission events. Clinics are responsible for disclosing this on their own websites. The pixel is not used to collect health conditions.
• Usage and device data, and cookies: IP address, browser and device type, pages viewed, timestamps, and cookies used to operate and secure the service. See our Cookie Policy.

3. Google user data

Connecting a Google account is optional. When a user chooses to connect a Google account, PsychSuite requests read-only access to:

• Google Ads reporting data (scope: https://www.googleapis.com/auth/adwords)
• Google Analytics data (scope: https://www.googleapis.com/auth/analytics.readonly)
• Google Search Console data (scope: https://www.googleapis.com/auth/webmasters.readonly)
• The user's email address, to identify the connected account.

What we access: account, property and site names and IDs, and aggregated performance metrics (impressions, clicks, cost, conversions, sessions, users, search queries and positions).

How we use it: solely to display marketing performance reports and dashboards to the clinic and its authorized team or agency inside PsychSuite. We do not create, edit or delete campaigns, properties or settings.

What we don't do: we do not sell Google user data. We do not use it for advertising, retargeting, credit-worthiness or lending decisions. We do not use it to train generalized AI or machine-learning models. We do not allow humans to read it except with the user's consent, for security purposes, to comply with applicable law, or when the data is aggregated and anonymized for internal operations.

PsychSuite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and protection: OAuth tokens are encrypted at rest (AES-256) and transmitted over TLS. Only aggregated daily metrics are stored.

Retention and deletion: data is kept while the connection is active. When a user disconnects, tokens are revoked and deleted, and stored metrics are deleted within 30 days or sooner on request. Users can also revoke access at any time at myaccount.google.com/permissions. See How to delete your data.

4. Meta (Facebook) user data

Connecting Meta is optional. When a user connects Meta, PsychSuite requests the ads_read and business_management permissions to list the ad accounts the user or their Business Manager can access and to read ad performance insights (spend, impressions, clicks, leads and conversions).

This data is used only to display reporting to the clinic and its authorized team or agency. We do not create or modify ads, do not post content, and do not sell or share Meta data with data brokers or for advertising.

Retention, encryption and deletion work the same way as for Google data above. Users may remove PsychSuite at any time in Facebook under Settings & Privacy > Settings > Business Integrations. Full steps: How to delete your data.

5. How we use information

We use information to deliver and support the service, keep it secure, communicate with account holders, and meet legal obligations.

We do not sell personal information.

6. How we share information

• Service providers and subprocessors under written contract, in these categories: cloud hosting, email and SMS delivery, payment processing, and analytics data connectors. See Subprocessors.
• The clinic's authorized users and the agencies they invite.
• When legally required, such as to comply with a court order or protect the safety of people.

7. Agency and team access

Clinics may invite their marketing agency to connect accounts on their behalf using a secure, single-use link. The clinic remains the account owner and can disconnect any integration or remove agency access at any time.

8. Data security

• Encryption in transit and at rest.
• Role-based access controls and least-privilege access.
• Audit logging of significant actions.
• Encrypted storage of third-party credentials. See Security.

9. Data retention

We keep account and operational data for as long as the account is active or as needed to provide the service and meet legal obligations. Connected-account data follows the retention rules in sections 3 and 4. PHI is retained or destroyed as directed by the clinic under the BAA, including any medical-record retention the clinic is required to keep.

10. Your rights and choices

• Access, correct or delete your personal information.
• Disconnect Google, Meta or other integrations at any time.
• Opt out of marketing email using the unsubscribe link in any message.

Residents of California (CCPA/CPRA) and other US states with privacy laws may have additional rights, including to know what we collect, to request deletion, to correct information, and not to be discriminated against for exercising these rights. Email support@psychsuite.com to make a request.

Patients: to access or amend medical records, please contact your treating provider directly.

11. Children

PsychSuite is not directed to children under 16, and we do not knowingly collect their personal information.

12. Changes to this policy

We may update this policy. We will post the new version here with a new "Last updated" date, and notify account holders of material changes.