Privacy Policy

Policy

Effective Date: June 1, 2026

Updated Date: June 24, 2026

NeuralClinic.Ai provides AI-assisted tools for developmental health, parent engagement, care coordination, and provider/practice workflows. Because our services may be used by parents, legal guardians, patients, healthcare providers, therapists, practices, and care teams, we maintain separate privacy disclosures for family-facing and provider-facing experiences. Please review the policy that applies to how you use NeuralClinic.Ai.

Patient, Parent and Legal Guardian Privacy Policy: for families, caregivers, adult patients, dependents, and users of the patient/parent portal or app.

Provider and Practice Web App Privacy Policy: for providers, practices, staff, administrators, and organizational users of the provider/practice web app.

Questions? Contact privacy@neuralclinic.ai

Patient, Parent and Legal Guardian Privacy Policy

Effective Date: June 1, 2026. Last Updated: June 24, 2026.

This Patient, Parent and Legal Guardian Privacy Policy (“Policy”) explains how [Legal Entity Name] d/b/a NeuralClinic.Ai (“NeuralClinic.Ai,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects information when individuals, parents, legal guardians, caregivers, and dependents use the NeuralClinic.Ai public website, patient/parent portal, mobile or web application, intake tools, care-coordination features, assessment workflows, messaging features, and related services (collectively, the “Patient App”).

This Policy is written for families and caregivers using NeuralClinic.Ai in connection with autism, developmental, behavioral, speech, learning, therapy, care coordination, school support, or related pediatric and family-support services. It is not a medical-consent form, Business Associate Agreement, Terms of Service, or healthcare provider Notice of Privacy Practices.

1. Who This Policy Applies To

Visitors to the NeuralClinic.Ai website who browse pages, submit contact forms, request a demo, or communicate with us.

Parents, legal guardians, adult patients, caregivers, or authorized representatives who create or use an account.

Children, adolescents, or other dependents whose profiles, assessments, therapy plans, developmental information, school documents, or health information are entered into the Patient App by a parent, legal guardian, provider, school partner, or other authorized user.

Individuals who communicate with NeuralClinic.Ai through email, chat, web forms, surveys, support channels, or other digital tools.

2. Important HIPAA and Provider Relationship Notice

When NeuralClinic.Ai receives, creates, maintains, or transmits protected health information (“PHI”) on behalf of a healthcare provider, practice, clinic, hospital, therapist, school-health program, or other HIPAA-covered entity or business associate (“Provider”), NeuralClinic.Ai acts as a service provider/business associate to that Provider. In that situation, the Provider remains responsible for its healthcare relationship with you, and the Provider’s Notice of Privacy Practices and consent processes may also apply.

If your Provider invited you to use NeuralClinic.Ai, certain requests about medical records, treatment records, amendments, restrictions, and disclosures may need to be directed to your Provider. NeuralClinic.Ai will support Provider-directed requests as required by applicable agreements and law.

3. Information We Collect

We may collect the following categories of information, depending on how you use the website or Patient App:

Account and contact information, such as name, email address, phone number, mailing address, preferred language, login credentials, account role, and communication preferences.

Parent/legal guardian and authorization information, such as relationship to the child or dependent, consent records, identity-verification information, authorization forms, custody or guardianship-related documentation when needed, and consent-withdrawal records.

Child, dependent, or patient profile information, such as name, date of birth, age, sex, developmental history, diagnosis history, school grade, therapy history, caregiver contacts, and relevant family-provided background.

Health, behavioral, developmental, and care information, such as autism-screening responses, developmental assessments, speech and language observations, behavioral notes, symptom trackers, medications, allergies, care plans, therapy goals, progress notes, provider notes, uploaded medical documents, and related information.

School and care-coordination information, such as IEP/504 documents, school-support plans, accommodations, teacher or caregiver notes, attendance or progress summaries, and communications that you or an authorized Provider choose to upload or share.

Communications, such as messages, support requests, survey responses, email content, chat content, telehealth-related scheduling information, and feedback.

Device, usage, and technical information, such as IP address, browser type, device identifiers, operating system, app interactions, pages viewed, referral URLs, timestamps, error logs, session metadata, and approximate location derived from device or network settings.

Payment and billing information, if applicable, such as transaction details, subscription status, invoice information, and limited payment-processing details handled by our payment processors. We do not intend to store full payment-card numbers unless expressly stated by the payment processor and authorized under our agreements.

Optional files and media, such as documents, images, audio, video, or recordings that you or an authorized Provider choose to upload. You should only upload content that is relevant to the requested service and that you are authorized to provide.

4. Sources of Information

You, when you create an account, complete forms, upload documents, submit assessments, message us, or otherwise use the Patient App.

Parents, legal guardians, caregivers, or authorized representatives acting on behalf of a child, dependent, or patient.

Providers, practices, therapists, school-health partners, or care teams that use NeuralClinic.Ai and are authorized to share information with us.

Technology providers, hosting providers, analytics providers, support tools, identity-management providers, and other service providers that help us operate the website and Patient App.

Third-party integrations that you or your Provider enable, such as electronic health record systems, scheduling tools, communication platforms, or other authorized systems.

5. How We Use Information

We use information for the following purposes:

To create and manage accounts, verify account roles, authenticate users, and maintain authorized access.

To provide the Patient App, including intake workflows, developmental-screening support, assessment workflows, care-plan support, therapy support, parent education, progress tracking, care coordination, messaging, reminders, and related features.

To support Providers, practices, care teams, and authorized school or therapy partners in delivering care, coordinating services, documenting interactions, and communicating with families.

To generate summaries, structured reports, care-team notes, recommendations, task lists, and AI-assisted insights for review by authorized users and, where applicable, licensed professionals.

To operate, maintain, troubleshoot, secure, test, monitor, and improve the website, Patient App, and related services.

To respond to inquiries, provide customer support, send service messages, communicate about account activity, and provide administrative notices.

To process payments, manage subscriptions, and fulfill billing obligations where applicable.

To comply with legal, regulatory, contractual, security, audit, accounting, and risk-management obligations.

To create aggregated, de-identified, or anonymized information that does not reasonably identify an individual, when permitted by law and applicable agreements.

6. AI-Assisted Features and Human Review

NeuralClinic.Ai may use artificial intelligence, machine learning, rules-based automation, natural-language processing, and related technologies to help organize information, identify patterns, generate summaries, suggest next steps, support developmental or therapy workflows, and improve care coordination.

AI-assisted outputs are not a substitute for professional medical judgment, diagnosis, treatment, emergency care, legal advice, school eligibility determinations, or individualized education decisions. Providers, clinicians, therapists, parents, legal guardians, and other qualified professionals remain responsible for reviewing and deciding how to use any AI-assisted output.

Unless separately authorized and permitted by law and applicable agreements, we do not use identifiable PHI from Provider-directed accounts to train general-purpose AI models for unrelated commercial use. Any use of de-identified or aggregated data will be handled in accordance with applicable law, customer agreements, and our de-identification practices.

7. Children, Minors, and Parent/Legal Guardian Consent

NeuralClinic.Ai is designed for use by parents, legal guardians, authorized caregivers, adult users, Providers, and care teams. Children under 13 should not create an independent account or submit personal information directly unless the child’s parent or legal guardian has provided consent through an approved workflow and the account is being used under adult supervision.

Parents and legal guardians may be asked to provide consent for collection, use, disclosure, and processing of a child’s information. The type of consent may depend on the feature used, the child’s age, the Provider relationship, applicable law, and whether the service is offered directly to the family or through a Provider.

A parent or legal guardian may contact us to request access to, correction of, deletion of, or limits on a child’s information, subject to identity verification, Provider instructions, legal obligations, record-retention requirements, and applicable law. Some requests may need to be directed to the Provider or practice that controls the medical record.

Parents and legal guardians should not provide information about a child or dependent unless they have legal authority to do so. If we learn that a child under 13 has provided personal information without required parent/legal guardian consent, we will take reasonable steps to address the issue in accordance with applicable law and our operational obligations.

8. When We Disclose Information

We may disclose information as described below:

To Providers and care teams involved in the applicable patient, child, or dependent’s care, treatment, care coordination, documentation, or administrative support.

To parents, legal guardians, caregivers, or authorized representatives according to account settings, consent records, Provider instructions, and applicable law.

To service providers and vendors that help us host, secure, operate, support, analyze, maintain, or improve the website and Patient App. These parties are authorized to process information only for permitted purposes and under appropriate contractual obligations.

To electronic health record systems, scheduling systems, communication tools, or other integrations enabled by you, your Provider, or your organization.

To schools, therapists, specialists, payers, or community-support partners only when authorized by you, your legal representative, your Provider, applicable consent, or applicable law.

To comply with law, court orders, subpoenas, regulatory requests, law-enforcement requests, public-health obligations, or other legal processes when required or permitted.

To protect rights, safety, security, integrity, or property of NeuralClinic.Ai, users, Providers, patients, children, or others, including to investigate suspected fraud, abuse, misuse, security incidents, or policy violations.

In connection with a merger, financing, acquisition, corporate reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate confidentiality and legal protections.

9. What We Do Not Do

We do not sell PHI.

We do not use Provider-directed PHI for third-party targeted advertising.

We do not knowingly allow children under 13 to create independent accounts without required parent/legal guardian consent.

We do not make medical, educational, or disability-benefit decisions for you. NeuralClinic.Ai provides technology tools and support workflows; Providers, schools, payers, and other authorized decision-makers remain responsible for their own determinations.

10. Cookies, Analytics, and Similar Technologies

Our public website may use cookies, pixels, local storage, analytics tools, and similar technologies to remember preferences, understand website usage, measure marketing performance, improve content, secure sessions, and operate forms. Authenticated app areas may use strictly necessary cookies or similar technologies for login, security, session management, and product functionality.

Where required, we will provide choices regarding non-essential cookies and analytics. You can also adjust browser settings to block or delete cookies, although some features may not function properly without them.

11. Communications and Notifications

We may send service-related messages, account notices, security alerts, appointment or task reminders, support responses, and administrative communications. You may be able to opt out of non-essential marketing communications, but you may still receive service-related messages needed to operate your account or provide services.

Email, SMS, and app notifications may not be fully secure. Do not include emergency information in routine messages. If you believe someone is in danger or needs urgent medical help, call emergency services or contact a qualified professional immediately.

12. Data Retention

We retain information for as long as reasonably necessary to provide the website and Patient App, fulfill the purposes described in this Policy, support Provider-directed services, maintain records, comply with legal and contractual obligations, resolve disputes, enforce agreements, preserve security, and support legitimate business operations.

Retention periods may differ depending on whether information is controlled by a Provider, whether it is part of a medical record, whether it relates to a child or minor, whether it is needed for audit or compliance purposes, and whether deletion is technically and legally feasible.

13. Security

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and destruction. These safeguards may include access controls, encryption, audit logging, secure hosting, network protections, workforce training, vendor review, and incident-response procedures.

No website, app, system, or transmission method is completely secure. You are responsible for maintaining the confidentiality of your login credentials, using strong passwords, limiting access to trusted individuals, logging out of shared devices, and promptly notifying us of suspected unauthorized access.

14. Your Choices and Requests

Depending on your relationship with NeuralClinic.Ai, your Provider, and applicable law, you may be able to request access to, correction of, deletion of, export of, or restrictions on certain information. You may also be able to withdraw certain consents, disable certain features, opt out of marketing, or limit some uses of information.

We may need to verify your identity and authority before fulfilling a request. We may deny or limit requests when permitted by law, when the information is controlled by a Provider, when retention is required, when deletion would affect another person’s privacy, or when the request conflicts with legal, contractual, security, medical-record, or compliance obligations.

15. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights, such as the right to know or access personal information, correct inaccurate information, delete information, obtain a copy of information, opt out of certain targeted advertising or sale/sharing activities, limit certain uses of sensitive personal information, and appeal certain decisions. These rights vary by state and may not apply to information regulated by HIPAA or other sector-specific laws.

To exercise a state privacy right, contact us using the information in the “Contact Us” section. We will respond as required by applicable law.

16. International Users

NeuralClinic.Ai is intended primarily for users in the United States unless we expressly state otherwise. If you access the website or Patient App from outside the United States, your information may be processed in the United States or other locations where we or our service providers operate. Different privacy laws may apply depending on your location and the services used.

17. Third-Party Links and Integrations

The website and Patient App may contain links to third-party websites, services, resources, app stores, video tools, payment processors, electronic health records, or educational resources. We are not responsible for the privacy practices of third parties that we do not control. Review the privacy policies of those third parties before providing information to them.

18. Changes to This Policy

We may update this Policy from time to time. The updated version will be posted with a revised “Last Updated” date. If we make material changes, we may provide additional notice through the website, app, email, or other reasonable means.

19. Contact Us

For privacy questions, requests, or concerns, contact:

NeuralClinic.Ai Corporation
Attn: Privacy Officer
Email: privacy@neuralclinic.ai

Provider and Practice Web App Privacy Policy

Effective Date: June 1, 2026. Last Updated: June 24, 2026.

This Provider and Practice Web App Privacy Policy (“Policy”) explains how [Legal Entity Name] d/b/a NeuralClinic.Ai (“NeuralClinic.Ai,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects information when healthcare providers, practices, clinics, hospitals, therapy organizations, school-health programs, administrators, staff, and other authorized organizational users access the NeuralClinic.Ai provider/practice web application, dashboard, portals, APIs, integrations, documentation tools, assessment workflows, care-coordination tools, analytics features, and related services (collectively, the “Provider App”).

This Policy is intended to supplement, not replace, the applicable service agreement, Business Associate Agreement (“BAA”), data processing terms, order form, provider terms of service, and any organization-specific privacy, security, or compliance requirements.

1. Roles and Responsibilities

NeuralClinic.Ai provides technology tools that support intake, developmental-assessment workflows, documentation, parent engagement, care coordination, therapy-support workflows, school-support workflows, and operational efficiency. NeuralClinic.Ai does not replace the clinical, legal, privacy, or compliance responsibilities of the Provider or practice.

Provider/practice responsibility: The Provider or practice is responsible for determining whether and how to use NeuralClinic.Ai, obtaining required patient or parent/legal guardian consents, providing required notices, maintaining the medical record, making clinical decisions, determining user access, and complying with applicable law.

NeuralClinic.Ai responsibility: NeuralClinic.Ai is responsible for operating the Provider App in accordance with applicable agreements, privacy and security obligations, and permitted instructions from the Provider or practice.

BAA control: If there is a conflict between this Policy and an executed BAA regarding PHI, the BAA controls to the extent required by law and the parties’ agreement.

2. Information We Collect Through the Provider App

We may collect or process the following categories of information:

Provider user information, such as name, work email, phone number, role, credentials, NPI or license information, organization name, department, location, username, authentication information, access permissions, and user preferences.

Practice and operational information, such as practice name, address, specialty, provider roster, staff roles, scheduling or workflow settings, billing/contact details, subscription details, implementation notes, support tickets, and integration settings.

Patient and dependent information entered, uploaded, transmitted, or synchronized by the Provider, practice, patient, parent/legal guardian, caregiver, or authorized integration, including demographic information, health information, developmental history, assessments, questionnaires, therapy notes, medications, allergies, care plans, documents, school-support materials, and communications.

Clinical and workflow content, such as intake forms, templates, AI-assisted summaries, structured notes, care-coordination tasks, referral information, progress tracking, intervention plans, communication logs, and related documentation.

Integration data, such as identifiers, metadata, event logs, system status, API activity, electronic health record messages, scheduling data, document-exchange records, and error messages.

Usage, security, and audit information, such as login activity, IP address, device/browser information, session information, feature usage, access logs, administrative changes, permissions, audit trails, error logs, and security events.

Communications, such as emails, support requests, implementation messages, training questions, feedback, and survey responses.

3. Protected Health Information and Business Associate Obligations

When NeuralClinic.Ai creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered Provider or another business associate, NeuralClinic.Ai acts as a business associate or subcontractor business associate, as applicable. In that capacity, NeuralClinic.Ai will use and disclose PHI only as permitted by the applicable BAA, the service agreement, Provider instructions, and applicable law.

Providers should not use the Provider App to store or transmit PHI unless a BAA or other required data-protection agreement is in effect, where required. The Provider is responsible for determining whether a BAA is required and for ensuring that its users comply with the Provider’s privacy and security policies.

4. How We Use Information

We use information to provide, secure, support, and improve the Provider App and related services, including:

Configuring and administering Provider App accounts, user permissions, roles, organizations, practices, and workflows.

Supporting intake, screening, assessment, documentation, care-plan, therapy-support, parent-engagement, care-coordination, referral, and follow-up workflows.

Generating AI-assisted summaries, structured notes, task recommendations, draft documentation, workflow prompts, reports, analytics, and related outputs for authorized review.

Connecting to electronic health record systems, scheduling tools, communication systems, data-exchange interfaces, and other integrations authorized by the Provider or practice.

Providing implementation, training, technical support, maintenance, troubleshooting, monitoring, and customer-success services.

Maintaining security, authentication, fraud prevention, audit logs, backup, business continuity, incident response, and access controls.

Complying with legal, regulatory, contractual, accounting, security, audit, and risk-management obligations.

Creating aggregated, de-identified, or anonymized information for analytics, product improvement, benchmarking, research support, or business operations only as permitted by applicable law and customer agreements.

5. AI-Assisted Features and Clinical Responsibility

The Provider App may include AI-assisted capabilities to organize information, detect patterns, generate summaries, suggest workflow steps, classify information, support triage or referral workflows, and produce draft documentation. These tools are intended to assist authorized users, not replace clinical judgment.

Providers and practices are responsible for reviewing AI-assisted outputs before relying on them, entering them into medical records, sharing them with patients or families, or using them in clinical, therapy, school-support, or administrative decisions. NeuralClinic.Ai does not independently diagnose, treat, prescribe, establish a provider-patient relationship, or determine eligibility for educational, disability, insurance, or public benefits.

Unless the applicable BAA, service agreement, and law permit otherwise, NeuralClinic.Ai will not use identifiable PHI from Provider-directed accounts to train general-purpose AI models for unrelated commercial purposes.

6. Provider and Practice Responsibilities for Patient and Minor Data

Providers and practices using NeuralClinic.Ai are responsible for:

Obtaining and documenting patient, parent, or legal guardian consents and authorizations required for the Provider’s use of NeuralClinic.Ai.

Providing any required Notice of Privacy Practices, privacy disclosures, informed consent, telehealth consent, treatment consent, school-release authorization, or other notices required by law and professional standards.

Determining when parent/legal guardian consent is required for minors, including children under 13, and ensuring that only authorized adults create or manage child accounts when required.

Confirming legal authority before allowing a parent, legal guardian, caregiver, school staff member, therapist, or other representative to access a child’s or patient’s information.

Managing user access, role-based permissions, workforce training, device security, password hygiene, termination of access, and internal privacy/security policies.

Reviewing AI-assisted outputs for accuracy and appropriateness before clinical, therapy, school-support, billing, referral, or documentation use.

Ensuring that information shared with schools, payers, specialists, community organizations, or other third parties is authorized and legally permitted.

7. When We Disclose Information

We may disclose information in the following circumstances:

To the Provider, practice, organization, authorized users, and care team members associated with the account.

To patients, parents, legal guardians, caregivers, or authorized representatives according to Provider instructions, account settings, consent records, and applicable law.

To service providers, subprocessors, hosting providers, infrastructure providers, support tools, security tools, analytics providers, payment processors, and integration partners that help us provide the Provider App, subject to appropriate contractual and confidentiality obligations.

To electronic health record systems, APIs, scheduling systems, communication tools, or other systems enabled by the Provider, practice, or authorized organization.

To comply with applicable law, regulation, court order, subpoena, public-health obligation, government request, audit, legal process, or professional obligation.

To protect rights, safety, security, integrity, or property, including investigating fraud, abuse, misuse, unauthorized access, security incidents, or policy violations.

In connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate confidentiality and legal safeguards.

8. Service Providers and Subprocessors

NeuralClinic.Ai may use third-party service providers and subprocessors to host, secure, operate, support, monitor, analyze, communicate, bill, and improve the Provider App. These parties may process information only for permitted purposes and under applicable contractual obligations. When required, NeuralClinic.Ai will ensure that subcontractors handling PHI agree to appropriate business associate or subcontractor obligations.

Providers may request information about key subprocessors or data-processing arrangements using the contact information below or through their customer-success contact, subject to confidentiality and security limitations.

9. De-Identified, Aggregated, and Anonymized Data

NeuralClinic.Ai may create and use de-identified, aggregated, or anonymized information that does not reasonably identify an individual for product improvement, analytics, operations, research support, benchmarking, safety monitoring, and business purposes. Where PHI is involved, de-identification will be handled in accordance with applicable law, BAA terms, and reasonable de-identification practices.

NeuralClinic.Ai will not attempt to re-identify de-identified data except as permitted by law, customer agreements, or to validate de-identification controls.

10. Security Measures

We use administrative, technical, and physical safeguards designed to protect information processed through the Provider App. Depending on the service configuration, these safeguards may include encryption, access controls, role-based permissions, audit logs, network protections, secure hosting, vulnerability management, backups, incident-response procedures, workforce training, vendor review, and business-continuity practices.

The Provider and practice are responsible for configuring appropriate access controls, promptly removing access for departed workforce members, protecting devices and credentials, reviewing audit activity when appropriate, and reporting suspected misuse or unauthorized access.

11. Audit Logs and Monitoring

The Provider App may maintain logs of authentication events, access activity, administrative changes, data-entry events, exports, integrations, AI-output generation, and other system activity. We use these logs for security, troubleshooting, audit support, compliance, product operations, and misuse prevention. Access to logs may be limited for security, privacy, or operational reasons.

12. Security Incidents and Breach Notification

If NeuralClinic.Ai becomes aware of a security incident or potential breach involving information processed through the Provider App, we will evaluate and respond in accordance with applicable law, the service agreement, the BAA, and our incident-response procedures. When PHI is involved, notification responsibilities and timelines will be handled according to the applicable BAA and law.

Providers and practices should promptly notify NeuralClinic.Ai of suspected unauthorized access, improper disclosure, credential compromise, misdirected information, or other security events involving the Provider App.

13. Data Retention, Return, and Deletion

We retain information for as long as reasonably necessary to provide the Provider App, fulfill the purposes described in this Policy, support Provider-directed services, comply with legal and contractual obligations, maintain security and audit records, resolve disputes, enforce agreements, and support business operations.

Upon termination or expiration of services, return, export, deletion, or continued retention of Provider-controlled information will be handled according to the applicable service agreement, BAA, technical capabilities, legal requirements, backup-retention practices, and security obligations. Some residual copies may remain in backups, logs, or archives for a limited period where deletion is not immediately feasible or where retention is legally or operationally required.

14. Cookies and Similar Technologies

The Provider App may use cookies, local storage, device identifiers, and similar technologies for authentication, session management, security, load balancing, preferences, product analytics, support, and functionality. Public website areas may use additional analytics or marketing technologies where permitted and disclosed. Users may manage some cookie settings through their browser, but disabling certain technologies may affect functionality.

15. Marketing and Sale of Information

NeuralClinic.Ai does not sell PHI.

NeuralClinic.Ai does not use Provider-directed PHI for third-party targeted advertising.

NeuralClinic.Ai may use Provider user business contact information for account administration, product updates, events, training, service notices, and marketing communications, subject to applicable opt-out rights and contractual restrictions.

16. Individual and Provider User Requests

Provider users may request access to or correction of their own account information by using account settings or contacting us. Patient or parent/legal guardian requests regarding medical records or PHI may need to be directed to the Provider that controls the record. NeuralClinic.Ai will support Provider-directed requests in accordance with applicable agreements and law.

17. International Access

The Provider App is intended primarily for use by U.S.-based Providers unless NeuralClinic.Ai expressly agrees otherwise. If a Provider authorizes access from outside the United States, the Provider is responsible for confirming that such access complies with its legal, contractual, and organizational requirements. Information may be processed in the United States or other locations where NeuralClinic.Ai or its service providers operate.

18. Changes to This Policy

19. Contact Us

For privacy questions, security concerns, BAA questions, or Provider App privacy requests, contact:

NeuralClinic.Ai Corporation
Attn: Privacy Officer
Email: privacy@neuralclinic.ai