Privacy Policy

This Privacy Policy explains how LBAPS National ("LBAPS," "we," "us," or "our") collects, uses, shares, and protects information when you use MomVersity, our insurance-billed ABA parent-training platform available at lbapsnational.com (the "Service"). By using the Service, you agree to the practices described in this policy. If you have questions at any time, contact us at [email protected].

1. Information We Collect

Information you provide to us

• Account and enrollment information. When you enroll or create an account, we collect your name, email address, phone number, mailing address, and login credentials.
• Child and family information. To deliver ABA parent-training services, parents and caregivers provide information about their child, including age, developmental and behavioral information, assessment responses, and progress data. Clinicians on your care team (BCBAs and RBTs) create session notes and clinical documentation. We treat this information as sensitive health information (see Section 6).
• Insurance information. We collect your insurance payer, member ID, and related coverage details to verify eligibility and, where required, obtain prior authorization for services.
• Payment information. Payments for optional paid features are processed by Stripe. Card numbers are transmitted directly to Stripe; we never store full card numbers on our systems.
• Employment applications. If you apply for a position through our careers page, we collect the information in your application and résumé. Résumés are stored in private storage and are accessible only to hiring staff.
• Referrals. If you refer a patient, we collect the contact and clinical information you submit, along with any attachments.
• Chat messages. Messages you send to Spark, our AI assistant, are processed to generate responses and screened by automated moderation for safety.

Information collected automatically

• Log and usage data, such as pages visited, actions taken, IP address, browser type, and timestamps.
• Cookies and similar technologies used to keep you signed in and to secure your session. We do not use third-party advertising cookies.
• Error and performance diagnostics collected through our monitoring tools to keep the Service reliable.

2. Information We Receive from Google

The Service offers two optional Google integrations. This section describes exactly what Google user data we access and how we use it.

Google Sign-In

If you choose to sign in with Google, we receive your name, email address, and profile picture from your Google account. We use this information solely to create and authenticate your MomVersity account and to display your name and picture within the Service. We do not use Google sign-in data for advertising, and we never sell it.

Google Calendar (staff only)

Clinical and staff users may optionally connect their Google Calendar using the calendar.events scope. We use this access for one purpose only: creating and updating training-session events on the connecting staff member's own calendar so their schedule stays in sync. We do not read unrelated calendar events, and we do not share calendar data with anyone else. OAuth tokens are stored securely and encrypted at rest. Staff can disconnect the integration at any time from the portal or by revoking access at myaccount.google.com/permissions, which immediately ends our access.

Limited Use disclosure

MomVersity's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

With respect to Google user data, we do not:

• use it for advertising or transfer it to advertising platforms;
• sell it to data brokers or any other party;
• allow humans to read it, except with your explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized;
• use it to develop, improve, or train generalized artificial intelligence or machine-learning models.

3. How We Use Information

• To provide, operate, and personalize the Service;
• To verify insurance eligibility, obtain prior authorization, and bill services through your insurance;
• To schedule and deliver live training sessions, including session reminders by email and, where you have provided a phone number, by SMS;
• To create individualized learning pathways and track your family's progress;
• To process payments for optional paid features;
• To communicate with you about enrollment, sessions, and account activity;
• To maintain security, prevent fraud, and debug the Service;
• To comply with legal, clinical, and payer requirements.

We process information because it is necessary to deliver the services you request, with your consent (which you may withdraw), to meet our legal obligations, or for our legitimate interests in operating a secure and reliable service.

4. Service Providers

We share information only with service providers who process it on our behalf under contractual confidentiality obligations, and only as needed for them to perform their functions:

• Supabase — hosting, authentication, database, and file storage;
• Stripe — payment processing and subscription billing;
• Resend and Cloudflare — transactional email delivery;
• Twilio — SMS session reminders and enrollment messages;
• Zoom — live video training sessions and session recordings;
• Availity — insurance eligibility and prior-authorization checks with your payer;
• OpenRouter and OpenAI — generating Spark AI chat responses and automated content moderation;
• Sentry — error and performance monitoring;
• Airtable — managing public job listings on our careers page;
• Google — sign-in, optional staff calendar sync, and importing curriculum files from Google Drive.

We may also disclose information when required by law, to protect the rights and safety of our users and the public, or in connection with a merger or acquisition (in which case this policy will continue to apply to your information). We do not sell personal information, and we do not share it with third parties for their own advertising.

5. Session Recordings

Live training sessions conducted over Zoom may be recorded for clinical documentation, quality assurance, and supervision. Participants are informed before recording begins. Recordings are stored in private storage, access is limited to your care team and authorized staff, and recordings are never made public.

6. Health Information

Clinical information about your child — including assessments, session notes, treatment data, and insurance records — is handled in accordance with applicable health-privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA) where it applies. This information is used and disclosed only for treatment, payment, and healthcare operations: it is shared with the clinicians on your care team and with your insurance payer as necessary to authorize and bill covered services. Access within the Service is role-restricted, and clinical records are protected with additional audit controls.

7. Children's Privacy

MomVersity accounts are created and managed by parents, caregivers, and clinical professionals. Information about children is provided by their parent or guardian as part of receiving services, with the parent's consent. Learner experiences within the Service are supervised through parent- and provider-managed accounts. We do not knowingly collect personal information directly from children under 13 without verifiable parental consent. If you believe a child has provided us information directly, contact [email protected] and we will delete it.

8. Cookies

We use first-party cookies that are essential to the Service: keeping you signed in, securing multi-factor authentication for clinical and staff roles, and protecting against cross-site request forgery. We do not use third-party advertising or cross-site tracking cookies. You can clear cookies in your browser settings, though the Service will not function without its essential authentication cookies.

9. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service. Clinical and billing records are retained for the periods required by healthcare recordkeeping laws and payer requirements. Employment applications are retained for the duration of the hiring process and a reasonable period afterward. When information is no longer needed, we delete it or de-identify it.

10. Security

We protect your information with encryption in transit (TLS) and at rest, role-based access controls, multi-factor authentication for clinical and staff accounts, private storage buckets for sensitive files, and audit logging of access to clinical records. No system is perfectly secure, but we work continuously to safeguard your data and will notify you as required by law in the event of a breach affecting your information.

11. Your Rights and Choices

• Access and correction. You may access and update your account information in the portal, or ask us for a copy of the personal information we hold about you.
• Deletion. You may request deletion of your personal information, subject to clinical and billing recordkeeping requirements we must follow by law.
• Portability. You may request your information in a portable format.
• Communications. You may opt out of non-essential emails and SMS messages at any time; we will still send messages necessary to deliver the Service.
• Google access. You may revoke our access to your Google account at any time at myaccount.google.com/permissions.

Depending on where you live, you may have additional rights under state privacy laws (such as those in New York, California, and other states), including the right to know, delete, correct, and not be discriminated against for exercising your rights. To exercise any right, email [email protected]. We will verify your identity before fulfilling the request and respond within the time required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice in the Service before the changes take effect, and we will update the effective date at the top of this page.

13. Contact Us

LBAPS National operates MomVersity. For any privacy question, request, or complaint, contact us at [email protected].