This Privacy Policy explains how LBAPS National ("LBAPS," "we," "us," or "our") collects, uses, shares, and protects information when you use MomVersity, our insurance-billed ABA parent-training platform available at lbapsnational.com (the "Service"). By using the Service, you agree to the practices described in this policy. If you have questions at any time, contact us at [email protected].
1. Information We Collect
Information you provide to us
- Account and enrollment information. When you enroll or create an account, we collect your name, email address, phone number, mailing address, and login credentials.
- Child and family information. To deliver ABA parent-training services, parents and caregivers provide information about their child, including age, developmental and behavioral information, assessment responses, and progress data. Clinicians on your care team (BCBAs and RBTs) create session notes and clinical documentation. We treat this information as sensitive health information (see Section 6).
- Insurance information. We collect your insurance payer, member ID, and related coverage details to verify eligibility and, where required, obtain prior authorization for services.
- Payment information. Payments for optional paid features are processed by Stripe. Card numbers are transmitted directly to Stripe; we never store full card numbers on our systems.
- Employment applications. If you apply for a position through our careers page, we collect the information in your application and résumé. Résumés are stored in private storage and are accessible only to hiring staff.
- Referrals. If you refer a patient, we collect the contact and clinical information you submit, along with any attachments.
- Chat messages. Messages you send to Spark, our AI assistant, are processed to generate responses and screened by automated moderation for safety.
Information collected automatically
- Log and usage data, such as pages visited, actions taken, IP address, browser type, and timestamps.
- Cookies and similar technologies used to keep you signed in and to secure your session. We do not use third-party advertising cookies.
- Error and performance diagnostics collected through our monitoring tools to keep the Service reliable.
2. Google User Data
MomVersity offers two optional Google integrations: Google Sign-In for all users, and Google Calendar for clinical and staff users. This section explains what Google user data the Service accesses, how we use it, who we share it with, how we protect it, and how long we keep it. Neither integration is required to use the Service.
Google user data we access
- Google Sign-In. If you choose to sign in with Google, we receive your name, email address, and profile picture from your Google account (the standard
openid, email, and profile scopes). We do not receive your Google password. - Google Calendar (clinical and staff users only). If a BCBA, RBT, or staff member connects their Google Calendar, we request the
calendar.events scope for their primary calendar. With this access we:- create events for the intake appointments, training sessions, and open intake slots MomVersity schedules for that staff member;
- update an open intake slot event when a family books it, and change it back when that booking is released;
- delete an open intake slot event when the staff member removes that time from their availability; and
- when the staff member chooses to sync, read the start and end times of events in the upcoming scheduling window so MomVersity has a record of when they are busy.
We also receive an OAuth refresh token that lets the Service keep the calendar up to date without asking the staff member to sign in to Google again.
Parents and caregivers are never asked to connect a Google Calendar. Separately, our staff may import curriculum files from a MomVersity Google Drive folder using an organization-owned service account; that feature does not access any user's personal Google account.
How we use Google user data
We use Google user data only to provide and improve the features you asked for:
- Sign-in data is used to create and authenticate your MomVersity account and to show your name and picture within the Service.
- Calendar access is used to keep the connected staff member's own calendar in sync with their MomVersity schedule. Events we create contain the appointment type, the Zoom link, and, for intake appointments, the family's name so the clinician knows who they are meeting. We only change or delete events MomVersity created; we never edit or delete the staff member's other events.
From events we did not create, we keep only start and end times and Google's event ID. We do not store their titles, descriptions, locations, or attendees. We do not use Google user data for advertising, profiling, or any purpose unrelated to these features, and we never sell it.
How we share, transfer, or disclose Google user data
We do not sell, rent, or trade Google user data, and we do not transfer or disclose it to third parties for any purpose other than those described above. Google user data is shared only:
- with Supabase, our hosting and database provider, which stores it on our behalf under contractual confidentiality obligations;
- within the Service, where your name and picture are visible to your care team and authorized staff (families never see a staff member's calendar details);
- when required by law, to protect the rights and safety of our users and the public, or as part of a merger or acquisition, in which case this policy continues to apply.
How we protect Google user data
- All data is encrypted in transit with TLS and stored in a database that is encrypted at rest.
- Google OAuth refresh tokens are stored server-side only. They are never sent to your browser or shown in the Service, and they are used only by our servers to call the Google Calendar API.
- Access is restricted by role. BCBA and staff accounts are created by invitation only, and only a small number of authorized engineers can access production systems, for security and support purposes.
- We request the narrowest Google scopes these features need, and we verify each Google connection with a cryptographically signed state value to prevent request forgery.
Retention and deletion of Google user data
- Sign-in data (name, email, and profile picture) is kept for as long as your MomVersity account is active.
- Calendar busy times are kept only for the upcoming scheduling window. Each sync replaces the previous set, and past busy times are no longer used.
- The Calendar refresh token is kept until the staff member revokes access, asks us to disconnect the integration, or their account is closed.
You can revoke MomVersity's access to your Google account at any time at myaccount.google.com/permissions. Revoking access immediately stops us from reading or writing your calendar. To have us delete the Google user data we hold, including stored tokens and busy times, email [email protected]. We will delete it within 30 days, except where we must keep information to meet clinical or billing recordkeeping laws. Events already created on your Google Calendar stay there until you delete them.
Limited Use disclosure
MomVersity's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
With respect to Google user data, we do not:
- use it for advertising or transfer it to advertising platforms;
- sell it to data brokers or any other party;
- allow humans to read it, except with your explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymized;
- use it to develop, improve, or train generalized artificial intelligence or machine-learning models.
3. How We Use Information
- To provide, operate, and personalize the Service;
- To verify insurance eligibility, obtain prior authorization, and bill services through your insurance;
- To schedule and deliver live training sessions, including session reminders by email and, where you have provided a phone number, by SMS;
- To create individualized learning pathways and track your family's progress;
- To process payments for optional paid features;
- To communicate with you about enrollment, sessions, and account activity;
- To maintain security, prevent fraud, and debug the Service;
- To comply with legal, clinical, and payer requirements.
We process information because it is necessary to deliver the services you request, with your consent (which you may withdraw), to meet our legal obligations, or for our legitimate interests in operating a secure and reliable service.
4. Service Providers
We share information only with service providers who process it on our behalf under contractual confidentiality obligations, and only as needed for them to perform their functions:
- Supabase — hosting, authentication, database, and file storage;
- Stripe — payment processing and subscription billing;
- Resend and Cloudflare — transactional email delivery;
- Twilio — SMS session reminders and enrollment messages;
- Zoom — live video training sessions and session recordings;
- Availity — insurance eligibility and prior-authorization checks with your payer;
- OpenRouter and OpenAI — generating Spark AI chat responses and automated content moderation;
- Sentry — error and performance monitoring;
- Airtable — managing public job listings on our careers page;
- Google — sign-in, optional staff calendar sync, and importing curriculum files from Google Drive.
We may also disclose information when required by law, to protect the rights and safety of our users and the public, or in connection with a merger or acquisition (in which case this policy will continue to apply to your information). We do not sell personal information, and we do not share it with third parties for their own advertising.
5. Session Recordings
Live training sessions conducted over Zoom may be recorded for clinical documentation, quality assurance, and supervision. Participants are informed before recording begins. Recordings are stored in private storage, access is limited to your care team and authorized staff, and recordings are never made public.
6. Health Information
Clinical information about your child — including assessments, session notes, treatment data, and insurance records — is handled in accordance with applicable health-privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA) where it applies. This information is used and disclosed only for treatment, payment, and healthcare operations: it is shared with the clinicians on your care team and with your insurance payer as necessary to authorize and bill covered services. Access within the Service is role-restricted, and clinical records are protected with additional audit controls.
7. Children's Privacy
MomVersity accounts are created and managed by parents, caregivers, and clinical professionals. Information about children is provided by their parent or guardian as part of receiving services, with the parent's consent. Learner experiences within the Service are supervised through parent- and provider-managed accounts. We do not knowingly collect personal information directly from children under 13 without verifiable parental consent. If you believe a child has provided us information directly, contact [email protected] and we will delete it.
8. Cookies
We use first-party cookies that are essential to the Service: keeping you signed in, verifying supervisor PINs for RBT accounts, and protecting against cross-site request forgery. We do not use third-party advertising or cross-site tracking cookies. You can clear cookies in your browser settings, though the Service will not function without its essential authentication cookies.
9. Data Retention
We retain personal information for as long as your account is active and as needed to provide the Service. Clinical and billing records are retained for the periods required by healthcare recordkeeping laws and payer requirements. Employment applications are retained for the duration of the hiring process and a reasonable period afterward. Google user data is retained as described in Section 2. When information is no longer needed, we delete it or de-identify it.
10. Security
We protect your information with encryption in transit (TLS) and at rest, role-based access controls, invitation-only clinical and staff accounts, private storage buckets for sensitive files, and audit logging of access to clinical records. No system is perfectly secure, but we work continuously to safeguard your data and will notify you as required by law in the event of a breach affecting your information.
11. Your Rights and Choices
- Access and correction. You may access and update your account information in the portal, or ask us for a copy of the personal information we hold about you.
- Deletion. You may request deletion of your personal information, subject to clinical and billing recordkeeping requirements we must follow by law.
- Portability. You may request your information in a portable format.
- Communications. You may opt out of non-essential emails and SMS messages at any time; we will still send messages necessary to deliver the Service.
- Google access. You may revoke our access to your Google account at any time at myaccount.google.com/permissions.
Depending on where you live, you may have additional rights under state privacy laws (such as those in New York, California, and other states), including the right to know, delete, correct, and not be discriminated against for exercising your rights. To exercise any right, email [email protected]. We will verify your identity before fulfilling the request and respond within the time required by applicable law.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice in the Service before the changes take effect, and we will update the effective date at the top of this page.
13. Contact Us
LBAPS National operates MomVersity. For any privacy question, request, or complaint, contact us at [email protected].