Privacy

Who is responsible for your information

EttaCare provides software to independent behavioral-health practices and clinicians. For clinical and billing records, your practice is generally the health-care provider and EttaCare processes information on its behalf under a business associate agreement. EttaCare is directly responsible for information collected for its own directory, account, security, support and pre-patient services.

A practice’s Notice of Privacy Practices governs its treatment, payment and health-care operations. Washington residents should also read our separate Consumer Health Data Privacy Policy.

Information we handle

The information depends on how you use EttaCare. It can include:

• Account, contact, identity, guardian and provider-credential information.
• Appointments, communications, intake responses, clinical notes and documents.
• Insurance, claims, estimates, invoices, payments and refund records.
• Support messages and security, audit, device and IP-address events.
• Directory searches, waitlist requests and other information you choose to submit before care begins.

Why we use it

We use information to provide and secure the service; connect people with providers; support scheduling, telehealth and communications; support treatment and clinical documentation; process coverage, claims and payments; respond to support and rights requests; prevent fraud; keep required audit records; and comply with law.

EttaCare does not sell personal information or consumer health data and does not use patient or consumer health data for targeted advertising. Optional marketing analytics that would receive consumer health data are disabled at launch.

When information is disclosed

We disclose only what is needed to the practice and clinicians involved in care; service providers that operate the platform; payment, insurance and clearinghouse participants selected for a requested workflow; recipients authorized by the individual; and government or safety recipients when law permits or requires it.

Our current service-provider list is published on the Subprocessors page. Self-hosted Jitsi video runs inside EttaCare’s AWS environment and is not a separate hosted video vendor.

Security, retention and choices

EttaCare uses access controls, audit trails, encryption in transit and at rest, malware scanning and other safeguards appropriate to the sensitivity of the information. No online service can promise absolute security.

Information is retained according to the record type, the practice’s legal duties and the documented retention schedule. Clinical, billing, security and agreement evidence may need to remain after an account closes. Where deletion applies, EttaCare deletes eligible copies and notifies applicable processors; backup deletion may take up to the period permitted by law.

You may use your existing account or an authenticated support request to request access, correction, restriction, an accounting, withdrawal or deletion where applicable. You do not need to create a new account to submit a privacy request.