Privacy Policy

1. Who we are

Healable ("Healable", "we", "us") provides software that helps mental health practitioners document, schedule and bill for clinical sessions. This policy explains what information we collect, how we use it, and the choices you have. It applies to our website, web application and related services (the "Services"). Healable is operated by Heartful Connect Inc., located in Canada.

2. Information we collect

We collect information in three ways:

• Information you give us. Account details (name, email, password), practice information, billing details, and any content you create such as session notes, transcripts and uploaded documents.
• Information about your clients. Practitioners may enter client contact details, intake responses, appointments, audio recordings and clinical notes. We process this information on behalf of the practitioner as a service provider.
• Information we collect automatically. Log data, device and browser information, IP address, and usage events needed to operate, secure and improve the Services.

3. How we use information

• To provide, maintain and secure the Services.
• To transcribe audio and generate clinical notes you request.
• To process payments and prevent fraud.
• To respond to support requests and send service related notifications.
• To comply with legal obligations.

We do not sell personal information, and we do not use client clinical content to train third party AI models.

4. Google Workspace and Photos API data (Limited Use)

Limited Use compliance statement. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. The same commitment applies to any user data received from the Google Photos API.

In practice this means Healable requests Google permissions only for the features that need them, such as signing in with a Google account and importing your Google Calendar events into your Healable schedule. We use that data solely to provide the feature you have enabled, and we do not use it for advertising, sell it, share it with third parties except our service providers working on our behalf, or use it to train general purpose AI models. Access is limited to the minimum required, and it ends when you disconnect your Google account.

You can review and revoke this access at any time in your Google Account settings and in the connected account controls inside Healable.

5. Canadian privacy law and clinical data

Healable is designed to support Canadian mental health practices. Our handling of personal information is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including health information privacy legislation such as Ontario's Personal Health Information Protection Act (PHIPA), where applicable.

When a practitioner uses the Services to handle personal health information, the practitioner remains the custodian or responsible party for that information under their provincial college or regulatory requirements. Healable acts as a service provider to support the practitioner's compliance. Clinical data is encrypted in transit and at rest, access is restricted by role, and audit logs are maintained. A Business Associate Agreement or data processing addendum is available on request.

6. Service providers

We use carefully selected service providers to host infrastructure, send email, process payments, transcribe audio and provide AI features. These providers are bound by contract to protect your information and to use it only to deliver services to us. Some of these providers may process or store data outside Canada. We use contractual safeguards and, where applicable, standard contractual clauses to help protect your information when it is transferred across borders.

7. Data retention

We retain account and clinical data for as long as your account is active or as needed to provide the Services. Practitioners can delete client records and session content at any time from within the application. Backups are purged on a rolling schedule.

8. Your choices and rights

You can access, update or delete most information directly in the application. If you are a client of a Healable practitioner, please contact your practitioner first, as they control your record. Under Canadian privacy law, you may also contact us to request access to, correction of, or deletion of your personal information, subject to legal exceptions.

9. Security

We use industry standard safeguards including encryption, least privilege access, continuous monitoring and regular reviews. No system is perfectly secure, so we also expect customers to use strong passwords and protect their devices.

10. Children

The Services are intended for licensed practitioners and their adult clients. Minors may be treated by a practitioner, but only with appropriate parental or guardian consent obtained by the practitioner.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the date above and, where appropriate, notify you in the application or by email.

12. Contact us

Questions about this policy? Reach us through our contact page.

13. Marketing cookies and Meta

On our home, pricing, about, practitioner benefits and practice application pages, we use Meta Pixel only after you select Accept. It measures marketing page visits and successful practitioner application submissions for advertising measurement and optimization. Meta receives browser and device information, IP address and cookie identifiers. The tracking document uses a fixed address without your page query parameters or referrer. We do not send names, emails, application fields, advanced matching data or clinical information to Meta.

Tracking does not run on directories, practitioner profiles, patient portals, booking pages or signed in application screens. Decline keeps marketing tracking off. Cookie settings in our marketing page footers lets you change your choice or withdraw permission at any time, including in other open tabs. Withdrawal stops future reporting, but does not remove information already received by Meta.

We remember your advertising choice in this browser with a random local visitor reference, the time, and the notice and options shown. Previous acceptance evidence is preserved when you withdraw. A consent reference is stored locally for the latest reported application outcome. These references are not sent to Meta. Practitioner applications are saved separately for review by authorized administrators.