Legal

Privacy Policy

Last updated: October 30, 2026

This Privacy Policy explains how Mosara ABA (“Mosara ABA,” “we,” “us” or “our”) collects, uses, shares and protects personal information when you visit our website, contact us, or use the Mosara ABA service (the “Service”).

1. Who this policy covers

1.1 Two kinds of information. We handle two different kinds of information, under different rules:

• Information about you as a business user or website visitor. This includes practice owners, administrators, clinicians and other staff who use the Service, people who request a demo, and visitors to our website. This Privacy Policy explains how we handle that information.
• Information our customers put into the Service about their clients. ABA practices (“Customers”) use the Service to document care for their clients, who are often children, and to work with caregivers. That information, including protected health information (“PHI”), belongs to the Customer. We handle it only on the Customer’s behalf, as the Customer’s “business associate” under HIPAA, following our Terms of Service and our Business Associate Agreement (“BAA”) with that Customer. The Customer’s own notice of privacy practices governs how it uses that information.

1.2 If you are a client or caregiver. If you receive services from a practice that uses Mosara ABA, please contact that practice about your information, including to see, correct or get a copy of your records. If you contact us, we will forward your request to the practice when we can identify it.

1.3 Business service, adults only. The Service is for businesses. Users must be at least 18.

1.4 Parent and caregiver portal users. If a practice invites you to its parent and caregiver portal, the practice decides what you can see and sign, and is responsible for confirming that you are the client’s parent, legal guardian or other authorized representative. Information about the client that you see or provide, including your signatures, is part of the practice’s records and is governed by our BAA with the practice. We also keep basic account and usage information about you (name, email, sign-in times, IP address and device) to run and secure the portal, as described in this policy. The practice is responsible for getting your consent to sign electronically where the law requires it. Ask your practice about access or corrections, or email [email protected] and we will forward your request to the practice.

2. Information we collect

2.1 Information you give us.

• Account and profile information: name, work email address, phone number, job title or role (for example, owner, BCBA or RBT), practice name and locations, and professional details your practice enters, such as credentials.
• Billing information: billing contact, billing address and plan details. Card payments are handled by our third-party payment processor. We receive only limited card details such as the card brand, last four digits and expiration date. We never receive or store full card numbers.
• Communications: what you send us when you request a demo, email us or ask for support.
• Mobile number: if text-message sign-in codes or reminders are turned on for you (text reminders are coming soon), we use your number to send them. Message and data rates may apply. Reply STOP to any text to stop receiving texts.
• Signatures: if your practice uses electronic signatures in the Service, the signatures of clinicians and caregivers are stored as part of the Customer’s records.

2.2 Information collected automatically.

• Usage and device information: when you use the Service, we log information such as IP address, browser and device type, pages and features used, dates and times, and errors. We use it to run, secure and improve the Service.
• Cookies and similar technologies: the Service uses cookies or similar browser storage that are necessary to keep you signed in and secure. Our website does not use advertising cookies or third-party trackers. Our hosting and security provider may set strictly necessary security cookies to protect the site from abuse.
• Website visit counts: our website counts anonymous page views with our own first-party analytics, without cookies and without storing IP addresses. We use these counts only to understand which pages are visited.
• Website forms: when you request a demo or a trial or send us a message through a form on our website, we store what you enter so we can reply. Please don’t include any client or patient information in these forms. Submitting a form does not sign you up for the Service or accept our Terms of Service.
• Ask Mosara box on our website: the Ask Mosara box on our website matches your question to answers from our FAQ inside your browser. It does not use AI, and what you type is not sent to us unless you choose to send it as a message. Please don’t type client information there.

2.3 Information from others. We may receive information from your practice (for example, when an administrator creates your login) and from our payment processor (for example, whether a payment succeeded).

3. How we use information

We use the information in Section 2 to:

• provide, operate and maintain the Service, and create and manage accounts;
• process payments, send receipts, trial and renewal reminders, and other account notices;
• provide support and respond to requests;
• protect the Service, our Customers and their clients, including by detecting and preventing fraud, abuse and security incidents;
• understand how the Service is used and improve it, using aggregated or de-identified information where possible;
• send product updates and, where allowed, marketing emails, which you can opt out of at any time (we will still send account and service notices); and send text messages only to people who have agreed to receive them; and
• comply with law and enforce our agreements.

We use PHI only as our BAA with the Customer allows, which means mainly to provide the Service to that Customer. We do not sell personal information or PHI, use PHI for marketing or advertising, or “share” personal information for cross-context behavioral advertising.

4. AI features

Some features use artificial intelligence, for example AI wording review of session notes and the “Ask Mosara” assistant inside the app (coming soon). We have not yet signed a business associate agreement with an AI model provider, so AI features are off for any practice account that holds real patient information (PHI) and are used today only with sample data, such as in the demo. We will turn AI features on for a practice that uses PHI only after our AI model provider has signed a business associate agreement with us and agreed in writing not to train its models on the data. When an AI feature runs, we send only the information needed for that feature. We do not use Customer Data or PHI to train AI models. AI suggestions are assistive. The clinician remains responsible for the final note.

5. How we share information

We share information only as described here.

5.1 Service providers (sub-processors). We use service providers in the categories below to run the Service. Each may process information only to provide services to us, under a written agreement. Every provider that will create, receive, store or transmit PHI must sign a business associate agreement with us before it handles any PHI; any provider that has not signed one is kept away from PHI.

• Cloud hosting and storage of Customer Data: before any Customer puts PHI into the Service, the environment that stores it will be hosted by a cloud provider that has signed a business associate agreement with us. Until that environment is enabled for a Customer, the Customer may use only test or sample data (see our Terms, Section 6.2).
• Demo and website hosting, network and security: Supabase, Inc. and Cloudflare, Inc. Our demo environment contains only fictional sample data, never PHI. Cloudflare also hosts our website and provides network and security services.
• Email: our business email is provided by Google LLC (Google Workspace), and an email delivery provider sends account emails such as sign-in codes, reminders and notices. These emails are designed not to include client information. Do not send PHI to us by email.
• Text messaging (coming soon): a text-message provider for sign-in codes and reminders. Texts are designed to carry no more than minimal information, and a provider that would carry PHI must sign a business associate agreement first.
• AI model provider: the provider that powers our AI Features (see Section 4). It will not receive PHI until it has signed a business associate agreement with us.
• Payment processing: our third-party payment processor (not yet connected). It receives billing details only, never PHI.
• Website analytics: our own first-party page-view counts (see Section 2.2). No third-party analytics provider receives information about you.

Sub-processor list. We will publish a current list of our sub-processors, what each does, and whether it is under a business associate agreement, and update it before a new sub-processor handles Customer Data. Until it is published, the list is available on request at [email protected].

5.2 Within a Customer’s account. Information in a practice’s account is visible to that practice’s Authorized Users according to the roles and permissions the practice sets.

5.3 Legal reasons. We may disclose information if we believe in good faith that the law, a court order or a valid government request requires it, or that disclosure is needed to protect the rights, property or safety of Mosara ABA, our Customers, their clients or others. For PHI, we follow the BAA and HIPAA.

5.4 Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal. Any successor must protect it as described in this policy and honor our BAAs.

5.5 With your permission. We may share information for other purposes with your consent or at your direction.

6. How long we keep information

• Account and business contact information: while the account is active and for up to 3 years afterward for legal, tax and record-keeping purposes.
• Billing and transaction records: for as long as tax and accounting laws require, generally up to 7 years.
• Customer Data, including PHI: for as long as the Customer’s subscription is active. After the subscription ends, the Customer can export its data for 30 days; we then delete it from the live Service within 30 days, and backup copies are deleted or overwritten within 90 days after that, unless the law requires us to keep it.
• Security and usage logs: for up to 12 months, unless needed longer to investigate a security issue.

7. How we protect information

We use administrative, physical and technical safeguards designed to protect the information we handle, including role-based access controls, two-step sign-in (multi-factor authentication) required for owner and administrator logins on accounts that hold real patient information, limits on staff access, and activity logging. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. For PHI, we follow the safeguard obligations in our BAA with each Customer.

8. Security incidents and breach notification

If we learn of a breach involving PHI we handle for a Customer, we will notify that Customer as required by HIPAA and our BAA, without unreasonable delay and in no case later than 60 days after discovery (our BAA commits us to a shorter period). The Customer, as the covered entity, is generally responsible for notifying affected individuals. Where the Florida Information Protection Act applies and we act as the Customer’s third-party agent, we will notify the Customer as quickly as practicable and no later than 10 days after determining, or having reason to believe, that a breach occurred, so that the Customer can notify affected individuals within the 30 days that law allows. If a breach affects personal information we hold for our own purposes, such as account information, we will notify affected people and regulators as the law requires.

9. Your choices and rights

9.1 Your account information. You can view and update most account information in the Service. You may also ask us to access, correct, delete or export personal information we hold about you as a business user or website visitor by emailing [email protected]. We will verify your request and respond within the time the law requires, or within 45 days where no specific law applies. Some information we must keep, for example for billing or legal reasons, or because it is part of a Customer’s records.

9.2 Information inside a practice’s records. If your information is part of a Customer’s records, for example as a clinician who wrote notes or a caregiver who signed, we will refer your request to that Customer, because it controls those records.

9.3 Marketing emails and texts. Our marketing emails identify us, include our postal address and an unsubscribe link, and we honor unsubscribe requests within 10 business days, as the CAN-SPAM Act requires. We do not send marketing texts without your prior express written consent. You can stop any text messages from us by replying STOP; we may still send account and service emails needed to provide the Service.

9.4 State privacy laws. Depending on where you live, state law may give you additional rights. We will honor those rights as the law requires and will not discriminate against you for using them. You may use an authorized agent where the law allows.

10. Children

The Service is not directed to children, and children may not create accounts. Our Customers may enter information about the children they serve as part of their clinical records. We handle that information only on the Customer’s behalf, under HIPAA and our BAA, and the Customer is responsible for any required parental notices and consents. We do not knowingly collect personal information directly from children under 13. If you believe a child has given us personal information directly, contact us and we will delete it.

11. Where information is processed

We are based in the United States, and the Service is designed for US health care providers. Information is stored and processed in the United States. If you access the Service from another country, your information will be transferred to and processed in the United States, and your practice is responsible for making sure that its use of the Service complies with the laws that apply to it there.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version with a new effective date and, if the changes are material, notify account owners by email or in the Service before they take effect.

13. Contact us

Questions or requests about this policy: [email protected]

Postal address: being finalized; it will be added here before we send any marketing email.

Questions? [email protected]