Privacy Policy

This Privacy Policy explains how Hootcare Inc ("we", "us"), the company that operates the Hootcare platform (the "Service"), handles information. Hootcare is software used by speech-language pathology practices and the families they serve: a homework management tool SLPs use to assign and oversee kids' speech practice at home.

Our role with health information

For the clinical and child information processed through the Service, the clinical practice is the data controller (and, under U.S. health-privacy law, the "Covered Entity"). Hootcare Inc acts as that practice's service provider — a HIPAA Business Associate and, where applicable, a GDPR processor — and processes Protected Health Information ("PHI") only on the practice's documented instructions and under a Business Associate Agreement (BAA). The practice's own privacy notice governs how that PHI is used in care. This Policy describes Hootcare Inc's own practices and our public website.

Information we collect

From website visitors. When you browse hootcare.io or request a demo, we collect what you submit (e.g., name, email, practice name). On our public marketing pages we use Google Analytics to understand aggregate traffic: pages viewed, the referring site or campaign, approximate location, and device type. It is never loaded inside the signed-in app or on any page containing patient information. We do not use third-party advertising or cross-site tracking cookies.

From platform users, on behalf of practices. To provide the Service we process: clinician and parent account details (name, email, and — for providers — SLP credentials such as an NPI, state license, or ASHA number, which we may check against public registries like NPPES); child profile and clinical information that the practice enters or that families provide (intake, practice assignments and results, clinical notes and progress summaries, messages, voice recordings captured during speech practice where consent has been given, and interactions with Hoot, the kid-facing AI companion); device push tokens for mobile notifications; and audit/usage logs. This information is provided to us by the practice and the families it invites, and is processed under the practice's instructions and the BAA.

How we use information

We use information solely to provide, secure, maintain, and improve the Service for the practice; to provide support; to process AI features (practice-activity generation, speech-practice feedback and transcription, draft session notes and progress digests, and Hoot's voice conversations); for billing to the practice; and to meet legal obligations. We do not sell personal information, and we do not use PHI or children's information for advertising or to train AI models for unrelated purposes.

Children's privacy (COPPA)

Hootcare's kid-facing surfaces are used in a clinical context. Child information is collected and used only at the direction of the clinical practice and the child's parent/guardian, who provide the required consent through the practice. We minimize the data collected from children, do not use it for advertising, and provide tools for the practice and parents to access or delete it. To request deletion of a child's data, a parent/guardian can email support@hootcare.io from the address on their account (or ask the child's practice), and we will erase the child's records and recordings; deleting the parent's own account in-app removes the family space it owns (see how to delete your account). Questions about a child's data should be directed to the child's practice or to us at support@hootcare.io.

A child's voice during speech practice. When a child practices, Hoot briefly listens each time the child says a practice word so it can transcribe that one word and check whether it was heard. This momentary capture happens on every practice turn, and on its own nothing is saved: the audio is used only for that check and then discarded — even before a grown-up has finished the in-app "Set up practice" step. A child's short practice clips are kept only with the verifiable consent of that child's own parent/guardian, given by the adult in the app (or by the treating clinician on the web) for that specific child; without it the server keeps nothing. Kept clips are automatically deleted after 90 days and are never used for advertising or to train AI models for unrelated purposes. A child's voice is processed by Google's Vertex AI under a HIPAA business-associate agreement (BAA), not by any consumer AI service. Consent can be withdrawn at any time in the app's Settings.

How we share information — subprocessors

We share information only with vendors that help us run the Service, under contracts that restrict their use of it (and a BAA where they may handle PHI). Our current subprocessors include Google Cloud (hosting, database, storage, and Vertex AI for AI features — covered by the Google Cloud BAA), WorkOS (clinician sign-in), Apple (App Store in-app subscription billing), SendGrid/Twilio (transactional email), Expo (mobile push notification delivery), and Cloudflare (network/security). We do not sell data and disclose it otherwise only when required by law or to protect rights and safety.

Cookies & tracking

We use only the cookies needed to sign you in and keep the Service secure, plus Google Analytics cookies on our public marketing pages (not in the signed-in app, and not for visitors in the EEA, UK, or Switzerland). Google's advertising features are turned off, and no third-party advertising or cross-site tracking cookies are used. You can opt out of Google Analytics with Google's browser add-on.

Data retention

We retain information for as long as needed to provide the Service to the practice and as the practice instructs, and as required by law. As a data-minimization measure, the most sensitive raw data (consent-retained child speech-practice recordings and raw AI conversation turns) is automatically purged after 90 days by a nightly job that deletes the stored audio and then its record, while clinical records are retained per the practice's record-keeping obligations. Audit logs are retained for at least six years.

Security

We encrypt data in transit and at rest, isolate each practice's data at the database layer, enforce role-based access controls, hash credentials, keep an append-only audit log of PHI access, and route all AI processing through BAA-eligible infrastructure. No method of transmission or storage is perfectly secure, but we hold ourselves to recognized safeguards for health data.

Your choices & rights

Individuals have rights to access, correct, and delete their personal information. For clinical/child information, these requests are fulfilled through the clinical practice (the controller); Hootcare Inc assists the practice and provides data-export and erasure tooling. For website/marketing information, contact us at support@hootcare.io to access or delete your data or to opt out of communications. To delete your HootCare account, follow the steps on our account deletion page.

Where data is processed

The Service is operated from the United States, and information is processed and stored in the United States. We do not currently offer the Service to controllers processing the personal data of individuals located in the EU/EEA/UK.

HootCare in ChatGPT and Codex

Clinicians can connect the optional HootCare plugin to OpenAI's ChatGPT or Codex to search HootCare's speech-sound and word content and to create and preview activities in their practice's activity library. The plugin is for reusable practice content only. It has no tools for accessing child profiles, goals, assignments, results, recordings, or notes, and excludes activities marked as made for an individual child. It cannot approve or assign activities; those actions happen only in the HootCare app. Do not include child information in prompts, activity titles, themes, or library content you use with the plugin. Free-text fields are not guaranteed to detect or remove personal information you enter.

What the plugin receives. When you connect it, you sign in through WorkOS, our sign-in provider, and we receive your WorkOS user ID and account email so we can match the connection to your existing HootCare clinician account (only a verified email is matched, and we never create an account through the plugin). Each time the plugin is used, we receive the tool inputs ChatGPT or Codex sends — for example a target sound, practice level, play theme or activity title — and we return library content such as practice words, activity titles and generated activity text. Activity generation uses HootCare's backend and Google Cloud Vertex AI, as it does in the app.

What OpenAI receives. ChatGPT and Codex are operated by OpenAI. When you connect and use the plugin, OpenAI receives the tool inputs and results above, plus your HootCare clinician account ID, display name and email to identify the connected account. OpenAI's terms and privacy policy govern its handling of that information. Please do not type a child's name or other details about a child into ChatGPT or Codex when using the plugin.

Retention and disconnecting. Activities you create through the plugin are saved in your practice's library like any other activity. Calls associated with your clinician account are recorded in our audit log, including the tool name, time, outcome and IP address, but not the tool's free-text inputs (retained as described above). We keep your WorkOS user ID on your clinician account so later connections recognize you. You can disconnect at any time from the plugin's settings in ChatGPT or Codex; activities already created stay in your library until you delete them in the HootCare app.

Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice to affected practices.

Contact us

Hootcare Inc — privacy questions: support@hootcare.io. If you are a patient/parent, you may also contact your clinical practice, which controls your health information.