Legal
Privacy Policy
Draft for attorney review. This policy is a working draft and not final legal advice. It does not claim HIPAA compliance, a BAA, or any encryption standard, certification, or security control that has not actually been implemented and documented.
Effective date: [to be set upon finalization] · Contact: [privacy contact placeholder]
1. Overview
Known Practice is a directory and discovery platform that connects consumers with mental health professionals and helps providers manage applications, evidence, and availability. This policy describes how information is handled. It is a draft for attorney review and not final legal advice.
2. Categories of data
Provider data includes profile content, credential and license documents, professional liability coverage attestations, specialty evidence, availability, consultation requests, appointment outcomes, and account-access dates used for security and operational support. Previously submitted malpractice insurance information may also remain on file. Consumer data includes account identity, contact and booking details, cancellation and dispute information, account-access dates, and basic browsing and analytics data.
3. Private credential, license, and insurance documents
Uploaded license documents and any previously submitted malpractice certificates of insurance, policy numbers, and administrative notes are stored privately. New providers attest to professional liability coverage without uploading insurance documents. Private credential records are never displayed on public profiles and are accessible only to the provider and authorized administrators.
4. Purposes of processing
Information is processed to operate the directory, review and display evidence, deliver consultation requests to providers, and maintain the integrity of verification. We do not sell provider or consumer data.
5. Payments and service providers
We use Stripe to collect and store payment credentials and to process an authorized booking commitment fee when applicable. Known Practice stores Stripe identifiers and limited payment status information, not full card numbers. We also use hosting and infrastructure service providers to operate the platform. [Specific service-provider disclosures to be completed upon finalization.]
6. Authentication and security
Access to accounts and records is controlled through authentication and role-based permissions. Known Practice records the date and time of authenticated account access and makes that history available only to authorized administrators for security, support, and profile-completion operations. We do not represent that any specific encryption standard, certification, or security control has been implemented unless separately documented. No system can be guaranteed secure.
7. Retention and deletion
Provider records are retained while an account is active and for a period thereafter to support verification and audit. [Specific retention periods to be finalized.] Users may request deletion subject to legal and audit obligations.
8. Your rights and contact
Depending on your jurisdiction, you may have rights to access, correct, or delete your information. To exercise these rights, contact [privacy contact placeholder].
9. Cookies and analytics
We use cookies and analytics to understand platform use and improve the service. [Specific cookie and analytics disclosures to be finalized.]
10. Minors
Known Practice is not directed to minors for independent use. Providers indicate the age groups they serve; this does not make Known Practice a service provider to minors.
11. Breach and security limitations
In the event of a security incident, we will act in accordance with applicable obligations. We do not warrant that information will never be exposed, and we do not claim compliance with any specific security framework unless separately documented.
12. Directory data vs. PHI
Known Practice handles ordinary directory and consultation-request data. It is not a covered entity and does not claim HIPAA compliance or offer a Business Associate Agreement. Consultation requests are not intended to carry Protected Health Information.
13. Text messaging
If you separately opt in, Known Practice may send the categories of text messages you selected, such as provider account and profile messages or promotional platform updates. Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe or HELP for help. You may withdraw consent at any time, and agreeing to texts is not required to create an account or use Known Practice. Text messaging originator opt-in data and consent are used only to administer your text-message preferences and are not shared with third parties. All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.
13. Do not upload patient information
Do not upload patient records, case notes, client names, or other patient-level PHI as evidence, and do not include highly sensitive clinical information in consultation requests. Known Practice is not a clinical records system.