Privacy Policy

Reframe Practice ("we," "us," or "our") is a Canadian software company that provides AI-powered tools for mental health professionals. Our primary service helps therapists create personalized therapeutic worksheets and session guides.

We are based in Ontario, Canada, and operate under Canadian privacy laws including PIPEDA (Personal Information Protection and Electronic Documents Act).

We collect the minimum information necessary to provide our services:

Account Information

• Email address - for account access, password resets, and important service notifications
• Name and credentials - your professional name and credentials (optional, for worksheet branding)
• Practice information - practice name and branding preferences (optional)

Usage Information

• Generation counts - how many worksheets you have created (for subscription limits)
• Feature usage - named actions, bounded counts, device category, and referring domain used to improve the product. Our anonymous first-party funnel uses a random browser-session identifier, not an email or a stable device fingerprint.
• Subscription status - your current plan and billing cycle

Assessments and Service Requests

• Contact and practice information - information you submit when requesting a visibility assessment, report, consultation, or service, such as your name, email, practice name, location, website, and public profile URLs
• Assessment answers and results - the professional-practice answers and generated visibility findings needed to provide the report and related follow-up
• Source information - referral source and campaign categories used to understand how a request reached Reframe

Payment Information

• Billing details - processed securely by Stripe. We do not store your full credit card number.

We use Google Cloud Vertex AI to generate therapeutic worksheets and session guides. Here is what you should know:

• HIPAA-eligible infrastructure - Google Cloud is HIPAA-eligible and we have a signed Business Associate Agreement (BAA) in place.
• No model training - Your content is NOT used to train Google's AI models. This is explicitly prohibited under our agreement.
• Ephemeral processing - Data is processed in memory and immediately discarded after the response is generated.
• US data centers - Processing occurs in Google Cloud's US data centers.

For our Profile Optimizer tool (which helps you write your Psychology Today profile), we use a separate AI service. This tool only processes your own professional bio text, not client information.

Best practice:While our architecture is designed to handle clinical content safely, we recommend using de-identified descriptions when possible (e.g., "35yo professional with anxiety" rather than full names).

We use the following categories of service providers:

Important: None of these services (except Google Cloud for AI processing) receive client descriptions or worksheet content. That data stays local to your browser or is processed ephemerally.

Reframe Practice is a Canadian company, but some of our service providers are based in the United States. When you use our AI generation features, your data is processed in the United States.

For Canadian users: By using our services, you consent to the transfer of your information to the United States for processing. We ensure a comparable level of protection through contractual safeguards (Data Processing Agreements) with our service providers, as required by PIPEDA.

For US users: Your data is processed domestically within the United States.

Note: Data processed in the United States may be accessible to US courts, law enforcement, or national security authorities under applicable US laws. Our zero-retention architecture minimizes this risk, as we do not maintain persistent records of client information.

We use analytics tools to understand how our product is used and to improve it:

Cookieless analytics (no persistent analytics cookies or consent banner):

• DataFast - Measures page views, referral sources, and approved conversion events. Its cookieless script sends events directly to DataFast and does not use cookies for visitor identification. It uses session-only browser storage and a pseudonymous identifier derived by DataFast from the visitor's IP address, browser User-Agent, the site domain, and a salt that rotates about every 24 hours. The identifier cannot follow a visitor across days.
• Ahrefs Web Analytics - Measures page views on public pages only. Reframe sends a minimal cookieless pageview after removing query strings and reducing external referrers to their origin. Ahrefs does not receive clicks, forms, assessment results, account pages, private routes, names, or email addresses from this integration.
• Vercel Web Analytics - Provides aggregate page statistics. Reframe removes query strings and replaces identifier-bearing paths with general route labels before an analytics event is sent.

Cookie-based analytics:

• Microsoft Clarity - Session recordings and heatmaps on public marketing pages only (homepage, About, services, product, pricing, guides, answers, and the Practice Checkup landing page). It uses cookies. It does not load on account pages, login, dashboards, clinical tools, or assessment result pages. Input fields are masked. We do not use recordings of clinical or account activity.
• Meta Pixel - Advertising measurement on public marketing pages only (homepage, About, services, product, pricing, contact, booking, guides, answers, and the Practice Checkup landing page). It uses cookies and Meta may match a visit to a Meta account. It does not load on account pages, login, dashboards, clinical tools, or assessment result pages, and it sends nothing from those pages if you navigate to them. We turn off Meta's automatic collection, so it does not scrape button clicks or form fields, and automatic advanced matching is off: we never send your name, email address, or phone number to Meta. It never receives worksheet content, client descriptions, assessment answers, or generated clinical content.
• Google Analytics 4 is currently disabled. If it is re-enabled, it will require consent and must pass our private-route and query-redaction verification first.

We also keep limited first-party event records in Supabase so we can measure activation and conversion. These records use named event categories and approved machine-readable properties. We do not send or store worksheet content, client descriptions, assessment answers, generated clinical content, names, or email addresses in analytics events.

You have the following rights regarding your personal information:

• Access - You can request a copy of the personal information we hold about you.
• Correction - You can update your account information at any time through your settings.
• Deletion - You can request deletion of your account and associated data.
• Data Portability - You can export your locally-stored worksheets at any time.

To exercise these rights, contact us at privacy@reframepractice.com.

For California residents: Under the CCPA, you have additional rights including the right to know what personal information we collect and the right to opt out of the sale of personal information. We do not sell your personal information.

• Account information - Retained while your account is active. Deleted within 30 days of account deletion request.
• Payment records - Retained as required by tax and accounting regulations (typically 7 years).
• Client descriptions - Not retained. Processed ephemerally and immediately discarded.
• Generated worksheets - Stored locally on your device. We have no access or retention of this data.
• Authenticated usage events - Retained while your account remains active and removed when the associated account is deleted.
• Anonymous funnel events - Retained for product and business measurement. They use a random browser-session identifier and are not linked to your account or email.
• Assessment and service-request records - Retained while needed to provide the requested report or service, maintain the business relationship, meet legal obligations, or respond to a valid deletion request.

Reframe Practice is a business tool for licensed mental health professionals. We do not knowingly collect personal information from children under 13. If you are a therapist working with minor clients, you are responsible for ensuring you have appropriate parental consent for any information you input into our system, as required by your professional obligations and applicable laws including COPPA.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our service at least 30 days before they take effect. Your continued use of the service after the effective date constitutes acceptance of the updated policy.