Privacy Policy

1. Introduction & Scope

TrustRoom Connect, Inc. (“TrustRoom,” “we,” “us,” or “our”) provides a HIPAA-compliant platform that facilitates secure communication, care plan management, and clinical analytics between licensed mental health providers (“Providers”) and their patients (“Patients”). This Privacy Policy explains how we collect, use, disclose, retain, and protect your information.

This policy applies to:

• Patients who use TrustRoom’s patient application
• Providers who use TrustRoom’s provider portal or provider mobile application
• Parents or legal guardians who provide consent for minor patients
• Visitors to our website at trustroomconnect.com
• Students at educational institutions whose counseling centers use TrustRoom

Our HIPAA Role. TrustRoom operates as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act (“HITECH”). We process Protected Health Information (“PHI”) on behalf of Providers (who are Covered Entities) pursuant to Business Associate Agreements (“BAAs”).

BAA Supremacy. If there is any conflict between this Privacy Policy and an applicable Business Associate Agreement, the terms of the BAA shall control with respect to Protected Health Information.

Your Provider’s Notice Comes First. Most information about Patients on TrustRoom is PHI that we process for a Provider under a BAA. Your Provider is the Covered Entity responsible for that information and for giving you its own Notice of Privacy Practices, which explains your HIPAA rights. This policy describes how TrustRoom handles that information as your Provider’s Business Associate. It does not replace your Provider’s notice.

Our FERPA Role. For educational institution clients (university counseling centers, clinical training programs), TrustRoom may also process Education Records as defined by the Family Educational Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g. In such cases, TrustRoom operates as a designated School Official with a Legitimate Educational Interest, and processes student data pursuant to a Data Privacy Agreement (“DPA”). Where FERPA and HIPAA both apply to the same data, the more protective standard governs.

TrustRoom is NOT a healthcare provider. We do not provide medical advice, diagnoses, or treatment. The therapeutic relationship exists solely between the Provider and the Patient. TrustRoom is a technology platform that supports that relationship.

TrustRoom is NOT a crisis service. If you are experiencing a medical emergency, call 911. If you are in crisis, contact the 988 Suicide & Crisis Lifeline by calling or texting 988.

2. Information We Collect

2.1 Information Provided by Patients

• Account Information: Name, email address, date of birth, and, if you verify one, a mobile phone number. Account creation, identity verification, and sign-in codes sent by text message.
• Profile Photo: A photo you choose to upload. Visible only to you and your Provider.
• Messages & Communications: Text messages, voice recordings sent to your therapist. Facilitating the therapeutic relationship.
• Journals: Private journal entries you write in the patient application. Treatment continuity when you choose to share them with your Provider.
• Care Plan Responses: Answers to care plan exercises, schedule completions, and in-between-session care items. Treatment tracking and progress monitoring.
• Mood & Wellness Data: Mood logs, wellness scores, self-reported health data. Symptom tracking under therapist supervision.
• Clinical Assessment Responses: Responses to brief validated screening measures assigned by your Provider (PHQ-2, GAD-2, PCL-5, WHO-5, AUDIT, and ACE). Measurement-based care and outcome tracking.
• Connected Health Data: Sleep, activity, and heart-rate metrics, only if you connect Apple Health (iOS) or Health Connect (Android) and grant those permissions. Optional care-plan support.
• Audio & Video Recordings: Voice messages; session recordings (when integrated with your therapist’s video platform). Clinical documentation and transcription.
• Insurance Card Photos: Front and back photos of your insurance card, if you upload them on an intake form. Lets your Provider fill in your insurance details, check coverage and file claims.

2.2 Information Provided by Providers

• Professional Information: Name, email, NPI number, license type, credentials, practice name. Account creation, identity verification, regulatory compliance.
• Clinical Notes: Session notes, treatment observations, and related chart documents. Clinical documentation.
• Billing, Claims & Superbills: Payment method (processed by Stripe), subscription tier, insurance-card images the Provider uploads, eligibility checks, claims, and superbills. Platform billing and, when the Provider uses those tools, insurance workflows.
• OAuth Credentials: Authorized connections to Google, Zoom, and Microsoft video conferencing and calendar platforms. Scheduling, meeting creation, recording import, and transcription.

Psychotherapy Notes: A Provider may keep psychotherapy notes in TrustRoom. HIPAA (45 C.F.R. § 164.501) defines psychotherapy notes as notes recorded by a mental health professional documenting or analyzing the contents of conversation during a counseling session, kept separate from the rest of the patient’s record. They exclude medication prescription and monitoring, session start and stop times, the modalities and frequencies of treatment, results of clinical tests, and any summary of diagnosis, functional status, treatment plan, symptoms, prognosis or progress; those items belong in the regular chart. TrustRoom stores psychotherapy notes apart from the chart and shows them only to the clinician who wrote them. Practice administrators, supervisors, billing staff and patients cannot open them in the platform, and they are left out of chart views, record exports, claims, superbills, and the AI features that build summaries, briefings and patient memory. Ask TrustRoom reads them only when their author asks, and that conversation cannot then draft or send anything. Under 45 C.F.R. § 164.508(a)(2), most uses and disclosures of psychotherapy notes require the patient’s specific written authorization; the Provider is responsible for obtaining it before any such disclosure. A practice administrator may turn off new psychotherapy notes. When a practice’s agreement with TrustRoom ends, its psychotherapy notes are returned to the practice in a separate file with its other records, then destroyed.

2.3 Information Related to Minors

When a Provider adds a patient under 18, we collect date of birth and the client’s state so we can apply that state’s consent rule. If a parent must consent (including anyone under 13 under COPPA), we also collect:

• Parent/Guardian Contact: Parent/guardian email address. Sending consent requests.
• Verification Data: Hashed date of birth (one-way hash; we do not store the raw value). Identity verification for consent signing.
• Consent Records: Signed consent document, timestamp, IP address, document hash. Legal compliance and audit trail.

TrustRoom does not accept patients younger than 12, or the higher minimum age we apply in the patient’s state. For a patient under 13, we collect information only after a parent or guardian consents through the workflow above. The Provider is responsible for obtaining all other consents required by the Children’s Online Privacy Protection Act (“COPPA”) and applicable state law.

2.4 Information Collected Automatically

• Device Information: Device type, operating system, browser type. Platform compatibility and security.
• Usage Data: Features accessed, session duration, timestamps. Service improvement and troubleshooting.
• Push Notification Tokens: Device tokens for delivering notifications. Delivering PHI-free notification alerts.
• IP Address: Public IP at time of consent or account action. Non-repudiation and fraud prevention.

We do NOT collect GPS geolocation, biometric templates, or neural data. Patient location on a note is typed by the Provider for billing (for example, telehealth place of service). It is not GPS. If a Patient connects Apple Health or Health Connect, we receive only the health metrics they authorize.

Biometric Authentication Note. Our mobile application supports Face ID and Touch ID for convenient login. Biometric verification is performed entirely on your device using Apple’s Secure Enclave or the Android Keystore. We never receive, transmit, or store biometric templates.

3. How We Use Your Information

3.1 Treatment & Healthcare Operations

We use your information to:

• Facilitate secure, asynchronous communication between Patients and Providers
• Deliver and manage personalized care plans and in-between-session care
• Support measurement-based care with validated clinical instruments
• Generate session transcriptions and draft clinical notes from audio and video recordings
• Support Provider billing, superbills, eligibility checks, and insurance claims when the Provider uses those tools
• Process and deliver care plan reminders and notifications

3.2 AI-Powered Clinical Analytics

TrustRoom uses artificial intelligence to support Providers in delivering better care. Our AI features operate as follows:

AI Service Provider:

TrustRoom’s AI-powered clinical analytics are powered by Google Gemini, accessed through Google Cloud’s Vertex AI platform. Clinician voice dictation uses Deepgram. If Gemini cannot transcribe a session recording and this path is configured, Groq (Whisper) may transcribe that recording as a fallback. Gemini and Deepgram processing is performed within HIPAA-compliant infrastructure, governed by Business Associate Agreements. A Groq path is used only when configured, and only if a Business Associate Agreement covering that processing is in place. These vendors may process patient data only to provide their service to TrustRoom and may not use inputs or outputs to train their models.

What AI does:

• Analyzes patient messages to identify recurring clinical themes (e.g., anxiety, sleep, relationships) and overall sentiment patterns
• Generates transcriptions of audio, voice messages, and session recordings
• Supports live clinician dictation while a Provider writes or edits a note
• Produces clinical summaries and answers Provider questions about a patient’s chart (Ask TrustRoom)
• Creates semantic search capabilities so Providers can efficiently locate relevant information within a patient’s history
• Generates structured clinical notes (SOAP, DAP, and other formats) from therapy session recordings and transcripts
• Suggests in-between-session care items from a session for the Provider to review and send
• Extracts structured clinical facts from therapy sessions — including symptoms discussed, interventions used, and homework assigned — to ground future session briefings. These facts are unreviewed working context. They are not part of the clinical record. Raw transcript data is purged after the draft note is generated, unless the Provider has opted to keep the transcript

What AI does NOT do:

• AI does not generate diagnoses, prescriptions, or clinical recommendations
• AI does not communicate directly with Patients
• AI does not make treatment decisions — all clinical judgment rests with the Provider
• AI does not access more information than is necessary for its specific function

Safeguards:

• AI processing is performed within Google Cloud’s HIPAA-compliant Vertex AI infrastructure, protected by a Business Associate Agreement
• Google Cloud does not retain patient data after processing — inputs and outputs are not used to train Google’s foundation models or any third-party models
• AI-generated clinical notes are reviewed and approved by the Provider before becoming part of the clinical record. Only an approved note enters the record
• AI-extracted session facts (such as topics discussed and interventions used) are generated automatically and are not part of the clinical record. They are unreviewed working context used to ground future session briefings, are labeled as unverified AI output, and can be corrected or removed by the Provider at any time
• AI outputs are subject to safety guardrails that prevent generation of harmful, off-label, or clinically inappropriate content
• AI is designed to augment — not replace — the professional judgment of licensed clinicians

AI Is Part of the Service. AI processing is a core part of how TrustRoom works and cannot be turned off for an individual account. If you do not want your information processed by AI as described in this section, do not use TrustRoom, and talk with your Provider about other ways to communicate. You may still decline to have your sessions recorded: your Provider must have your consent before recording a session, and some states require that consent in writing.

3.3 De-Identified Data

We may use de-identified data — information from which all patient identifiers have been permanently removed following the HIPAA Safe Harbor standard (45 C.F.R. § 164.514(b)(2)) — for the following purposes:

• Improving the accuracy and quality of our services, including AI features
• Product development and platform improvement

De-identified data cannot reasonably be used to identify any individual. We implement technical and administrative safeguards to prevent re-identification and do not attempt to re-identify de-identified data. De-identified data is no longer Protected Health Information under HIPAA.

Audio recordings are excluded from all of the above. We do not retain session audio for AI training, transcription tuning, benchmarking, or any other secondary purpose. Session audio is transcribed and then permanently deleted from our systems automatically, with a storage lifecycle rule that purges any residual file within 7 days as a backstop. We do not create, derive, or store voiceprints or other biometric identifiers from session audio.

De-identified data used for the purposes above is derived from text and structured data only, never from voice. We do not use Student Data covered by a Data Privacy Agreement for these purposes.

3.4 Communication Preferences

We may send you transactional communications related to your account, including:

• Care plan reminders and notification alerts (PHI-free)
• Service updates and security notices
• Policy change notifications

You may manage your notification preferences — including opting out of non-essential email communications — at any time through your account settings or by contacting us. Certain communications required by law (e.g., breach notifications, policy updates) cannot be opted out of.

3.5 Administrative & Operational

• Processing payments and managing billing through our payment processor
• Responding to support requests
• Complying with legal obligations and regulatory requirements
• Maintaining audit trails as required by HIPAA

4. How We Share Your Information

4.1 With Your Therapist

Patient information — including messages, journals you share, care plan responses, mood data, connected health metrics, audio recordings, and AI-generated clinical insights — is shared with the Provider who manages your care. This sharing is necessary for treatment purposes under HIPAA.

4.2 With Service Providers

We engage carefully selected service providers to operate the TrustRoom platform. Each provider that may access PHI is bound by a Business Associate Agreement.

• Cloud Infrastructure (Google Cloud Platform): Computing, data storage, serverless functions, backups. BAA in place.
• AI Processing (Google’s Gemini model family via Vertex AI): Clinical theme analysis, session transcription, text embeddings, summarization, and chart Q&A. Covered under Google Cloud BAA; data not used to train models.
• Speech-to-Text (Deepgram): Live clinician dictation in the note editor. BAA in place; audio is streamed for transcription and is not retained by Deepgram for model training.
• Speech-to-Text fallback (Groq): Session recording transcription when Gemini transcription is unavailable and this path is configured. Used only with a Business Associate Agreement covering that processing.
• Authentication (Firebase Authentication): User authentication, role-based access controls. Covered under Google Cloud BAA.
• Email Delivery (Amazon SES, Postmark, Resend): Transactional emails (consent requests, password resets, notifications). No clinical content in emails. BAA or equivalent data-protection terms in place.
• Text Messaging (Amazon SNS): Sign-in and phone-verification codes. Messages contain only a one-time code, never health information.
• Payment Processing (Stripe): Provider subscription billing and, when used, patient session payments. BAA available; cardholder data not stored by TrustRoom.
• Claims Clearinghouse: When a Provider checks insurance eligibility or submits a claim, the minimum patient and claim data needed for that request is sent to the clearinghouse and payer. BAA required.
• Video Platform Integration: Meeting create/update/cancel, recording import, and scheduling sync (Provider-authorized). BAA required from Provider’s video platform.
• Calendar Integration: Appointment scheduling and sync, including creating or updating events when the Provider books through TrustRoom. Governed by Provider’s existing agreements.

4.3 Third-Party Platform Integrations

TrustRoom allows Providers to connect their accounts with third-party video conferencing and calendar platforms. These integrations are Provider-initiated and Provider-controlled. Each integration uses OAuth 2.0, an industry-standard authorization protocol, and requests only the minimum permissions necessary. Providers may disconnect any integration at any time through Settings > Integrations in the Provider Portal.

Google Workspace (Calendar & Meet)

When a Provider connects their Google account, TrustRoom requests access to the following Google data:

• Email address (scope: email) — to identify which Google account is connected
• Calendar events, read and write (scope: calendar.events) — to display upcoming sessions, to create, update, or cancel events when the Provider books through TrustRoom, and to create the Google Meet link for a session as a calendar event
• Calendars, read (scope: calendar.readonly) — to let the Provider choose which calendars TrustRoom uses
• Google Meet conference information, read (scope: meetings.space.readonly) — to look up the Meet TrustRoom created and to access meeting transcript entries for session summarization
• Google Meet settings (scope: meetings.space.settings) — to turn on automatic transcription for Meet links TrustRoom creates

How we use Google data: Calendar events are read to display a Provider’s upcoming sessions and to surface a patient card before each scheduled appointment. When the Provider schedules in TrustRoom, we may create or update the matching calendar event and its Meet link. Meet transcript entries are processed through our AI pipeline to generate clinical session summaries for Provider review. Google data is stored in encrypted Firestore collections, access-controlled per Provider, and is never shared with other Providers or third parties.

How to revoke access: Providers may disconnect their Google account at any time via Settings > Integrations > Google > Disconnect in the Provider Portal. Providers may also revoke access directly from their Google Account Permissions page.

Google API Services User Data Policy. TrustRoom’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We limit our use of Google user data to the purposes described in this privacy policy
• We do not transfer Google user data to third parties except as necessary to provide or improve our services, to comply with applicable laws, or as part of a merger or acquisition with adequate data protection
• We do not use Google user data for serving advertisements
• We do not allow humans to read Google user data unless we have the user’s affirmative consent, it is necessary for security purposes, to comply with applicable law, or the data is aggregated and de-identified for internal operations

Zoom

When a Provider connects their Zoom account, TrustRoom requests the following permissions:

• User profile and host join token (scopes: user:read:user, user:read:zak) — to identify the Zoom account and let the Provider join as host from TrustRoom
• Meetings, write/update/delete/read (scopes: meeting:write:meeting, meeting:update:meeting, meeting:delete:meeting, meeting:read:meeting) — to create, reschedule, cancel, and read Zoom meetings for sessions booked in TrustRoom
• Past meeting participants (scope: meeting:read:list_past_participants) — to match a recording to the correct client
• Cloud recordings, read and delete (scopes: cloud_recording:read:list_recording_files, cloud_recording:read:recording, cloud_recording:read:meeting_transcript, cloud_recording:delete:recording_file) — to import the recording or transcript, then delete the Zoom copy after secure download

How we use Zoom data: TrustRoom creates and manages Zoom meetings for sessions the Provider books in the platform. After the session, recordings and transcripts are downloaded and processed through our AI pipeline. We delete the Zoom cloud copy after a successful import. We keep the downloaded audio only until the note is drafted, and for at most two hours after the session ends so a dropped and rejoined call can be combined into one note; it is then deleted. The draft note is stored for Provider review. The raw transcript is purged unless the Provider has opted to keep it. Zoom data is stored in encrypted Firestore collections, access-controlled per Provider.

How to revoke access: Providers may disconnect their Zoom account via Settings > Integrations > Zoom > Disconnect in the Provider Portal. Providers may also revoke access from the Zoom App Marketplace installed apps page.

Microsoft 365 (Outlook Calendar & Teams)

When a Provider connects their Microsoft account, TrustRoom requests the following permissions:

• Offline access (scope: offline_access) — to maintain the connection without requiring re-authentication
• User profile (scope: User.Read) — to identify which Microsoft account is connected
• Calendar events, read and write (scope: Calendars.ReadWrite) — to display upcoming sessions and to create or update events when the Provider books through TrustRoom
• Online meetings, read and write (scope: OnlineMeetings.ReadWrite) — to read meeting metadata and create a Teams meeting for a TrustRoom session, set to record and transcribe automatically
• Meeting transcripts, read (scopes: OnlineMeetingTranscript.Read.All, CallTranscripts.Read.All) — to access Teams session transcripts, including calls started with Meet Now, for clinical documentation

How we use Microsoft data: Outlook Calendar events are read to display upcoming sessions and surface patient cards before scheduled appointments. When the Provider schedules in TrustRoom, we may create or update the matching Outlook event and Teams meeting. Teams transcripts are processed for clinical summarization, accessible only to the connected Provider. TrustRoom does not download Teams recordings. Microsoft data is stored in encrypted Firestore collections, access-controlled per Provider.

How to revoke access: Providers may disconnect their Microsoft account via Settings > Integrations > Microsoft > Disconnect in the Provider Portal. Providers may also revoke access from their Microsoft Account App Permissions page.

General Integration Principles

All third-party integrations share the following principles:

• Provider-controlled: Only the Provider initiates and authorizes video and calendar integrations. Patients may separately connect Apple Health or Health Connect if they choose.
• Least privilege, not read-only: We request the permissions needed to schedule, import recordings, and clean up PHI. That includes creating, updating, or canceling meetings and calendar events the Provider books in TrustRoom, and deleting a Zoom cloud recording after we have imported it. We do not write unrelated data to those platforms.
• Minimum necessary: We request only the specific permissions required for scheduling, session cards, recording import, and HIPAA cleanup.
• Encrypted storage: All tokens and data received from third-party platforms are encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Revocable at any time: Providers may disconnect any integration immediately through the Provider Portal, which deletes stored tokens and ceases all data access.
• No advertising or cross-platform tracking: Data from connected platforms is never used for advertising, marketing, or cross-platform user tracking.

Apple Health & Health Connect

Patients may optionally connect Apple Health (iOS) or Health Connect (Android) in the patient application. TrustRoom requests read-only access to sleep, activity, and heart-rate data the Patient authorizes. This data is shared with the treating Provider to support care plans. The Patient can disconnect at any time in their device health settings. We do not write data back to Apple Health or Health Connect.

4.4 Legal Disclosures

We may disclose your information when required by law, including:

• Pursuant to a valid court order, subpoena, or legal process
• To comply with government regulatory requirements
• To prevent serious harm or protect public safety
• As required by HIPAA, state health privacy laws, or other applicable regulations
• To report suspected child abuse or neglect, as required by law

4.5 What We NEVER Do

• We do not sell your personal information or PHI. We have not sold personal information in the preceding 12 months, and we will not sell it in the future.
• We do not share your information with advertising networks or ad technology companies.
• We do not use cookies, analytics, or tracking technologies to monitor patient activity within our clinical applications for marketing or advertising purposes.
• We do not use PHI for marketing without your express written authorization.
• We do not disclose your information to your employer. We do not send your information to an insurance company unless your Provider uses TrustRoom to check eligibility or submit a claim, you (or your Provider on your behalf) have authorized that use, or the law requires it.

5. Your HIPAA Rights

Your Provider is responsible for honoring your HIPAA rights, and your Provider’s Notice of Privacy Practices explains them. As your Provider’s Business Associate, TrustRoom helps your Provider respond. Under HIPAA, you generally have the following rights over the health information your Provider keeps on TrustRoom:

• Right to Access: You may inspect and get a copy of your health information, including in electronic format.
• Right to Amendment: You may ask your Provider to correct information you believe is inaccurate or incomplete.
• Right to Accounting of Disclosures: You may ask for a list of certain times we shared your health information in the six years before your request, using the TrustRoom app or by writing to us; we will respond within 60 days, and the first list in any 12-month period is free.
• Right to Request Restrictions: You may ask your Provider to limit certain uses or disclosures. Your Provider must agree not to share information with your health plan about care you paid for in full yourself; other requests may be declined.
• Right to Confidential Communications: You may ask to be contacted in a specific way or at a specific place.
• Right to Be Notified of a Breach: You have the right to be notified if your unsecured health information is breached. We notify your Provider as our BAA requires, and your Provider (or we, on your Provider’s behalf) notifies you.
• Right to Data Portability: You may request an export of your clinical records in portable format (PDF). Contact your Provider, who can generate exports via the platform.

To exercise these rights, contact your Provider. If you send a request to us instead (see Section 15), we will forward it to your Provider promptly and help them respond within the time HIPAA allows.

6. Substance Use Disorder Records (42 CFR Part 2)

If your Provider’s practice is a Part 2 program, or if substance use disorder (“SUD”) treatment records are shared with TrustRoom in the course of providing services, those records receive additional protections under 42 CFR Part 2, as amended by the 2024 final rule (compliance required by February 16, 2026).

Additional protections for SUD records include:

• SUD treatment records require your explicit written consent for use and disclosure, except in limited circumstances (medical emergencies, scientific research without identifying information, qualified audits or evaluations, or as authorized by a court order under Subpart E).
• SUD treatment records and testimony relaying their contents shall not be used in any civil, criminal, administrative, or legislative proceedings against you without your written consent or a qualifying court order.
• If SUD records are disclosed to TrustRoom as a Business Associate pursuant to your consent for treatment, payment, and healthcare operations, TrustRoom may further use such records consistent with HIPAA and this Notice.
• You may revoke your consent for SUD record disclosure at any time. Revocation will not affect disclosures already made in reliance on your prior consent.

For Providers: If your practice treats patients with substance use disorders, you may be required to update your own Notice of Privacy Practices to address 42 CFR Part 2 requirements. Contact us at support@trustroomconnect.com for guidance and sample language.

7. Data Retention & Disposal

We retain your information only as long as necessary to fulfill the purposes described in this policy or as required by law.

• Patient messages, care plans, clinical content: These are your Provider’s records. We keep them for your Provider while your Provider uses TrustRoom. Your Provider decides how long they are kept and is responsible for meeting their state’s medical-record laws (for minors, often counted from the age of majority).
• Session audio recordings: Deleted automatically once transcription and note generation complete; any residual file is purged within 7 days. Audio is never retained long-term.
• Raw session transcripts: Purged after the draft clinical note is generated, unless the Provider has opted to keep the transcript for that session or client.
• AI-extracted session facts: Kept as unreviewed working context until the Provider corrects or removes them, or the patient record is deleted under this policy.
• Audit logs (PHI access records): 6 years (HIPAA § 164.530(j)).
• Incident reports and risk assessments: 6 years (HIPAA).
• Business Associate Agreements: Relationship + 6 years (HIPAA).
• Subscription and billing records: 7 years (tax and accounting requirements).
• De-identified analytics: Indefinite (no legal restriction; not PHI).

Record Export

Providers may generate clinical record exports on behalf of their patients at any time through the platform. Exports are available in PDF format and include messages, clinical notes, care plans, journals, and mood data. Patients should request records from their Provider. If you contact us at support@trustroomconnect.com, we will route your request to your Provider.

Archival & Deletion

When a patient account is closed or offboarded:

1. A complete record export is generated and archived to secure, encrypted long-term storage
2. Active data is removed from production systems after archive confirmation
3. Archived records are kept for the retention period described above, then securely destroyed via cryptographic erasure

Requesting Deletion

You may request deletion of your data by contacting us. Please note that we may be unable to delete certain records that are required to be retained under HIPAA, state medical record laws, or other legal obligations. We will inform you of any such limitations when we process your request.

8. Data Security

We implement comprehensive technical, administrative, and physical safeguards to protect your information, including:

Technical Safeguards:

• Encryption at rest using AES-256 for all data stores
• Encryption in transit using TLS 1.2 or higher for all communications
• Role-based access controls ensuring Providers can only access data for their own patients
• Immutable audit logging of all PHI access events
• Automated session timeouts after periods of inactivity
• PHI-free push notifications — notification alerts never contain health information

Administrative Safeguards:

• Formal information security policies and procedures (POL-001 through POL-009)
• Workforce security training requirements
• Incident response plan with defined escalation procedures
• Regular risk assessments and vulnerability management

Infrastructure:

• All data is processed and stored within the United States
• Cloud infrastructure hosted by providers who maintain SOC 2 Type II, HITRUST, and ISO 27001 certifications
• All infrastructure providers are bound by Business Associate Agreements
• No external analytics, error tracking, or monitoring tools that operate outside of BAA-covered infrastructure

For more information about our security practices, visit our Security page.

Regulatory Updates. We actively monitor changes to healthcare privacy and security regulations, including anticipated updates to the HIPAA Security Rule. We are committed to implementing any new requirements within the timelines established by the U.S. Department of Health and Human Services.

9. Children’s Privacy

Patients Under 18

TrustRoom supports the treatment of minors under the supervision of a licensed Provider when the following conditions are met:

1. The Provider initiates the minor’s account and determines that TrustRoom is clinically appropriate
2. When state or federal law still requires it, a parent or legal guardian provides informed consent through our secure consent workflow, which includes:
   • Identity verification via date-of-birth confirmation
   • Review and electronic signature of a consent document covering telehealth services, privacy practices, and platform usage
   • All consent events are recorded with server-side timestamps, IP addresses, and document hashes for legal non-repudiation

Parental access to a minor’s therapy communications may be limited to protect the therapeutic relationship, in accordance with applicable state and federal laws governing minor mental health treatment.

Children Under 13

TrustRoom does not accept patients younger than 12. We collect information about a patient under 13 only after a parent or guardian consents through the workflow above. If we learn that we collected information from a child under 13 without that consent, we will promptly delete it.

10. Cookies & Tracking Technologies

Clinical Applications (Provider Portal & Patient App)

Our clinical applications use essential cookies only — cookies that are strictly necessary for authentication, security, and platform functionality. We do not use:

• Advertising or marketing cookies
• Analytics or behavioral tracking cookies
• Third-party tracking pixels or beacons
• Cross-site tracking technologies

Marketing Website (trustroomconnect.com)

Our marketing website uses essential cookies for basic site functionality. We use Vercel Analytics and Vercel Speed Insights for anonymous page-view and performance metrics. These tools do not identify you, do not track you across other sites, and are not used for advertising. We do not use advertising pixels or social media tracking on our marketing website.

Global Privacy Control

We respect browser-based privacy signals, including the Global Privacy Control (“GPC”). When we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information.

Third-Party Links

Our platform and website may contain links to third-party websites or services (e.g., crisis hotlines, regulatory complaint portals). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), and the Confidentiality of Medical Information Act (“CMIA”).

HIPAA Exemption

Under CCPA § 1798.145(c)(1), medical information that is collected and maintained in accordance with HIPAA is exempt from most CCPA obligations. This means that Protected Health Information processed by TrustRoom under a Business Associate Agreement — including patient messages, journals, clinical notes, care plan data, mood logs, connected health metrics, claims data, and audio recordings — is governed by HIPAA, not the CCPA. The CCPA rights below apply primarily to non-clinical personal information such as account profile data, usage data, and marketing website interactions.

Your CCPA/CPRA Rights

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to HIPAA retention requirements and other legal obligations.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: You may request that we limit the use or disclosure of your Sensitive Personal Information (as defined by the CPRA) to purposes necessary to provide services.
• Right to Data Portability: You may request your personal information in a portable and readily usable format that can be transmitted to another entity.
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No action is required on your part.
• Right of Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Sensitive Personal Information

Under the CPRA, health-related data collected by TrustRoom constitutes Sensitive Personal Information (“SPI”). We use SPI only as necessary to provide our services as described in this policy. You may request that we limit our use of SPI by contacting us using the information in Section 15.

Automated Decision-Making Technology

TrustRoom uses automated processing (AI) to transcribe sessions, draft notes, extract working-context facts, analyze themes, and support Provider chart questions. This processing is subject to the following:

• You may request information about the logic involved in the automated processing
• AI processing is part of the service and cannot be turned off for an individual account (see Section 3.2). You may decline to have your sessions recorded.
• Automated processing does not produce decisions with legal or similarly significant effects on you — all clinical decisions are made by your Provider

California Confidentiality of Medical Information Act (CMIA)

Under California Civil Code § 56 et seq., a business that offers mental health digital services may be treated as a provider of health care solely for purposes of the CMIA. TrustRoom follows the CMIA on that basis. This does not make TrustRoom your healthcare provider. We comply with CMIA requirements, including:

• We will not use or disclose your medical information without your authorization, except as expressly permitted by law
• We will not use manipulative or deceptive user interfaces (“dark patterns”) to obtain consent
• We maintain safeguards that meet or exceed CMIA requirements for the confidentiality of medical information
• We give Providers information on how to find data breaches reported to the California Attorney General, at oag.ca.gov/privacy/databreach/list

Exercising Your California Rights

To submit a verifiable consumer request, contact us at support@trustroomconnect.com or at the mailing address in Section 15. We will verify your identity before processing your request and will respond within 45 days, with the option to extend by an additional 45 days if reasonably necessary.

You may use an authorized agent to submit a request. We may ask the agent for your signed permission and ask you to verify your identity directly with us. We have not sold or shared personal information in the preceding 12 months.

Categories of Personal Information (Preceding 12 Months)

Outside of PHI covered by HIPAA, we have collected these categories of personal information in the preceding 12 months:

• Identifiers: name, email address, mobile phone number, IP address, and device and push-notification identifiers
• Customer records (Cal. Civ. Code § 1798.80(e)): name, phone number, and professional license information
• Protected classifications: age and date of birth
• Commercial information: subscription plan and billing history (Providers)
• Internet or network activity: app usage data and anonymous marketing-site analytics
• Professional information: license type, credentials, NPI, and practice name (Providers)
• Sensitive personal information: account login credentials and health information

We collect this information from you, from your Provider, and from services you or your Provider connect. We disclose it only to the service providers listed in Section 4.2, for the business purposes described in this policy.

12. New York Privacy Rights

If you are a New York resident, you have additional protections under the New York Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”).

Data Covered

The SHIELD Act protects “private information,” which includes medical information (any information concerning your medical history, mental or physical condition, or treatment by a healthcare professional) and health insurance information. All patient data maintained by TrustRoom for New York residents falls within these protections.

Security Standards

TrustRoom’s HIPAA-compliant security program satisfies the SHIELD Act’s requirement for “reasonable safeguards,” including administrative, technical, and physical protections for private information.

Breach Notification

In the event of a data breach affecting your private information, we will notify you within 30 days of discovering the breach, as required by the SHIELD Act (as amended December 2024). We will also notify the New York State Attorney General, the Department of State, the Division of State Police, and the Department of Financial Services, as required by law.

13. Additional State Privacy Laws

TrustRoom monitors and complies with applicable state privacy laws as they take effect. The following laws may apply to you based on your state of residence:

• Washington: My Health My Data Act (MHMDA) — Health information we process as PHI under HIPAA is exempt. We do not sell consumer health data, and we collect or share any other consumer health data only as needed to provide a service you request, or with your consent.
• Texas: Texas Responsible AI Governance Act (TRAIGA) — Healthcare providers must clearly disclose their use of AI to patients no later than when care is first provided. The patient app discloses AI use at sign-up, and Providers remain responsible for their own disclosure.
• Illinois: Wellness and Oversight for Psychological Resources Act (HB 1806) — AI may support licensed professionals with administrative and supplementary tasks but may not make independent therapeutic decisions or deliver therapy. A patient must give written informed consent before AI is used to record or transcribe a session. AI on TrustRoom does not make treatment decisions, and Providers must obtain that consent before recording.
• Colorado: Colorado Privacy Act (CPA) — Rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, sale, and certain profiling. We do not sell personal data or use it for targeted advertising. AI use is described in Section 3.2.
• Virginia: Consumer Data Protection Act (VCDPA) — Right to access, correct, delete; opt-out of targeted advertising. We do not engage in targeted advertising.
• Connecticut: CT Data Privacy Act (CTDPA) — Similar to VCDPA; proposed AI safeguards for mental health. Compliance through existing privacy practices.
• Oregon: Oregon Consumer Privacy Act (OCPA) — Right to know, delete, correct; right to data portability. Record export available upon request.

If you reside in a state with specific privacy legislation and wish to exercise your rights, please contact us using the information in Section 15. We will process your request in accordance with applicable law.

Right to Appeal. If we decline your request, you may appeal by emailing support@trustroomconnect.com with “Appeal” in the subject line. We will respond within the time your state’s law requires. If we deny your appeal, you may contact your state’s Attorney General.

13A. Student Data & FERPA Compliance

This section applies to educational institution clients, including university counseling centers and clinical training programs, that use TrustRoom to deliver behavioral health services to students.

Applicability

When TrustRoom processes student records on behalf of an educational institution, TrustRoom is designated as a School Official with a Legitimate Educational Interest under FERPA (34 CFR § 99.31(a)(1)). The terms of the applicable Data Privacy Agreement (“DPA”) between TrustRoom and the Institution govern the processing of Education Records and Student Data.

Prohibited Uses of Student Data

TrustRoom will never:

• Use Student Data for advertising, marketing, or commercial purposes
• Build behavioral profiles of students for non-educational purposes
• Sell, rent, or trade Student Data to any third party
• Use Student Data to train, retrain, or fine-tune AI foundation models
• Disclose Student Data to any third party except as authorized by the DPA or required by law

Data Return & Destruction

Upon termination of the agreement with an educational institution:

1. TrustRoom will provide the Institution with a complete export of all Student Data within thirty (30) days of the termination effective date
2. All Student Data will be securely destroyed within ninety (90) days of the termination effective date
3. TrustRoom will provide written certification of data destruction in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization)

State Student Privacy Laws

In addition to FERPA, TrustRoom complies with applicable state student privacy laws, including:

• SOPIPA (Student Online Personal Information Protection Act) — California
• SOPPA (Student Online Personal Protection Act) — Illinois
• NY Education Law § 2-d — New York’s student data privacy requirements

Data Privacy Agreement

For the full terms governing TrustRoom’s processing of Student Data, including specific obligations under FERPA and applicable state laws, see our Data Privacy Agreement.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes:

1. Email Notification: We will email registered users about material changes at least 30 days before they take effect.
2. In-App Acceptance: Providers must accept updated terms at their next sign-in before continuing to use the platform. Patients are notified by email.
3. Website Update: The “Last Updated” date at the top of this page will reflect the most recent revision.
4. Acceptance Records: Each version is numbered. We keep a record of each acceptance, including the date and time and, where available, the version accepted and IP address.

We encourage you to review this policy periodically. Your continued use of TrustRoom after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree to the changes, you should discontinue use and contact us to request deletion of your information.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise any of your rights, or have concerns about how your information is handled:

Filing a Complaint

If you believe your privacy rights have been violated, you may:

1. Contact us directly at the addresses above
2. File a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:
   Online: hhs.gov/hipaa/filing-a-complaint
   Phone: 1-800-368-1019
3. File a complaint with the California Attorney General (for California residents):
   Online: oag.ca.gov
4. File a complaint with the New York State Attorney General (for New York residents):
   Online: ag.ny.gov

We will not retaliate against you for filing a complaint.

16. Definitions

• Business Associate (BA): An entity that creates, receives, maintains, or transmits PHI on behalf of a Covered Entity.
• Covered Entity: A health care provider, health plan, or health care clearinghouse subject to HIPAA.
• Protected Health Information (PHI): Individually identifiable health information transmitted or maintained in any form.
• Sensitive Personal Information (SPI): As defined by the CPRA: personal information revealing health data, precise geolocation, racial or ethnic origin, or other categories specified in Cal. Civ. Code § 1798.140(ae).
• De-Identified Data: Health information that has been stripped of all 18 HIPAA identifiers per the Safe Harbor method (45 C.F.R. § 164.514(b)(2)) and for which the entity has no actual knowledge it could identify an individual.
• Automated Decision-Making Technology (ADMT): Technology that processes personal information using computation to make or substantially facilitate a decision.