Privacy Policy

This Privacy Policy explains what Intelligena LLC, a California limited liability company does with personal information in connection with Practiceful. It applies to the Service and not to any third-party site or service reached through it.

1. Who is responsible

Intelligena LLC, a California limited liability company is the controller (and, under California law, the “business”) for personal information processed through the Service, except where an organisation — your employer, school, practice or another Practiceful customer — uses the Service to process information about you. In that case that organisation is the controller and we act as its service provider / processor on its instructions, and you should direct your request to them; we will refer you to them and assist them in responding.

2. What we collect, where it comes from, and why

Where consent is the lawful basis (for example non-essential cookies, or marketing email), you may withdraw it at any time. Otherwise we rely on the performance of our contract with you, our legitimate interests in operating and securing the Service, or compliance with a legal obligation.

3. The other documents this one sits beside

This Policy describes what we do with personal information. What you and Intelligena owe each other is in the Terms of Service, which govern your use of the Service and to which this Policy is incorporated. Where your use involves Protected Health Information, the Business Associate Agreement governs it and controls over this Policy in respect of that information.

These cross-references are load-bearing rather than courteous: a privacy policy that cannot reach the agreement it defers to on the handling of client or patient data is not usable for the purpose it exists for.

4. Cookies and similar technologies

See the Cookie Policy. We do not use advertising cookies or third-party trackers for advertising purposes.

5. Who we disclose personal information to

• Subprocessors and service providers — hosting, storage, email and SMS delivery, payment processing, error monitoring and AI model providers, each under contract restricting them to processing on our instructions. The current list is at Subprocessors.
• Your organisation, where you use the Service through an account it administers — it can see the content and activity within its own workspace.
• Legal and safety — where we believe in good faith that disclosure is required by law, subpoena or court order, or is necessary to investigate a breach of our terms, to protect the rights, property or safety of any person, or to prevent fraud.
• A successor, in connection with a merger, acquisition, reorganisation, financing or sale of assets, subject to this Policy continuing to apply.

6. Automated processing and AI

Some features process your content using machine-learning models, some of which are operated by us and some by third-party providers listed in our Subprocessors page. Your content is not used to train third-party foundation models, and our contracts with model providers prohibit it. We may use aggregated or de-identified data — data that does not identify you or any individual and that we do not attempt to re-identify — to evaluate and improve our own systems.

We do not make decisions producing legal or similarly significant effects about you by automated means alone. Where a feature marks, scores, flags or classifies work, the result is a recommendation to a human being, who decides.

7. How long we keep it

• Account and content: for as long as your account is open, and then for up to 90 days after closure to allow recovery.
• Billing and tax records: seven years, as accounting and tax law requires.
• Security, audit and access logs: up to 24 months.
• Backups: deleted data persists in routine encrypted backups for up to 35 days before being overwritten.
• Records of consent and of legal notices: for as long as needed to establish or defend a legal claim.

Where a customer organisation controls the data, its own retention instruction applies and may be shorter or longer than the above.

8. Security

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the information, including encryption in transit and at rest, access control on a least-privilege basis, and audit logging. No method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. You are responsible for the strength and confidentiality of your own credentials.

9. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you, and how we use and disclose it;
• receive a copy of it, in a portable format;
• correct inaccurate information;
• delete it, subject to exceptions the law allows;
• limit the use and disclosure of sensitive personal information;
• opt out of sale or sharing — we do neither, so there is nothing to opt out of; and
• not be discriminated or retaliated against for exercising any of these rights.

To exercise a right, write to privacy@intelligena.com. We will verify your identity against the information already on your account before acting, and will respond within 45 days, extending once by a further 45 days where necessary and telling you if we do. An authorised agent may act for you with written proof of authority. If we decline a request we will tell you why, and you may appeal by replying to our response; we will answer an appeal within 45 days.

10. Children

The Service is not directed to children under 13 and we do not knowingly collect their personal information. Learners under 18 reach the Service only through a school, teacher, parent or guardian who has warranted that they hold the consents the law requires. Where an educational institution uses the Service, we process student records only under that institution’s direction, as a “school official” with a legitimate educational interest under FERPA, and we do not use student data for advertising or build a profile for any purpose other than providing the Service. If you believe a child under 13 has given us information, write to privacy@intelligena.com and we will delete it.

11. Where data is processed

We are based in the United States of America and process data there. If you use the Service from elsewhere, you understand your information is transferred to and processed in the United States, where data-protection law may differ from that of your own country. Where a transfer requires a safeguard, we use the appropriate one, including the European Commission’s standard contractual clauses.

12. Changes to this Policy

We review this Policy at least every twelve months and update it when our practices change. The version and effective date are shown at the top of this page. Where a change is material we will give notice by email or in the Service before it takes effect.

13. Contact and complaints

Privacy questions and requests go to privacy@intelligena.com. If you are not satisfied with our response you may complain to your data-protection authority or, in California, to the California Privacy Protection Agency or the Attorney General.