1. Introduction

This Privacy Policy describes how Visualize Change LLC d/b/a Visualize Change Digital ("Company," "we," "us," or "our") collects, uses, discloses, and protects information when you use the myKokoro EHR platform, including our web application, client portal, and related services (collectively, the "Service"). myKokoro EHR is a cloud-based electronic health record system designed for mental health and substance use disorder treatment providers.

We are committed to protecting the privacy and security of information processed through our Service. Because our Service is used by healthcare providers that may be covered entities under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), we maintain administrative, physical, and technical safeguards designed to protect information and support our obligations under applicable law, including HIPAA, the HITECH Act, 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records), and applicable state privacy laws. The safeguards appropriate for a particular practice also depend on that practice's services, jurisdiction, policies, workforce, and configuration of the Service.

2. Definitions

Protected Health Information (PHI)

Individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or its business associate, as defined under HIPAA.

Covered Entity

A healthcare provider, health plan, or healthcare clearinghouse that transmits health information electronically, as defined under HIPAA.

Business Associate

A person or entity that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involves the use or disclosure of PHI.

Client or Patient

An individual receiving healthcare services from a provider who uses our Service.

Provider or Practice

A healthcare professional or organization that subscribes to and uses the Service.

User

Any individual who accesses the Service, including providers, practice staff, and clients accessing the client portal.

3. Our Role Under HIPAA

Visualize Change LLC d/b/a Visualize Change Digital operates as a Business Associate to healthcare providers and organizations that are Covered Entities and use our Service. Before a provider enters, uploads, imports, or otherwise transmits PHI through the Service, the provider must execute or electronically accept our Business Associate Agreement ("BAA"). AWS, our primary cloud-infrastructure provider, participates in AWS's HIPAA-eligible services and BAA program for the applicable services we use.

We do not use or disclose PHI except as permitted or required by our BAA, HIPAA, or applicable law. We do not sell PHI or use PHI for marketing purposes. We use PHI only as necessary to provide, secure, support, and maintain the Service and as otherwise permitted by the applicable BAA or law. We may use properly de-identified or aggregated information to improve the Service; we do not use identifiable PHI to train generalized artificial-intelligence or machine-learning models.

4. Information We Collect

4.1 Information Provided by Healthcare Providers

Practice information, including practice name, address, phone number, NPI number, tax identification number, and logo.
Staff information, including names, credentials, email addresses, role assignments, and professional license numbers.
Patient/client records entered by the provider, including legal names, dates of birth, contact information, insurance information, diagnoses, treatment plans, clinical notes, assessment results, medications, and other PHI as documented during the course of treatment.
Billing and claims data, including CPT codes, diagnosis codes, insurance claim submissions, and payment records.

4.2 Information Collected from Client Portal Users

Account credentials, including the email address associated with the client's record and a hashed password. We never store passwords in plain text.
Session data, including session tokens, IP addresses, and timestamps for authentication and security auditing purposes.
Any information the client submits through portal forms, such as intake questionnaires, consent forms, or other documents assigned by their provider.

4.3 Information Collected Automatically

When you access the Service, we may collect certain technical information for security, reliability, and support purposes:

Log data, including IP addresses, browser type, operating system, referring URLs, pages accessed, and timestamps.
Device information, including device type, screen resolution, and language preferences.
We do not use cookies for advertising or tracking purposes. Session cookies are used solely for authentication and security.

4.4 Google Calendar Integration & Data Minimization

OAuth & HIPAA Compliance

If a provider enables optional integrations, we may process additional data. If a provider connects their Google Calendar, we access calendar event data solely to synchronize appointments. We request only the minimum necessary scopes. During the Google Calendar connection process, we access the user's primary Google Account email address to identify and authenticate the connection, and basic Google profile information to verify the user's identity. This information is used solely to establish and maintain the calendar connection and is not used for any other purpose. We do not access other Google account data.

What is Synced to GoogleAllowed

Appointment Type (e.g., "Individual Session")
Appointment Date & Time

Data Not Included in Calendar EventsBlocked

No Client Names or Identifiers (initials, phone, email)
No Diagnoses or Clinical Codes (ICD-10, DSM-5)
No Clinical Notes, Treatment Plans, or Session Content
No Billing, Financial, or Insurance Claim Data

Clinical and identifying client data is not included in the Google Calendar event data described above. The integration is intended to minimize the information used for scheduling and does not use calendar data for advertising or generalized AI/ML training.

How to Revoke Google Calendar Access

Users may revoke Google Calendar access at any time through the Google Calendar settings page within the Service or through their Google Account permissions at myaccount.google.com/permissions. Upon disconnection, we will immediately stop syncing appointments, and any temporary sync tokens will be securely deleted.

4.5 Google API Services Compliance

Limited Use Policy

myKokoro EHR's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Calendar data accessed through the Google Calendar API is used solely to provide the appointment-synchronization feature described in Section 4.4. The integration is configured to minimize the calendar data used for that feature and is not used for advertising or generalized AI/ML training.

Specifically, Google user data obtained through the Google Calendar API is not:

Used or transferred for serving advertisements, including retargeted, personalized, or interest-based advertising;
Used or transferred to determine creditworthiness or for lending purposes;
Sold or transferred to data brokers, information resellers, or any third party other than as necessary to provide the appointment synchronization feature;
Used to develop, improve, or train generalized artificial intelligence or machine learning models; or
Transferred to any third-party service that uses the data to train AI/ML models.

Google Calendar data is not read by humans except: (a) with the user's affirmative consent, (b) as necessary for security purposes such as investigating abuse, or (c) to comply with applicable law.

5. How We Use Information

We use the information we collect for the following purposes:

To provide, operate, and maintain the Service, including electronic health records, scheduling, billing, clinical documentation, and the client portal.
To authenticate users and maintain the security of accounts and sessions.
To process insurance claims and facilitate billing on behalf of providers (submitting insurance claims through our integrated clearinghouse partner, Stedi, in accordance with HIPAA).
To generate reports and analytics requested by the provider about their own practice data.
To send transactional communications, including appointment reminders, portal activation links, password reset emails, and secure message notifications.
To comply with legal obligations, including HIPAA, state licensing requirements, and court orders.
To detect, prevent, and respond to security incidents, fraud, or technical issues.
To improve and develop the Service, using de-identified or aggregated data only. We never use identifiable PHI for product development.

6. How We Share Information

We do not sell, rent, or trade any personal information or PHI. We share information only in the following circumstances:

6.1 With Service Providers

We use third-party service providers who assist us in operating the Service. These providers are bound by contractual obligations to protect the confidentiality and security of the data they process:

Amazon Web Services (AWS): Cloud infrastructure, including compute (Lambda), database (RDS), storage (S3), email (SES), and content delivery (CloudFront). AWS has executed a BAA with us.
Stedi: Electronic claims clearinghouse used for insurance-billing functions. Where Stedi processes PHI on our behalf, we use appropriate contractual and privacy arrangements and disclose only the information necessary for the applicable claims function.
Replit: Development environment used for building and deploying the Service. Replit does not have access to production PHI.
Google Calendar: If enabled by a user, Google Calendar is connected through OAuth for appointment synchronization. The integration is configured to minimize calendar data used for scheduling and is subject to the Google API Services User Data Policy and the current integration configuration described in Section 4.4.

6.2 As Required by Law

We may disclose information only when required or permitted by applicable law and our contractual obligations, including in response to a valid court order, subpoena, or regulatory investigation. We evaluate legal requests as appropriate and, where permitted by law and consistent with the applicable BAA, will notify the affected provider before a disclosure. Additional restrictions may apply to substance use disorder records under 42 CFR Part 2.

6.3 With the Provider's Authorization

We may share data at the direction of the healthcare provider, such as when transmitting referral information or generating reports for external entities as requested by the provider.

6.4 In a Business Transfer

If Visualize Change LLC d/b/a Visualize Change Digital is involved in a merger, acquisition, or sale of assets, information may be transferred as permitted by applicable law, the applicable BAA, and the transaction documentation. We will provide notice of a material change in ownership or control of information where required by law or contract.

7. Data Security

We maintain administrative, physical, and technical safeguards designed to protect information processed through our Service. Examples include:

Encryption in transit: All data transmitted between users and our Service is encrypted using TLS 1.2 or higher.
Encryption at rest: All data stored in our databases (Amazon RDS) and file storage (Amazon S3) is encrypted using AES-256 encryption.
Access controls: The Service uses a multi-tenant architecture with row-level security (RLS) and role-based permissions designed to logically isolate each practice's data and limit staff access according to assigned permissions.
Authentication: Passwords are hashed using cryptographic hash functions with unique salts. Session tokens are generated using cryptographically secure random number generators. Staff sessions expire after periods of inactivity.
Audit logging: The Service records specified access, security, disclosure, and modification events, including relevant actor, action, timestamp, and technical context, to support accountability, investigation, and operational review.
Infrastructure security: Our AWS infrastructure operates within a Virtual Private Cloud (VPC) with security groups, and database access is restricted to the application layer through RDS Proxy.
Business Associate Agreement: We use AWS services eligible for AWS's HIPAA program and maintain the contractual arrangements appropriate to the services used.

8. Data Retention

Active accounts: Data is retained for as long as the provider's subscription is active.
After termination: Following termination, providers may request an export of their data during the applicable export period. Deletion or return of PHI is governed by the applicable BAA, our documented retention schedule, legal holds, and applicable law. Data removed from active production systems may remain in encrypted backups until those backups expire under the backup-retention schedule.
Audit logs: We retain audit and security records for at least six (6) years under our documented retention schedule to support accountability, investigation, and contractual or legal obligations. Different categories of data may have different retention requirements.
Backups: Encrypted backups are retained for disaster recovery purposes and are destroyed in accordance with our data retention schedule.

9. Your Rights

9.1 Rights of Healthcare Providers: As our customers, providers have the right to access, export, and request deletion of their practice data, subject to applicable legal retention requirements.

9.2 Rights of Clients/Patients: Under HIPAA, clients may have rights regarding their PHI. Because we are generally a Business Associate, those rights are ordinarily exercised through the client's healthcare provider or other Covered Entity. Clients should contact their provider to request access, request an amendment, request a restriction or confidential communication, or request an accounting of disclosures to the extent applicable. The client portal may provide direct access to certain documents, forms, and appointment information as made available by the provider.

9.3 State-Specific Rights: Residents of certain states may have additional privacy rights under state law. We comply with all applicable state privacy laws, including but not limited to the Pennsylvania Breach of Personal Information Notification Act and the California Consumer Privacy Act (CCPA), where applicable.

10. Substance Use Disorder Records

Records relating to substance use disorder treatment may be subject to additional federal protections under 42 CFR Part 2 ("Part 2"). Whether Part 2 applies depends on the provider, program, record, and disclosure at issue. The Service includes warnings and audit-trail attestations related to disclosures; it does not manage Part 2 consent documents. The provider remains responsible for determining when Part 2 applies and for using the Service in accordance with applicable law:

Part 2 may impose additional consent, disclosure, patient-notice, and legal-proceeding restrictions beyond general HIPAA requirements.
Providers must verify the applicable scope, recipient, purpose, expiration, and revocation status of a consent or other legal basis before disclosing a record.
Providers are responsible for obtaining and maintaining appropriate consents and authorizations and for determining any additional protection required for separately maintained SUD counseling notes or other specially protected information.

11. Children's Privacy

The Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. Our Service does process records of minor patients (under 18) as entered by their healthcare providers in the course of treatment. Such records are treated as PHI and receive the same protections described in this policy, with additional safeguards for minor consent as required by state law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on our website and update the "Effective Date" at the top of this policy. For material changes, we will provide notice to active subscribers via email or in-application notification at least thirty (30) days before the changes take effect.

13. Contact Us

If you have questions or concerns about this Privacy Policy, our privacy practices, or wish to exercise your rights, please contact us at:

Visualize Change LLC d/b/a Visualize Change DigitalEmail: support@mykokoroehr.comWebsite: https://mykokoroehr.com

If you believe your privacy rights have been violated, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints.