Privacy Policy for BIP Visualized Inc.

This Privacy Policy explains how BIP Visualized Inc. ("BIP Visualized," "we," "us," or "our") collects, uses, shares and protects information when you use our services ("Services"), including:

• Our public website at https://www.bipvisualized.com (the "Website")
• Our application at https://app.bipvisualized.com (the "Application")
• Our courses, trainings, support, sales and marketing activities

If you do not agree with this policy, please do not use our Services. Questions? Email support@bipvisualized.com.

Summary of key points

• What we collect. Account details (such as name, email and, if you choose, a phone number), the content you create in the Application, payment details handled by our payment processor, and technical information about how you use the Services.
• Sensitive information. We treat all information in the Application as sensitive. This includes account information (such as names and email addresses) and all content you create, such as BIPs, behavioral information, accessibility needs and uploaded media.
• Student and client information. We do not ask for student or client names or other identifying details, and we recommend initials or codes. If you enter them, we store them encrypted and protect them as sensitive health information.
• No sale, no ads from app data. We do not sell personal information. Nothing you do inside your account is used for advertising.
• No AI training. We do not use your content to train AI models.
• Your rights. You can access, correct or delete your information by contacting us.

Table of contents

1. Information we collect
2. How we use information
3. Information about students and clients
4. AI features
5. When we share information
6. Service providers
7. Cookies and similar technologies
8. Social logins
9. Security and HIPAA safeguards
10. International processing
11. How long we keep information
12. Minors
13. Your privacy rights
14. Do Not Track
15. Changes to this policy
16. Contact us

1. Information we collect

Information you give us

• Account information: name, email address, password, role, organization and team.
• Phone number (optional): if you add one, we use it only to send login codes and account security messages.
• Content: BIPs, behavior overviews, strategies you customize, uploaded images and files, course progress, certificates, and messages you send to support.
• Purchase information: billing name, billing address, plan and invoice details. Card and bank details are collected and stored by our payment processor, Stripe. We do not store full card numbers.
• Communications: emails, support chats, survey answers, feedback, and information you share when you book or attend a call with us. Sales and customer calls may be recorded and transcribed with notice to participants, to keep accurate records of what was discussed.

Information collected automatically

• Device and usage information, such as IP address, browser type, operating system, language, referring pages, pages viewed and features used.
• Login and security events, such as sign-in times, new device checks and login codes sent.
• Cookies and similar technologies, described in Section 7 and in our Cookie Policy.

Information from other sources

• If you sign in with Google, we receive basic profile information from Google (see Section 8).
• If your organization buys a team account, your administrator may give us your name and email to invite you.
• We may receive business contact information from public sources and marketing partners.

2. How we use information

We use information to:

• Create and manage accounts, teams and seats
• Provide the Services, including creating, saving and sharing BIPs, courses and resources
• Secure accounts, including email-based two-factor authentication (2FA) and, if you choose, text-message login codes
• Process payments, send invoices and receipts, and manage subscriptions
• Provide support and respond to requests
• Issue course completion records and continuing education certificates
• Understand how the Services are used so we can fix problems and improve them
• Send service messages, such as login codes, invitations, receipts and important account notices
• Send marketing emails about our products and resources (you can unsubscribe at any time using the link in the email; service messages are not affected)
• Measure our advertising on our public pages
• Prevent fraud and abuse, enforce our Terms and comply with law

3. Information about students and clients

Our Services are used by professionals (such as BCBAs, school psychologists and teachers) to create behavior plans for the students and clients they support. Students and clients do not create accounts or log in.

• We do not ask for identifying details. We do not ask for student or client names or other identifying details, and we recommend using initials or client codes.
• If you enter them, we protect them. Any such information is stored encrypted and protected as sensitive health information.
• The minors rule does not apply to this information. Section 12 (Minors) covers people who create accounts. It does not apply to student or client information entered by an adult user, and we will not delete that information under Section 12.
• Your organization decides. For team and enterprise accounts, student and client information is kept or deleted as the customer organization instructs.
• Schools. When we provide the Services to a school or district, we act on the school's behalf and use student information only to provide the Services to that school. We do not sell it or use it for advertising, and we do not build profiles of students. We are happy to sign a school's or district's data privacy agreement on request.

4. AI features

The Application includes optional AI-assisted features, such as AI image generation for visual BIPs, an AI guide that helps you find resources and strategies, and tools that help draft or reword plan content.

• You choose. AI features run only when you choose to use them. The rest of the Services work fully without them.
• Personal details. As you type in AI features, the Application highlights likely names and other personal details and warns you before you submit. Please do not enter identifying student or client information into AI features.
• Protected providers. AI processing is performed by AI service providers under agreements that protect your data, including Business Associate Agreements where health information may be involved.
• No training. We do not use your content, student or client information, uploaded media or usage activity to train or improve AI models, and our AI providers are contractually prohibited from doing so.
• Check the output. AI output can be wrong or incomplete. You are responsible for reviewing anything AI produces before you use or share it.

5. When we share information

We share information only as described here:

• Service providers that help us run the Services (see Section 6). They may use information only to provide services to us.
• People you share with. When you share a BIP, course or resource, the people you share it with can see it. Shared viewers may be asked to create a free account.
• Your organization. If you are on a team account, your team administrators can see your membership, seat and activity on the team, and content shared within the team.
• Advertising partners (public pages only). On our public pages (the Website and the Application's public pages, such as sign-up and sign-in), Meta and Google receive limited usage information to measure our ads. We never share information from inside your account for advertising.
• Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• Legal reasons. When required by law, or to protect the rights, safety and property of our users, the public or BIP Visualized.
• With your consent or at your direction.

We do not sell personal information.

6. Service providers

We use trusted service providers to host, secure and run the Services. Our main providers and what they do:

We also use standard business tools (such as email, calendar, video meetings, CRM and accounting software) to communicate with customers and prospects and run our business.

Providers that may handle health information are covered by appropriate agreements, including Business Associate Agreements where required. We may update this list as our providers change, and we will notify team and enterprise customers of material changes.

7. Cookies and similar technologies

• Essential cookies keep you signed in, remember trusted devices so you see fewer 2FA prompts, and keep the Services secure. These are used on both the Website and the Application.
• Analytics help us understand how the Website and Application are used. In the Application, analytics are limited to product usage and are configured not to receive BIP content.
• Advertising technologies from Meta and Google Ads are used only on our public pages (the Website and the Application's public pages, such as sign-up and sign-in) to measure our ads. They never run on the pages inside your account, and nothing you do there is used for advertising.

You can manage non-essential cookies on the Website using the cookie banner. See our Cookie Policy for details.

8. Social logins

You can sign up or sign in with your Google account. If you do, Google shares basic profile information with us, such as your name, email address and profile picture. We use it only to create and secure your account. Google's own use of your information is governed by Google's privacy policy.

9. Security and HIPAA safeguards

We take the protection of your information seriously and apply administrative, physical and technical safeguards modeled on the HIPAA Security Rule. These include:

• Encryption of data in transit and at rest, with additional field-level encryption for sensitive content
• Two-factor authentication and secure session management
• Access controls, logging and continuous monitoring
• A documented incident response plan
• A designated HIPAA Compliance Officer
• Agreements with key service providers, including Business Associate Agreements where health information may be involved

Business Associate Agreements. We sign a Business Associate Agreement (BAA) with customers who need one. Contact support@bipvisualized.com to request one.

Security incidents. If we become aware of a security incident affecting your information, we will notify affected customers without unreasonable delay and as required by law and by our agreements with customers.

Your part. No system is completely secure. Please use initials or client codes instead of names, share content only with people who need it, keep your login details private, and follow your professional ethics code and the privacy rules that apply to your organization.

10. International processing

Our primary servers are in the United States. Some service providers process information in other countries, including the European Union, as shown in Section 6. If you use the Services from outside the United States, your information will be transferred to and processed in the United States and those other countries. We take reasonable steps to protect it as described in this policy.

11. How long we keep information

• Account information: while your account is active, and for a reasonable period afterwards to handle questions, billing and legal obligations.
• Content: until you delete it or your account is closed. For team and enterprise accounts, content is kept or deleted as the customer organization instructs.
• Billing records: as long as required for tax and accounting.
• Backups: deleted data may remain in secure backups for a limited time before it is overwritten.

When we no longer need information, we delete or anonymize it.

12. Minors

Accounts are for adults. We do not knowingly allow anyone under 18 to create an account, and we do not market to children. If we learn that a person under 18 has created an account, we will deactivate it and delete that person's account information. Contact support@bipvisualized.com if you think this has happened.

This section applies to account holders only. Information about students and clients entered by adult users is covered by Section 3.

13. Your privacy rights

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and how we use it
• Get a copy of it
• Correct it
• Delete it
• Withdraw consent you have given
• Opt out of marketing emails

You can update most account information in your account settings. For anything else, email support@bipvisualized.com. We may need to verify your identity, and we will not treat you differently for using your rights. Residents of California and other states with consumer privacy laws can use these rights in the same way. We do not sell personal information.

If you are on a team or enterprise account, or your information was entered by a professional who supports you, we may refer your request to that organization, since it controls that information.

14. Do Not Track

There is no common standard for Do Not Track browser signals, so we do not currently respond to them. You can manage cookies on the Website using the cookie banner.

15. Changes to this policy

We may update this policy from time to time. We will change the "Last updated" date at the top, and for material changes we will post a notice in the Services or email you.

16. Contact us

BIP Visualized Inc.
513 W Avenue 37
Los Angeles, CA 90065
United States
support@bipvisualized.com