IntakeFlow
Log inStart free

Privacy Policy

Last updated: 2026-09-23

This Privacy Policy describes how IntakeFlow ("we," "us," or "the Service") collects, uses, shares, and protects personal information. IntakeFlow is operated by EMHNJ, based in New Jersey, USA. Protected Health Information (PHI) is additionally governed by your HIPAA Business Associate Agreement — see the BAA.

Who we are

IntakeFlow is a B2B SaaS that helps licensed psychotherapy practices screen the prospective-client emails they receive. We act as a Business Associate (under HIPAA) to the therapists who subscribe. We are not a healthcare provider; we do not provide clinical services. We are not a marketing platform; we do not serve ads, build profiles, or sell data.

Information we collect

From therapists (our customers)

  • Account info: email address, name, practice name, sign-in timestamps.
  • Get-started requests: if you fill in the form at /get-started we store your name, work email, practice name and size, where your inquiries arrive, and (if you give them) a phone number and short message, and email them to our team so we can reply. We use them only to contact you about IntakeFlow.
  • Billing info: name, billing address, last 4 digits of payment card, and a Stripe customer ID. Full card numbers are never stored on our servers — they live with Stripe (see Subprocessors).
  • Authentication state: hashed sign-in tokens, TOTP secret (encrypted at rest with a global key).
  • Operational metadata: IP address, user agent, session activity (for audit logging and abuse detection).

From prospective clients (the inbox you connect)

  • Inbound email body — encrypted at rest with a per-tenant data-encryption key (DEK) wrapped by a KMS-managed master key.
  • Structured extraction — insurance carrier, availability, presenting concerns, modality preference, parsed out of the email body and stored encrypted alongside the body.
  • Crisis flag and rationale — a boolean plus a short rationale, stored encrypted with the intake, if our system detected acute-risk language.
  • Salted hash of the sender's email address — used for abuse rate-limiting and to correlate audit rows without storing the raw address in plaintext.

Prospective-client data is PHI under HIPAA. It is held under the Business Associate Agreement between us and the therapist whose inbox it arrived at. It belongs to the therapist's practice; we have no independent right to use it.

How we use information

  • To run the screening pipeline (extract structured fields, route crisis cases, send acknowledgments and the daily digest to the therapist).
  • To bill subscriptions through Stripe and provide customer support.
  • To detect fraud, abuse, and security incidents.
  • To comply with legal obligations and respond to lawful requests.

What we do not do: We do not sell or rent personal information. We do not use PHI to train AI models, ours or any third party's. We do not load third-party advertising or behavioral-analytics trackers on authenticated (logged-in) pages. We do not share PHI with our payment processor.

Legal bases

For customers in the United States, we process information to perform our contract with you (Terms of Service + BAA), to comply with HIPAA and other applicable law, and where you provide consent (e.g. connecting your mailbox by OAuth). We do not knowingly process information of EU/UK residents in a way that triggers GDPR/UK-GDPR; if you are an EU/UK practitioner, please contact us before signing up.

Subprocessors

We use a small set of vendors to operate the Service. Vendors that touch PHI sign a HIPAA Business Associate Agreement; vendors that don't touch PHI are still bound by data-processing terms. Full list with roles and BAA status at /legal/subprocessors. Key categories:

  • Cloud infrastructure — Amazon Web Services (BAA; runs the application on ECS Fargate, holds encrypted PHI, manages KMS keys, and serves Bedrock inference) and Neon (BAA; Postgres database, HIPAA mode — PHI is stored there as ciphertext only).
  • AI extraction — Claude models via Amazon Bedrock, inside AWS and covered by the AWS BAA. Prompts are not retained by Bedrock by default and are never used to train models. We do not send client data to any AI vendor outside that boundary.
  • Email — Replies to prospective clients, clinician notifications, and your daily digest are sent from your practice's own connected Google Workspace / Gmail mailbox, using the send permission you grant when you connect it. That mailbox is your Google account under your own Google terms; we recommend Google Workspace, which offers a HIPAA BAA. Our sign-in emails, which contain no client information, go through Google Workspace or Amazon SES, both under a signed BAA.
  • Billing & payments — Stripe, Inc. We send Stripe only non-PHI billing fields: your business email, plan ID, billing address, and (when you check out) the payment card you enter into Stripe's own iframe — those card details go straight from your browser to Stripe and never transit our servers.

Cookies & trackers

The public marketing pages (the home page, Features, Pricing, Security, About, Contact, Flow Creator, Get started, and these legal pages) load the Google Ads tag (gtag.js) so we can tell which of our advertising brought a practice to the site. It is the only third-party script on the site. When it loads, Google receives the address of the page you visited, the page that referred you, your IP address, and your browser's user-agent string, and it sets Google's advertising cookies on our domain: _gcl_au (a random browser identifier) and, if you arrived by clicking one of our Google ads, _gcl_aw or _gcl_gb (a record of that click). We have switched off the tag's ad-personalization signals, so Google does not use these visits to add you to advertising audiences or to show you our ads on other sites. You can also manage Google's ad settings at adssettings.google.com. Those pages contain no client information, and nothing about any practice's clients ever reaches Google Ads. A link from a practice's intake form to this site is sent without a referrer, so Google is never told that a visitor came from an intake form.

The tag is never loaded on authenticated pages, the sign-in and two-factor pages, or a practice's public intake form. On those pages we use only the cookies necessary for authentication and CSRF protection, and our Content-Security-Policy blocks any third-party script from loading there. We do not use Google Analytics, Meta Pixel, or any other third-party tag anywhere on the site.

Retention

  • Encrypted intakes & extracted fields: retained until you delete them, your subscription ends and you ask us to crypto-shred your tenant key, or you delete your account.
  • Audit logs: six (6) years, the HIPAA Security Rule retention period. Audit logs contain only non-PHI metadata (action, timestamp, hashed identifiers).
  • Billing records: seven (7) years, to comply with tax law.
  • Get-started requests: kept until you ask us to delete them (email admin@intakeflownow.com); nothing deletes them automatically.
  • Encrypted backups: our database provider's point-in-time-recovery window, then destroyed. Backups hold the same ciphertext as the live database; after you delete your practice, its records age out of backups as that window rolls over.
  • Infrastructure logs: never contain client content or email text (the application does not log them); kept up to six (6) years alongside the audit log.

Security

  • Per-tenant envelope encryption (KMS-wrapped DEK) for all PHI at rest.
  • TLS 1.2+ for all data in transit.
  • Row-level security in the database, in addition to application-level tenant scoping.
  • Mandatory 2FA (TOTP) for every user role that can view client information.
  • Audit log of every PHI access, retained 6 years.
  • Breach-notification procedures documented in our internal runbook and reflected in the BAA.

Your rights as a therapist customer

  • Access: view your tenant's data anytime in the dashboard.
  • Export: download an export of all your tenant's intakes (Settings → Account → Export; account owner only). The export is JSON, decrypted, and includes every intake with its extracted fields. Your audit log is viewable on the Audit page of the dashboard.
  • Correction: email admin@intakeflownow.com and we will correct or annotate a record; in-app editing is on our roadmap.
  • Deletion: delete your practice (Settings → Account → Delete this practice; account owner only). This crypto-shreds your tenant key, rendering encrypted PHI unrecoverable. Audit logs remain (HIPAA-required).
  • Portability: the Export is in a standard JSON shape so you can re-import elsewhere.

Prospective clients (your patients-to-be)

If you contacted a therapist's practice and want to know what we store about you, please contact the therapist directly — they are the HIPAA Covered Entity and the owner of any PHI. We will work with them to fulfill valid HIPAA access, correction, or deletion requests under the BAA.

State privacy rights (US)

Residents of states with comprehensive privacy laws (e.g. California's CCPA/CPRA, Virginia's VCDPA, Colorado's CPA) have the right to access, correct, and delete personal information we hold about them, and the right to opt out of "sale" or "sharing" of personal information. We do not "sell" or "share" personal information as those terms are defined under any US state privacy law. Requests: admin@intakeflownow.com.

Children

The Service is not directed at children under 13. If a prospective-client email is from a minor, the therapist is responsible for any parental-consent obligations under HIPAA, COPPA where applicable, and state law.

International transfers

Our servers are located in the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US.

Changes

We'll email account owners at least 30 days before material changes. The current version is always at this URL.

Contact

Mailing address available on written request to admin@intakeflownow.com.