HIPAA & Business Associate Statement

1. Our Role Under HIPAA

Please note that this document is not a Notice of Privacy Practices (NPP). An NPP is a document that a Covered Entity (like a physician or clinic) provides directly to its patients.

PsychLocal, Inc. is a technology vendor. We are not a Covered Entity, we do not act as a healthcare provider, and we do not provide medical advice or treatment. Generally, we operate as a standard software service. However, in cases where a practice utilizes our platform in a manner that causes us to create, receive, maintain, or transmit Protected Health Information (PHI) on the practice's behalf, PsychLocal, Inc. acts as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

2. Business Associate Agreements (BAA)

We offer Business Associate Agreements (BAAs) to customers on all paid subscription plans.

If your use of our services involves the transmission or storage of PHI, you must request and execute a BAA before entering any PHI into the platform. To request a BAA, please contact our compliance team at hello@psychlocal.com.

3. What the Platform is Designed For

PsychLocal is purposefully built to manage and distribute public-facing business and provider directory information. The intended data includes:

• Practice and clinic names
• Physical addresses and phone numbers
• Operating hours and business categories
• Provider names and National Provider Identifier (NPI) numbers
• Accepted insurance networks
• Treatments offered and conditions treated

This provider and practice information is classified as business marketing information, not PHI, because it does not identify any individual patient or their specific health condition.

4. What NOT to Store Without a BAA

While the core directory fields are not PHI, our platform includes open text fields and communication tools. Without a fully executed BAA in place, practices must not enter PHI into the following areas:

We strongly advise practices to maintain all clinical details securely within their dedicated Electronic Health Record (EHR) systems and utilize PsychLocal strictly for the marketing and directory syndication layer.

6. Service Providers and PHI

To deliver our core features, content entered into free-text fields may be transmitted to downstream vendors. This includes routing messages through SMS and email gateways, or sending review text to artificial intelligence providers.

Please review the How We Share Information section of our Privacy Policy to understand the categories of service providers we use and where data flows. This transmission footprint is the primary reason why PHI must not be submitted into the platform without a signed BAA confirming that appropriate downstream vendor coverages are established. A detailed list of named sub-processors is provided to customers under a BAA upon request.

7. Reviews & Patient-Authored Content

Our platform aggregates reviews from public sources (such as Google and Yelp) and processes them for sentiment analysis. It is common for a patient to voluntarily disclose health information in a public review.

Because these reviews are public and voluntarily published by the consumer on third-party networks, PsychLocal does not control their content. However, we apply the same internal security safeguards to all aggregated review text synchronized to our database.

8. Breach Notification

In the event of a security incident that compromises the confidentiality, integrity, or availability of your data, PsychLocal, Inc. commits to investigating the matter promptly. For customers with an active BAA, we will provide notification of any verified breach of unsecured PHI without unreasonable delay, in accordance with the terms of our BAA and applicable law.

9. Context on Marketing Claims

You may see descriptions of our platform as "HIPAA-conscious" or referencing HIPAA compliance in our marketing materials. We want to be radically transparent: no software is inherently HIPAA compliant on its own.

Our platform supports HIPAA compliance by providing the necessary technical safeguards and the legal framework of a BAA. However, ultimate compliance relies entirely on how your practice configures the tool, what data you choose to input, and how you manage user access.

10. Contact Us

If you have questions about this statement, our security practices, or need to initiate a BAA request, please reach out to us:

Email: hello@psychlocal.com
Toll-Free Phone: (800) 434-4519