Privacy Policy

EndGol Therapist Hub ("EndGol," "we," "us") provides a practice-management platform for mental health therapy practices, used by both practice staff ("Practice Users") and their clients ("Client Users"). This Privacy Policy explains what information we collect, how we use and protect it, and the choices available to you. It applies to everyone who uses the platform, whether through the staff dashboard or the client portal.

Because this platform is used to store and process Protected Health Information (PHI) on behalf of therapy practices, this policy should be read alongside the Business Associate Agreement (BAA) between EndGol and each practice, which governs our obligations under the Health Insurance Portability and Accountability Act (HIPAA). Where this policy and a practice's BAA conflict on the handling of PHI, the BAA controls.

Account & Identity Information

Name, email address, phone number, and password (stored as a salted hash, never in plain text) for anyone who creates an account, whether a practice owner, staff member, or client.

Protected Health Information (PHI)

When entered by a practice, this may include client demographics, appointment history, session notes, treatment plans, diagnosis and risk-assessment information, clinical assessment responses (e.g. PHQ-9, GAD-7), consent form submissions and signatures, insurance details, and billing history. This information is entered and controlled by the practice, not by EndGol, and is stored in the practice's isolated data space, only accessible to that practice's authorized staff and the specific client it belongs to.

Payment Information

Card payment details are processed directly by Stripe, our payment processor; EndGol never stores full card numbers on its own servers. We do store invoice records, payment amounts, and payment status.

Usage & Device Information

Log data such as IP address, browser type, device information, and pages visited, used for security monitoring, audit logging, and improving the service.

• To provide the core functionality of the platform: scheduling, clinical documentation, billing, secure messaging, and the client portal.
• To send transactional communications you or your practice requests: appointment reminders and confirmations, invoice notices, two-factor authentication codes, and account/security notices.
• To maintain the HIPAA-required audit trail of who accessed or modified what data, and when.
• To detect, investigate, and prevent security incidents, fraud, and abuse.
• To comply with legal obligations, respond to lawful requests, and enforce our Terms & Conditions.

We do not sell personal information or PHI to third parties, and we do not use PHI for advertising.

• Database-level tenant isolation. Every practice's data is isolated using PostgreSQL Row-Level Security, enforced at the database layer, not just in application code.
• Encryption in transit. All connections to the platform use HTTPS/TLS.
• Role-based access control. Staff only see the functions and data appropriate to their role (owner, admin, therapist, billing, receptionist); clients only ever see their own information.
• Immutable audit logging. Every authenticated action is recorded in an append-only audit log that cannot be altered or deleted, even by administrators.
• Session security. Automatic idle session timeout with a warning before sign-out, and optional two-factor authentication (TOTP or email) for all account types.
• No PHI in error logs. Our error-handling is designed to exclude clinical content from system logs and crash reports.

We share information only as necessary to operate the platform, and only with service providers bound by confidentiality and, where they may handle PHI, a signed Business Associate Agreement:

• Cloud hosting infrastructure — to run the application and store data securely.
• Stripe — for processing card payments, when a practice enables online payments.
• Email delivery providers — to send transactional emails (appointment reminders, invitations, notifications).

We do not share PHI with advertisers, data brokers, or any party for marketing purposes.

Depending on your role and applicable law (including HIPAA's rules on individual access to health information), you may have the right to:

• Request a copy of the personal information or clinical records associated with your account.
• Request correction of inaccurate information.
• Request deletion of your account, subject to the practice's legal obligation to retain clinical records for the period required by applicable law.
• Withdraw consent for non-essential communications at any time.

Client Users should direct requests about their clinical records to their practice directly, since the practice — not EndGol — is the legal custodian of that data (the "Covered Entity" under HIPAA). Practice Users can contact us directly using the information below.

We retain account and clinical data for as long as a practice's account is active, and thereafter for the period required by the practice's applicable record-retention obligations, or as needed to comply with legal, tax, or audit requirements. Audit logs are retained in full and are never deleted, consistent with HIPAA's audit-control requirements.

The platform may be used by therapy practices to store records for minor clients, entered and managed by the practice on the minor's behalf. The client portal itself is intended for use by adult clients or by a parent/guardian managing a minor's care, consistent with the practice's own policies and applicable law.

We may update this Privacy Policy from time to time. If we make material changes, we will notify practice administrators and, where appropriate, display a notice within the application. Continued use of the platform after an update constitutes acceptance of the revised policy.

Questions about this Privacy Policy, or requests regarding your personal information, can be sent to your practice directly (for questions about your own clinical records) or to EndGol Therapist Hub support through the Help page.