This policy explains how HypnoNest LLC ("HypnoNest") handles personal information when you use our websites, web app and mobile apps.
1. Two roles
- For your account (name, email, sign-in and security details, preferences) HypnoNest decides how information is used.
- For practice records (client records, appointments, forms and signatures, messages, session notes, session transcripts and AI notes, recordings, activities and reflections, payments) the practice decides; HypnoNest processes them on the practice's behalf under our Data Processing Agreement. Questions about practice records go to the practice first.
2. What we collect
- Account details: name, email, password (stored only as a secure hash), sign-in codes and authenticator setup, remembered devices, session records, preferences.
- Information practices and clients add while using the service (see above), including information about health and well-being.
- Payment details are collected and held by Stripe; we receive identifiers and payment status, never full card or bank numbers.
- Information from services a practitioner connects: with Zoom, the meeting details for sessions HypnoNest scheduled and, when the practitioner turns it on and the client has agreed, the cloud recording of those meetings; never the practitioner's other meetings or recordings.
- Technical information: request logs with request identifiers and errors (without the content of notes, messages or forms), crash reports with error details, and aggregate counts of public website page views with no visitor identifiers.
3. How we use it
To provide and secure the service, send account and appointment emails and notifications you choose, process payments, provide support, prevent abuse, meet legal obligations and improve reliability. We do not sell personal information, share it for cross-context advertising, or use advertising trackers.
4. AI features
When a practitioner uses AI features, only what that task needs is sent to an AI provider: a session's recorded audio to Google Cloud to transcribe it, and the transcript to draft a note (both only with the client's agreement), or a script to draft or read aloud. Providers process it only to return the result and do not use it to train their models. We do not use your content, including anything from Zoom, to train AI models.
5. Consumer health information
Information about your health is used only to provide the service you asked for. Clients give separate, explicit consent before a practice's records about them are processed in HypnoNest. You can withdraw consent by contacting the practice and us. After you withdraw, the practice can no longer use HypnoNest to collect new information about you; records it already holds stay with the practice for its legal retention period.
We never sell consumer health data or use it for advertising. If you live in Washington, Nevada or another state with a consumer health data law, you can ask us to confirm what we hold, give you a copy, or delete it (records a practice must keep are deleted when its retention ends). Email support@hypnonest.com; we answer within 45 days.
6. Who we share it with
- The practices and people you work with, as the service is designed to do.
- Service providers acting for us: Amazon Web Services (hosting, storage, email, and AI note drafting with Anthropic's Claude through Amazon Bedrock), Google Cloud (Vertex AI: transcribing recorded session audio, only with the client's agreement, and Gemini voices that read a script aloud), Stripe and Square (payments), Expo with Apple and Google push services (push notifications, without private content), Zoho (our support and staff email).
- Services a practitioner chooses to connect, such as Zoom (session meetings) or their own ElevenLabs account (voices). Their own privacy policies apply to what they hold.
- Authorities when the law requires it, and a successor in a merger or acquisition with notice.
7. Where and how long
Information is stored in the United States on Amazon Web Services and encrypted at rest and in transit. Account data is kept while your account exists; after deletion it is removed, except backups that expire within 90 days. Practices keep their records for their legal retention periods.
8. Your choices and rights
Download your data or request deletion in Account security. Ask the practice to access, correct or delete practice records about you. Depending on where you live you may have further rights (for example under California law); contact support@hypnonest.com. We will not discriminate against you for using them.
9. Security
Encryption, access limited by role and practice, multi-factor sign-in for practitioners and administrators, audit records of sensitive actions, and monitoring. No system is perfectly secure; we will notify you and the practice of a breach as the law requires.
10. Children
HypnoNest is for adults 18 and over.
11. Changes and contact
We will ask you to accept material changes. HypnoNest LLC, Elk Grove, California, USA, support@hypnonest.com.