Privacy Policy

Effective Date: October 6, 2026 • Last Updated: October 6, 2026

1. Scope and Clinical Context

StoryCare is a clinical documentation and therapeutic intervention platform operated by Entryway Health PLLC. The platform is designed for licensed mental health professionals, including psychotherapists, psychologists, psychiatrists, and authorized clinical care teams.

When StoryCare provides services to healthcare providers, clinics, hospitals, or research institutions that qualify as Covered Entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), StoryCare functions strictly as a Business Associate under Title 45 of the Code of Federal Regulations (45 CFR Parts 160 and 164).

All Protected Health Information (PHI) created, received, maintained, or transmitted through our systems is governed by binding Business Associate Agreements (BAAs) executed with each customer organization. To the extent that state or federal privacy laws (such as the California Consumer Privacy Act / CPRA) contain specific exemptions for medical information and PHI covered by HIPAA (including Cal. Civ. Code § 1798.145(c)), such information is protected pursuant to HIPAA requirements and applicable medical confidentiality statutes.

2. Information We Collect Across Platforms

We adhere strictly to the principle of data minimization. We collect only the information necessary to authenticate healthcare providers, record clinical sessions at the provider's instruction, generate accurate clinical documentation, and maintain system reliability.

2.1 Clinician Account and Authentication Credentials

StoryCare accounts are provisioned exclusively through enterprise healthcare organizations, clinics, or direct clinician verification. We do not permit anonymous, unverified, or public self-registration. We collect:

• Full legal and professional name.
• Professional clinical credentials and title.
• Enterprise work email address.
• Practice or organizational affiliation.
• Cryptographic session tokens and authentication logs managed through Firebase Authentication.

2.2 Clinical Session Audio and Therapeutic Media

When a licensed provider initiates a session in the StoryCare Session Recorder or web portal, we process:

• High-definition audio recordings of clinical therapy sessions captured via the device microphone.
• Session metadata, including session date, duration, audio file checksums, and encrypted patient reference codes.
• Verbatim and speaker-diarized transcripts generated from session audio.
• Structured clinical summaries, progress notes, and therapeutic media requested by the clinician.

Clinical Consent Mandate: StoryCare is an assistive documentation tool. Audio recording requires affirmative initiation by the clinician and prior patient informed consent in accordance with applicable state recording laws, professional ethics codes, and institutional policies.

2.3 Diagnostic, Operational, and Integrity Telemetry

To ensure uninterrupted audio capture and confirm that no clinical data is lost during network transitions, our mobile and web applications collect minimal technical telemetry:

• Cryptographic file checksums (SHA-256) used exclusively to verify block-level upload integrity of chunked audio files.
• Hardware and operating system specifications (such as iOS or Android build version, device model).
• Local outbox upload status, queue latency, and sanitized operational error traces.

Exclusions: We do not collect Advertising Identifiers (such as Apple IDFA or Google GAID), location coordinates, contacts, SMS records, browsing history, or payment card details through our mobile applications.

3. How We Use Collected Data

We use collected information solely for legitimate clinical, administrative, and technical operations:

• Clinical Note Generation: Processing audio streams to produce transcripts, draft progress notes, and extract clinical themes at the direction of the treating clinician.
• Caseload Management: Enabling authenticated clinicians to review their assigned patient roster, verify prior session dates, and review clinical progress.
• Data Integrity and Delivery Assurance: Verifying bit-level upload completion before local device cache eviction to prevent recording loss.
• Compliance and Security Auditing: Generating immutable audit logs of account authentication, patient record access, session exports, and permission modifications in accordance with HIPAA Technical Safeguards (45 CFR § 164.312(b)).

Prohibition on Commercial Exploitation: We do not sell, rent, monetize, or lease clinician or patient data to third parties. We do not engage in behavioral advertising, data broker exchanges, or commercial cross-context tracking.

4. Artificial Intelligence and Machine Learning Boundaries

StoryCare incorporates automated speech recognition and specialized clinical language models to convert spoken dialogue into clinical notes. We enforce strict data boundaries:

• No Public Model Training: Session audio, patient transcripts, and clinical summaries are never used to train, retrain, fine-tune, or evaluate public, commercial, or third-party foundational artificial intelligence models.
• Isolated Cloud Processing: All automated transcription and language inference workloads run within dedicated, private enterprise cloud environments bound by signed HIPAA Business Associate Agreements with zero data retention for training purposes.
• Human-in-the-Loop Clinical Authority: AI outputs within StoryCare are preliminary drafts. Treating clinicians maintain sole responsibility for reviewing, modifying, and approving all documentation before it is entered into the designated health record.

5. Security Architecture and Data Safeguards

StoryCare enforces comprehensive Administrative, Physical, and Technical safeguards that meet or exceed the requirements of the HIPAA Security Rule.

5.1 Mobile Device Security (iOS and Android)

• Hardware-Backed Encryption on iOS: All local audio chunks recorded on Apple devices are stored using Apple Data Protection (NSFileProtectionCompleteUnlessOpen). File contents remain encrypted in flash memory and can only be decrypted while the device is unlocked and the recording process holds an open handle.
• Android Keystore Protection: On Android devices, cached recording artifacts are protected using hardware-backed cryptographic keys managed by the Android Keystore system.
• Ephemeral Device Storage: Audio chunks are buffered locally in protected application sandboxes only until a cloud upload is confirmed. Once the cloud server verifies the SHA-256 integrity hash, local audio files are immediately purged from the mobile device.
• Biometric Authentication: The mobile application supports biometric authentication (Face ID, Touch ID, and Android BiometricPrompt) to protect local access. Biometric verification occurs entirely within the device Secure Enclave or hardware security module; StoryCare never receives or stores biometric data.

5.2 Network Transmission and Cloud Infrastructure

• Encryption in Transit: All traffic between clients and servers uses Transport Layer Security (TLS 1.3). Unencrypted HTTP access is rejected.
• Encryption at Rest: All audio files, transcripts, database tables, and system backups are encrypted at rest using AES-256 across Google Cloud Platform storage and managed PostgreSQL instances.
• Role-Based Access Control: Access to patient data is strictly segregated. Clinicians may access only the patients assigned to their active caseload.

6. Disclosures and Third-Party Subprocessors

StoryCare shares data only with vetted subprocessors necessary to deliver platform functionality. Every vendor handling sensitive data is bound by a formal Business Associate Agreement:

• Cloud Infrastructure: Google Cloud Platform (secure data storage, serverless compute, and database hosting within United States data centers).
• Identity and Authentication: Google Identity Platform / Firebase Authentication (tokenized user credentials and session validation).
• Clinical Speech Processing: Enterprise speech-to-text processing partners operating under strict BAA terms and zero data-retention guarantees.
• HIPAA-Compliant Email: Paubox (encrypted email communications for platform notifications).

7. Data Retention and Deletion Policy

7.1 Medical Records Retention

Because StoryCare processes data on behalf of licensed healthcare entities, retention periods for patient records and session summaries are governed by state medical board regulations, institutional record retention policies, and federal healthcare laws (typically requiring retention between seven and ten years from the date of service, or until a minor reaches the age of majority).

7.2 Clinician and Enterprise Deletion Requests

Authorized clinical administrators may request the permanent deletion of session audio files, transcripts, or clinician accounts by contacting our privacy office at privacy@storycare.health. When a verified deletion request is executed, operational files are purged from active production databases and permanently overwritten across backup cycles in accordance with HIPAA standards.

8. Mobile Device Operating Permissions

9. Contact Information

For questions regarding this policy, HIPAA compliance verification, Business Associate Agreements, or data subject rights, please contact our Privacy and Information Security Office:

Entryway Health PLLC d/b/a StoryCare Health
Attention: Privacy and Compliance Office
Email: privacy@storycare.health
Website: https://storycare.health
Headquarters: New York, NY, United States