Privacy Policy

1. Introduction

Phoenix Therapy ("we," "our," or "us") operates the website at phoenixtherapy.com (the "Site") and the Phoenix Therapy electronic health record platform (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit the Site, submit a demo request, receive transactional SMS messages related to the Platform, or otherwise interact with us.

By using the Site or Platform, you agree to the collection and use of information in accordance with this policy. This policy should be read alongside our Terms of Use.

2. Information We Collect

Information You Provide Directly

When you submit our demo request form, we collect:

• First and last name
• Work email address
• Company or organization name
• Phone number (optional)
• Your area of interest (e.g., demo request, pricing, integration question)

This information is submitted to HubSpot, our CRM platform, for processing.

Information Collected Automatically

With your consent (provided via our cookie banner), we use analytics and tracking tools that may collect:

• IP address and approximate geographic location
• Browser type, device type, screen resolution, and operating system
• Pages visited, time on page, scroll depth, and navigation path
• Referral source (e.g., search engine, social media, direct)
• Cookies and similar tracking identifiers

If you decline cookies, no analytics or tracking data is collected beyond what is strictly necessary for the Site to function.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Responding to inquiries — to follow up on demo requests and questions you submit through the Site
• Communications — to send you information about Phoenix Therapy's products, updates, and related content (with your consent)
• Analytics — to understand how visitors use the Site so we can improve content, performance, and user experience
• Legal compliance — to comply with applicable laws, regulations, and legal processes
• Transactional SMS — to send opted-in recipients secure links for required portal forms and consents (see Section 4)

4. SMS Messaging Program

Phoenix Therapy and participating care facilities may send transactional text messages to patients and their designated responsible parties who have provided prior express written consent. These messages contain a secure link to complete required therapy-related portal forms or consent documents. Messages are transactional (not marketing) and are designed to avoid including clinical diagnoses or other unnecessary protected health information.

Information Used for SMS

When SMS consent is on file, we may use:

• Mobile phone number for the patient or responsible party
• SMS consent status recorded in the Platform
• Message delivery metadata needed to send and support the message (for example, delivery status)

How Consent Is Collected

Opt-in is collected in writing at the care facility during patient intake or responsible-party registration. Facility staff record SMS consent in the Phoenix Therapy Platform. Recipients may also text START to the Phoenix Therapy messaging number to confirm opt-in. Consent is not a condition of receiving care.

Message Frequency and Rates

Message frequency varies based on care and documentation needs (typically a small number of messages when forms or consents are requested). Message and data rates may apply.

Opt Out and Help

• Reply STOP to cancel SMS messages. You may also ask facility staff to update your SMS consent in the Platform.
• Reply HELP for help, or contact support@phoenixtherapy.com.
• Reply START to re-subscribe after opting out (where supported).

Sharing and Carriers

We do not sell, rent, or share mobile numbers for marketing or promotional purposes. We use Amazon Web Services (AWS) to deliver SMS under our existing AWS business associate agreement. Wireless carriers are not liable for delayed or undelivered messages.

5. Cookies and Tracking Technologies

Our Site uses a cookie consent banner that allows you to accept or decline non-essential cookies before any tracking occurs.

You can withdraw your consent at any time by clearing your browser's local storage for this site, which will cause the cookie banner to reappear on your next visit.

6. Third-Party Services

We use the following third-party services that may process your data under their own privacy policies:

• Google Analytics 4 — web analytics and traffic measurement. Only loaded after cookie consent. Google Privacy Policy
• HubSpot — CRM, demo request form processing, and visitor tracking. Form data is always sent; tracking cookies are only loaded after consent. HubSpot Privacy Policy
• Amazon Web Services (AWS) — hosting, content delivery, and transactional SMS delivery for the Platform (Amazon SNS). The Site is hosted on AWS S3 and served through AWS CloudFront. AWS Privacy Notice
• Google Fonts — web font delivery. Google may log font requests. Google Privacy Policy

7. Data Sharing

We do not sell, rent, or trade your personal information. We may share your data only in the following circumstances:

• Service providers — with third-party vendors who help us operate the Site, Platform, and SMS delivery (as described in Sections 4 and 6)
• Legal requirements — when required by law, subpoena, court order, or government request
• Business transfers — in connection with a merger, acquisition, or sale of assets, in which case your data would be transferred to the successor entity
• Protection of rights — when we believe disclosure is necessary to protect our rights, your safety, or the safety of others

8. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy:

• Demo request data is retained in our HubSpot CRM until you request deletion
• Analytics data is retained according to Google Analytics and HubSpot default retention periods
• Cookie consent preferences are stored in your browser's local storage and persist until cleared
• SMS consent and phone numbers are retained in the Platform while needed to provide care-related messaging and as required by applicable law or facility policy; opt-out requests are honored promptly

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data
• Opt out — unsubscribe from marketing communications at any time; for SMS, reply STOP
• Withdraw consent — withdraw cookie consent by clearing local storage; withdraw SMS consent by replying STOP or asking facility staff to update your record
• Do Not Sell — we do not sell personal information; no opt-out is necessary

To exercise any of these rights, contact us at privacy@phoenixtherapy.com. We will respond within 30 days.

10. Security

We implement commercially reasonable security measures to protect your information, including:

• TLS/HTTPS encryption for all data transmitted between your browser and the Site
• Restricted access to personal data on a need-to-know basis
• Use of reputable, security-audited third-party service providers

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security of your data.

11. Children's Privacy

The Site is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us at privacy@phoenixtherapy.com and we will promptly delete it.

12. State-Specific Disclosures

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how it is used, request deletion of your data, and opt out of the sale of personal information. We do not sell personal information. To make a request, contact privacy@phoenixtherapy.com.

European Visitors (GDPR)

If you are located in the European Economic Area, our legal basis for processing your personal data is your consent (for cookies and marketing) and legitimate interest (for responding to demo requests). You have the right to access, rectify, erase, restrict, or object to the processing of your data. Contact privacy@phoenixtherapy.com to exercise these rights.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy on this page and update the "Last updated" date at the top. We encourage you to review this page periodically. Your continued use of the Site after any changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle your data, contact us at: