Privacy Policy

Last updated: July 2026

Who we are

IntakeCompass ("we," "us") provides a software tool that lets licensed clinicians ("Providers") send structured, non-diagnostic intake assessments to their clients and receive a summary before the first session. IntakeCompass is operated by SYR Wellness LLC.

Two kinds of people, two roles

This policy covers two groups. Providers create accounts and are our customers. Clients are the people a Provider invites to complete an assessment. For a Client's assessment responses (which may be protected health information, or "PHI"), the Provider is the responsible party and we act as their Business Associate — we handle that information on the Provider's behalf and under their direction, not for our own purposes.

Information we collect

• Provider account information: name, email, practice name, and authentication details (we never store your password in plain text; sign-in is handled by Amazon Cognito, and two-factor authentication is required).
• Assessment responses (Client PHI): the answers a Client provides, stored on the Provider's behalf. We do not use this content for any purpose other than generating the Provider's report and operating the service.
• Billing information: processed by Stripe. We do not store full card numbers; Stripe handles payment data under its own PCI-compliant systems.
• Basic technical logs: needed to operate and secure the service. We take care to keep assessment content out of application logs.

How we use information

We use information to provide the service: to authenticate Providers, generate the structured report from a Client's responses, process credit purchases, and keep the platform secure and reliable. We do not sell personal information, and we do not use Client assessment content for advertising, model training, or any purpose beyond delivering the Provider's report.

HIPAA and how we protect information

• The platform runs on HIPAA-eligible AWS infrastructure, and we have a signed Business Associate Addendum with AWS.
• Data is encrypted in transit and at rest.
• Each practice's data is logically isolated from every other practice's.
• Access is controlled, and administrative access to production is audit-logged.

Who we share information with

We share information only with service providers ("subprocessors") that help us run the platform, and only as needed: Amazon Web Services (hosting and storage), Stripe (payments), and Google (optional single-sign-on for Providers who choose it). We do not sell data or share it with advertisers. We may disclose information if required by law.

Retention and deletion

We retain data for as long as needed to provide the service and as directed by the Provider. Providers may request deletion of their organization's data; on a verified request we permanently remove the associated assessments, responses, reports, access links, and account records.

Cookies

We use only essential cookies and browser storage needed to keep you signed in and operate the app. We do not use third-party advertising or tracking cookies.

Children

IntakeCompass is a professional tool for licensed clinicians and is not directed to the general public. Any assessment of a minor is administered by, and under the responsibility of, the treating Provider in accordance with applicable law and consent requirements.

Changes to this policy

We will update this page as the service and our legal review evolve, and will revise the "last updated" date above.

Contact

Questions about privacy: support@intakecompass.com.