Privacy Policy

1. Who we are and what this policy covers

Acceptance Path (formerly PathwayNotes) is software that therapists and other clinicians use to stay connected with their clients between sessions. It is operated by Minds Awakened LLC, doing business as Acceptance Path (“Acceptance Path,” “we,” “our,” or “us”). This policy explains how we collect, use, share, and protect personal information when you:

• visit our websites, including theclientpath.com and pathwaynotes.app;
• use Acceptance Path as a clinician, practice owner, or practice administrator (a “Clinician”); or
• use Acceptance Path as a client invited by a Clinician (a “Client”).

Client health information. Clinicians use Acceptance Path to support their Clients’ care. When a Clinician or practice is a HIPAA “covered entity,” we handle Client information on its behalf as a “business associate,” under HIPAA and our Business Associate Agreement (“BAA”). In that case the Clinician or practice decides how Client information is used and disclosed, and its Notice of Privacy Practices also applies to you. If you are a Client and want to access, correct, or restrict your records, please contact your Clinician first; we will help them respond. Where this policy differs from HIPAA or the BAA for protected health information, HIPAA and the BAA control.

Acceptance Path is not a healthcare provider and does not provide therapy or crisis services. Our Terms of Service explain more.

2. Information we collect

From website visitors

When you visit our websites, our hosting and security providers receive technical information such as your IP address, browser type, and the pages you request. Our website at theclientpath.com does not currently use analytics or advertising cookies. It loads fonts from Google Fonts, which receives your IP address.

From Clinicians

• Account details: name, email address, sign-in method (email and password, Google, or Apple), professional role and specialty, and practice name.
• Practice details: for practice accounts, the names and email addresses of team members, and the email address and phone number of people you invite.
• Billing details: plan, subscription status, and payment records. Card payments are handled by Stripe, and in-app purchases by Apple or Google; we do not receive or store full card numbers.
• Agreement records: when you agreed to our Terms of Service, this Privacy Policy, and the BAA.
• Sign-up and marketing details: if you arrive from one of our ads, advertising identifiers (such as Meta’s “_fbc” and “_fbp” cookies), your IP address, browser type, and a country estimated from your time zone, plus any promo code you use.

About Clients

From the Clinician who invites you: your name, email address, and mobile phone number, and any intake information the Clinician chooses to add, such as notes used to tailor the app to you.

From you, when you use the app:

• Account details: name, email address, password or Google or Apple sign-in, and when you agreed to our terms.
• Journal entries: what you write, the mood and intensity you choose, and entry titles. If you use voice, your speech is transcribed as you speak; we do not store the audio. If you photograph a handwritten page, the image is processed to read the text and is not stored.
• Check-ins, mood logs, and questionnaires your Clinician sends (such as the PHQ-9 or GAD-7), including scores.
• Messages and attachments you exchange with your Clinician (images or PDFs).
• Questions you ask in Ask and the answers you receive.
• Reminder and notification preferences, including reminder times the app learns from when you usually write.

From your Clinician, as part of your care: session summaries, notes, progress notes (which can include diagnoses), and AI-generated summaries and profiles about your progress.

From everyone who uses the app

• Device and usage information: push notification tokens, time zone, and records of sign-ins and key actions (including IP address and device or browser type) that we keep for security and audit purposes.
• Error reports: when the app or our servers hit an error, a report is sent to our error-monitoring provider. Reports identify you only by an account ID but may include technical details of the request that failed.

We do not collect your precise location or your contacts. The app asks to use your camera, microphone, photos, speech recognition, or Face ID only when you use a feature that needs them.

3. How we use information

We use personal information to:

• provide, maintain, and secure Acceptance Path, including creating accounts and delivering entries, check-ins, messages, and summaries between Clients and Clinicians;
• provide AI features (see “Artificial intelligence”);
• detect language that may suggest a risk of harm (see “Safety scanning”);
• send invitations, reminders, notifications, and account messages by email, text message, and push notification;
• process payments and manage subscriptions for Clinicians;
• provide support and respond to requests;
• understand and improve how Acceptance Path is used, using de-identified or aggregated information where possible;
• measure and improve our marketing to Clinicians; and
• comply with law, enforce our terms, and protect the rights, safety, and property of our users and others.

We do not use the content of Client journals, check-ins, questionnaires, or messages for advertising.

4. Artificial intelligence

Acceptance Path uses AI to write journal reflections, answer questions in Ask, summarize weeks and months, draft session summaries and documentation for Clinicians, read handwriting, transcribe voice, and read text aloud. To do this, we send the relevant content (for example, a journal entry and your recent entries, or a Clinician’s notes) to AI services:

• Amazon Bedrock, run by Amazon Web Services, hosts the language models we use, including Amazon Nova and Moonshot AI’s Kimi. These models run inside Amazon Web Services; your content is not sent to the companies that developed the models.
• AssemblyAI transcribes voice.
• Amazon Polly reads text aloud.

Some AI responses, including journal reflections and answers in Ask, are shown to Clients automatically, without a Clinician reviewing them first. Drafts written for Clinicians, such as session summaries, are reviewed and edited by the Clinician before they are sent. AI can be wrong; our Terms of Service explain its limits.

We do not use your content to train AI models.

5. Safety scanning

To support Client safety, Acceptance Path automatically checks journal entries (including entries you have not shared), notes in check-ins, and questions in Ask for language that may suggest a risk of harm to yourself or others. If something is flagged, the app shows you crisis resources, such as the 988 Suicide & Crisis Lifeline, and your Clinician can see a short excerpt and the reason it was flagged. This scanning is automated and imperfect, and it is not an emergency service. If you are in danger, call or text 988, or call 911.

6. What your Clinician can see

• Journal entries are shared with your Clinician by default when you save them. You can stop sharing an individual entry from that entry’s screen.
• Check-ins and mood logs are always visible to your Clinician.
• Questionnaire answers and scores, messages, and anything flagged by safety scanning are visible to your Clinician.
• If your Clinician belongs to a group practice, the practice’s owner or administrators may see engagement information about the practice’s clients, such as activity levels and whether a client may be at risk of leaving care.

7. How we share information

We share personal information only as described here.

• With your Clinician or practice, as described in “What your Clinician can see.”
• With service providers that process information for us under contract, for the purposes in this policy:
  • Amazon Web Services: hosting, databases, file storage, encryption keys, AI (Amazon Bedrock), text-to-speech (Amazon Polly), email, and text messages;
  • Google Firebase: sign-in, push notifications, and hosting of our web app;
  • AssemblyAI: voice transcription;
  • Sentry: error monitoring;
  • Stripe: Clinician payments; Apple and Google: in-app purchases and sign-in with Apple or Google;
  • GoHighLevel: our customer relationship and email system;
  • Google (Google Analytics, Google Tag Manager, Google Fonts) and Meta: website and marketing measurement;
  • Cloudflare and Rocket.net: website hosting and security.
• For analytics and marketing. Our web app currently loads Google Tag Manager, which we use to run Google Analytics and the Meta Pixel to measure sign-ups and purchases. These tools can receive cookies, device information, and the address of the page you visit. When an account is created, we record the sign-up in Google Analytics with an account ID (and, for Clients, the ID of the inviting Clinician), and in GoHighLevel with the person’s name and email address (and, for Clients, the inviting Clinician’s ID).
• For legal reasons. We disclose information when required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect someone’s safety, to investigate fraud or security issues, or to protect our rights. For protected health information, we follow HIPAA and the BAA.
• In a business transfer. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy and any BAA.
• With your consent or at your direction.

We do not sell personal information.

8. Text messages

We send text messages for account purposes, such as invitations from your Clinician and reminders to finish setting up your account. Message frequency varies. Message and data rates may apply. Reply STOP to stop receiving texts, or HELP for help.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

9. Cookies and similar technologies

• Our website at theclientpath.com uses only the cookies needed to deliver and secure the site. It does not use analytics or advertising cookies.
• Our web app uses browser storage to keep you signed in and to remember settings such as dark mode and security preferences. It also loads Google Tag Manager, Google Analytics, and the Meta Pixel, as described in “How we share information,” which set their own cookies.
• Our mobile apps do not contain advertising or analytics tools. They send error reports to Sentry.

You can block or delete cookies in your browser settings. Our services do not currently respond to “Do Not Track” signals.

10. How we protect information

• Information is encrypted in transit.
• Sensitive content, including journal text, messages, progress notes, questionnaire answers, summaries, and AI reflections, is encrypted at the application level with keys managed in AWS Key Management Service. Other stored information, such as moods, check-in answers, entry titles, and questionnaire scores, is protected by the encryption our database applies to all stored data.
• Access is limited to personnel who need it, and Clinicians’ access to Client journal entries is logged.
• Data is stored in the United States.

No method of transmission or storage is completely secure, and we cannot guarantee security. If you believe your account has been compromised, contact us right away.

11. How long we keep information

We keep personal information for as long as your account is active and as needed to provide Acceptance Path, meet our obligations to Clinicians (including under the BAA), comply with law, resolve disputes, and enforce our agreements. Some information expires automatically: for example, Ask conversations are deleted after 14 days, and journal export links expire after 24 hours.

When a Client deletes their account, we delete their journal entries, Ask conversations, and sign-in account, and deactivate their profile. Information that forms part of a Clinician’s record of care, such as messages, questionnaire results, session summaries, and the Clinician’s notes, is kept for the Clinician and handled under our agreements with them and applicable law.

Deleted information may remain in encrypted backups, which we keep for up to seven years, until those backups expire.

12. Your choices and rights

• Clients: you can download your journal from the app and delete your account in the app’s settings. To access, correct, or restrict your health records, contact your Clinician; we will help them respond.
• Clinicians and visitors: you can update your account details in the app. To request access to, correction of, or deletion of your personal information, email support@pathwaynotes.app.
• Marketing: you can unsubscribe from marketing emails using the link in any email, and stop text messages by replying STOP.
• Notifications: you can change push notification and reminder settings in the app or on your device.

Depending on where you live, you may have additional rights under state privacy laws, such as the right to know, access, correct, delete, or get a copy of your personal information, and to opt out of targeted advertising. To make a request, email support@pathwaynotes.app. We will verify your request before acting on it. If we decline your request, you can appeal by replying to our decision and asking us to reconsider, and we will respond to your appeal in writing. We will not discriminate against you for exercising your rights.

13. Children

Acceptance Path is intended for adults. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. A Clinician may invite a minor only as described in our Terms of Service, including with the consent of a parent or legal guardian. If you believe a child under 13 has given us personal information without appropriate consent, contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will post the new version with its date, and for material changes we will notify users by email or in the app before the change takes effect.

15. Links to other websites

Our websites and app link to other websites, such as our help center. Their privacy practices are their own, and we encourage you to read their policies.

16. Contact us

Minds Awakened LLC, doing business as Acceptance Path (formerly PathwayNotes)

• Mailing address: 12807 Haynes Rd., Houston, TX 77066
• Privacy questions and requests: support@pathwaynotes.app