Privacy Policy

Clementine Labs, LLC ("Clementine Labs," "we," "us," or "our") operates SunnyEHR under the SunnyEHR brand. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our website, join our early-access waitlist, or use the SunnyEHR product.

Questions or requests regarding this Policy may be sent to michael@sunnyehr.com.

This Policy applies to personal information we process in connection with:

• The SunnyEHR marketing website and early-access waitlist
• Accounts and use of the SunnyEHR product by therapy practices and their authorized users
• Communications we send about early access, product updates, and related service messages

This Policy does not describe the privacy practices of your therapy practice toward its clients. Practices using SunnyEHR remain responsible for their own notices of privacy practices and client-facing disclosures.

We may collect the following categories of information:

• Account and practice information — such as name, email, practice name, role, billing details, and settings you provide when creating or administering an account.
• Client and clinical information — when a Customer uses the Service, we process information the practice submits about clients and clinical work, including protected health information ("PHI") where a Business Associate Agreement ("BAA") is in place.
• Waitlist and marketing contact information — such as email address when you request early access or otherwise contact us.
• Technical and usage information — such as IP address, browser type, device information, pages viewed, and server logs generated when you use the website or product.
• Essential cookies — such as preferences needed for site functionality (for example, light/dark color scheme). We do not use third-party advertising or analytics cookies today.

We use personal information to:

• Provide, operate, secure, and maintain the Service
• Create and administer accounts and practice workspaces
• Contact you about early access, product launch, and service-related updates
• Respond to support requests and communicate about your account
• Detect, prevent, and address fraud, abuse, and security incidents
• Comply with law and enforce our agreements
• Improve the Service through internal analysis of aggregated or de-identified data where permitted

We may send you emails about early access and product updates. You may unsubscribe from non-essential marketing emails using the link in those messages or by contacting us.

When a Customer uploads or processes PHI through SunnyEHR, we act as a business associate to the Customer under HIPAA and process PHI in accordance with an executed BAA. Customers may not submit PHI until a BAA is in place.

This Privacy Policy is not a substitute for a practice's Notice of Privacy Practices or other client-facing disclosures. Clients of a therapy practice should direct privacy questions about their clinical records to their provider.

We do not sell personal information. We may share information in the following circumstances:

• Service providers — with vendors that help us host, secure, deliver, and support the Service, including Amazon Web Services, Google Cloud, Stripe, and Stedi, subject to contractual protections appropriate to the data involved.
• At your direction — when a practice configures integrations or shares information through product features.
• Legal and safety — when required by law, legal process, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to continued protections.

We may update our subprocessors over time. Material changes will be reflected in updates to this Policy or other notice as appropriate.

Today we use only essential cookies and similar technologies needed for core site functionality, such as remembering your color-scheme preference. We do not currently use third-party advertising cookies or third-party analytics on the marketing site.

We may introduce additional analytics or similar technologies in the future to understand how the website and product are used. If we do, we will update this Policy and, where required, provide additional notice or choices.

We retain personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods may differ based on data type and Customer settings or requests.

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and at rest for sensitive data where applicable. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You may:

• Unsubscribe from marketing emails as described above
• Request access, correction, or deletion of account or waitlist information by emailing us
• Manage certain account settings directly within the product where available

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, including the right to know, delete, and correct personal information, and the right to opt out of the sale or sharing of personal information. We do not sell personal information. To exercise applicable rights, contact michael@sunnyehr.com.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the marketing site or waitlist. The product is intended for use by therapy practices in a professional context.

The Service is intended for users in the United States. If you access the Service from outside the United States, you understand that information may be processed in the United States and other locations where our service providers operate.

We may update this Privacy Policy from time to time. We will post the updated Policy and revise the effective date. If changes are material, we will provide additional notice as appropriate, such as by email or in-product message.

Continued use of the website or Service after an update means you accept the revised Policy, except where applicable law requires otherwise.

For privacy questions or requests, contact michael@sunnyehr.com.