Privacy Policy
Effective Date: May 29, 2026 · Last Updated: May 29, 2026
Introduction
CaseConsult.ai provides AI-powered clinical consultation tools for licensed and associate-level mental health professionals and for credentialed school-based counseling professionals. We understand that you handle sensitive client and student information, and this Privacy Policy explains how we protect both your data and the privacy of the people you serve.
This policy applies to eligible professionals using CaseConsult.ai for clinical consultation and case reflection through our web application at CaseConsult.ai.
HIPAA and Business Associate Status
CaseConsult.ai is not a HIPAA Business Associate.
This Service is designed exclusively for consultation using de-identified information. We do not create, receive, maintain, or transmit Protected Health Information (PHI) as defined by HIPAA.
Why we are not a Business Associate:
- •You are expected to de-identify all client and student information before entering it into CaseConsult.ai.
- •The Service is built to be used with de-identified material; it may gently prompt you to consider de-identification, but it does not screen, filter, or block content.
- •We provide consultation to you as an individual professional, not services to your practice, school, or employer.
- •The information in our system is de-identified by design and therefore not PHI.
This is similar to:
- ✓Peer consultation groups where cases are discussed using pseudonyms
- ✓Clinical supervision sessions with de-identified cases
- ✓Professional journaling about clinical or school-counseling work
- ✓Continuing education case presentations
Your responsibility:
You remain solely responsible for ensuring all information is properly de-identified before submission. Because we do not read your conversations, we cannot detect or correct a lapse on your behalf — the responsibility to protect client and student confidentiality rests entirely with you.
If you work for a covered entity:
If you work for a hospital, clinic, group practice, school, or district, your employer may have additional requirements about using third-party tools. Check your organization's policies before using CaseConsult.ai.
Information We Collect
Information you provide directly:
- •Account information: name, professional license or credential number, license or credential type, state of licensure or credentialing, email address
- •Payment information: processed by Stripe (we do not store credit card data)
- •Consultation data: de-identified case information you enter during consultations
- •Feedback: optional feedback you provide about the Service
Automatically collected information:
- •Technical data: IP address, device type, browser type, operating system, access times
- •Usage data: session frequency, consultation topics, conversation length, feature usage
- •Analytics data: aggregated usage patterns to improve service functionality
Information we do NOT collect:
- ✕Protected Health Information (PHI)
- ✕Identifiable client or student data
- ✕Clinical records, educational records, or treatment plans for specific, identifiable individuals
How We Use Your Information
We use collected information to:
- ✓Provide AI-powered clinical consultation responses
- ✓Maintain and improve the Service's clinical relevance and accuracy
- ✓Ensure platform security and prevent unauthorized access
- ✓Support good practice by gently prompting you to consider de-identification when identifying details appear
- ✓Communicate service updates, technical issues, and policy changes
- ✓Process billing and subscription management
- ✓Analyze usage patterns to improve features (in aggregate only)
- ✓Comply with legal and professional obligations
We do NOT:
- ✕Sell your data to third parties
- ✕Use your consultation conversations to train AI models (without explicit opt-in)
- ✕Share your information for marketing purposes
- ✕Provide your data to other users
De-identification Requirements
You are responsible for de-identifying all client and student information before entering it into CaseConsult.ai.
This means removing or generalizing:
- ✕Names, initials, nicknames, or any identifying descriptions of clients, students, or others
- ✕Specific dates (birth dates, appointment dates, incident dates)
- ✕Specific addresses, phone numbers, email addresses
- ✕Medical record numbers, student ID numbers, case numbers, or file identifiers
- ✕School, workplace, or program names (if small or identifiable)
- ✕Photos, images, recordings, or videos
- ✕Any combination of details that could identify a specific person
Acceptable de-identified information:
- ✓General descriptors: "a client in her 30s"
- ✓Broad locations: "a client in Northern California"
- ✓Approximate timeframes: "recently" or "a couple of months ago"
- ✓General roles: "an elementary school teacher" or "a high-school student"
- ✓Age ranges: "a teen client" or "a middle-aged adult"
What the platform does — and does not do:
To support good practice, the Service may gently prompt you to consider de-identification when it appears that identifying details have been included. These prompts are a courtesy and a support, not a guarantee. The Service does not screen, filter, block, or guarantee the removal of identifying information. We do not and cannot verify complete de-identification. The clinical and ethical responsibility for protecting client and student confidentiality remains entirely with you.
Data Storage and Security
What we store:
- •Account information: name, email, professional license or credential number, license or credential type
- •Consultation history: de-identified case discussions and AI responses
- •Usage data: login times, session frequency, feature usage
- •Payment records: transaction history (credit card data stored by Stripe only)
What we do NOT store:
- ✕Protected Health Information (PHI)
- ✕Identifiable client or student data
- ✕Credit card numbers (handled by Stripe)
Security measures:
- Encryption in transit: TLS encryption for all data transmission
- Encryption at rest: industry-standard encryption for stored data
- Secure authentication: password-protected accounts
- Regular security monitoring and updates
Your control over data:
- ✓Delete individual conversations through the interface
- ✓Delete your entire account and all associated data
- ✓Request a copy of your data (see Your Data Rights below)
- ✓Request data portability in machine-readable format
Third-Party Services
CaseConsult.ai uses the following third-party services to operate:
Base44 Platform — Application Infrastructure
- •Purpose: application hosting, user authentication, conversation storage
- •Data shared: all account and consultation data
- •Security: enterprise-grade encryption and security measures
Anthropic (Claude API) — AI Consultation Processing
- •Purpose: generates AI consultation responses using Claude language models
- •Data shared: de-identified case queries and AI responses
- •Retention: Anthropic automatically deletes API inputs and outputs within 30 days of receipt or generation. Limited exceptions apply where Anthropic must retain content longer to enforce its Usage Policy or comply with law.
- •Training: Anthropic does not use commercial API inputs or outputs to train its models.
- •Privacy policy: anthropic.com/legal/privacy
Stripe — Payment Processing
- •Purpose: credit card processing and subscription billing
- •Data shared: billing information only (no clinical or consultation data)
- •Security: PCI-DSS compliant payment processing
- •Privacy policy: stripe.com/privacy
All service providers are required to maintain confidentiality and security standards, use data only for providing services to CaseConsult.ai, and comply with applicable data protection laws.
Data Sharing and Disclosure
We do not sell your data.
We will never sell, rent, or trade your personal information or consultation data to third parties for marketing purposes.
Limited sharing circumstances:
- Service providers — hosting, payment processing, and essential infrastructure, under strict confidentiality agreements.
- Legal compliance — when required by law, court order, subpoena, or legal process; to protect our legal rights or defend against legal claims; to prevent fraud or abuse; or to protect the safety of users or the public.
- Business transfers — in connection with a merger, acquisition, or sale of assets. You will receive advance notice and an opportunity to delete your data.
- With your consent — when you explicitly authorize us to share specific information, or for research or service improvement (only if you opt in).
- Aggregated / anonymous data — we may share aggregated, non-identifiable usage statistics. This data cannot be traced back to individual users.
AI Model Training
Your consultation data is NOT used to train underlying AI models without your explicit opt-in consent.
- Anthropic (Claude API provider) does not use commercial API data for model training.
- We do not use your conversations for training purposes.
- General usage patterns may be analyzed in aggregate form only for service improvement.
- If we ever want to use de-identified data for training, we will ask for your explicit consent.
Cookies and Tracking
Essential cookies (required):
- •Authentication and session management
- •Security and fraud prevention
- •User preference storage
- •Service functionality
Analytics cookies (optional):
- •May be used to understand usage patterns
- •Can be disabled through browser settings
No third-party advertising:
- ✕We do not use advertising cookies
- ✕We do not track you across other websites
- ✕We do not sell data to advertisers
You can control cookie settings through your browser, though disabling essential cookies may limit functionality.
Your Data Rights
You have the following rights regarding your data:
- •Access: request a copy of your personal data and consultation history
- •Correction: update or correct inaccurate information in your account
- •Deletion: request deletion of your account and all associated data
- •Portability: receive your data in a structured, machine-readable format (JSON/CSV)
- •Restriction: request limitation of data processing under certain circumstances
- •Object: object to certain types of data processing
- •Withdraw consent: withdraw previously given consent for optional data uses
To exercise your rights:
- •Email: hello@caseconsult.app
- •Subject line: "Data Rights Request"
- •Include: your name, account email, and specific request
We will respond within 30 days of receiving your request.
California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act:
- •Right to know: what personal information we collect, use, and disclose
- •Right to delete: request deletion of your personal information
- •Right to opt out: opt out of "sale" of personal information (though we do not sell data)
- •Right to non-discrimination: we will not discriminate against you for exercising your privacy rights
- •Shine the Light: request information about data shared with third parties (if any) for marketing
Contact us at hello@caseconsult.app. We will verify your identity before processing requests.
European Privacy Rights (GDPR)
If you are in the European Economic Area (EEA), UK, or Switzerland, you have rights under the General Data Protection Regulation.
Legal basis for processing:
- •Contract performance: to provide the Service you signed up for
- •Legitimate interests: to improve the Service, prevent fraud, and ensure security
- •Consent: for optional features (where we ask for consent)
Your GDPR rights:
- ✓Right to access, rectification, and erasure
- ✓Right to data portability
- ✓Right to restrict or object to processing
- ✓Right to withdraw consent
- ✓Right to lodge a complaint with your data protection authority
Data controller:
Family Matters Counseling Services
Email: hello@caseconsult.app
Professional Responsibility Reminder
CaseConsult.ai is a consultation tool, not a substitute for proper clinical supervision, peer consultation, or professional judgment.
You remain fully responsible for:
- •All clinical and professional decisions regarding your clients and students
- •Maintaining HIPAA compliance (if applicable) and professional ethical standards
- •Proper de-identification of client and student information
- •Determining when consultation is insufficient and formal supervision is needed
- •Following your licensing board's or credentialing authority's requirements
- •Maintaining your own professional liability insurance
CaseConsult.ai provides consultation to support your thinking, not directives for treatment.
Children's Privacy
CaseConsult.ai is intended only for licensed, associate-level, and credentialed professionals aged 18 and older. We do not knowingly collect information from individuals under 18.
If we become aware that we have collected personal information from someone under 18, we will delete it immediately.
International Data Transfers
Your data may be transferred to and processed in countries other than your country of residence, including the United States. We ensure adequate protection through contractual obligations with service providers, the security measures described in this policy, and compliance with applicable data protection laws.
Data Breach Notification
In the unlikely event of a data breach that affects your personal information:
- •We will notify you within 72 hours of discovering the breach
- •Notification will include what happened, what data was affected, and what we are doing about it
- •We will notify appropriate authorities as required by law
- •We will provide guidance on steps you can take to protect yourself
Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or new features.
How we will notify you:
- •Email to your registered address (for material changes)
- •Prominent notice in the Service interface
- •Updated "Last Updated" date at the top of this policy
Your options:
- •Review the updated policy before continuing to use the Service
- •Contact us with questions about changes
- •Discontinue use if you disagree with the updated terms
- •Continued use after changes constitutes acceptance
Contact Us
Privacy questions or concerns:
CaseConsult.ai / Family Matters Counseling Services
Email: hello@caseconsult.app
Compliance Acknowledgments
This Privacy Policy is designed to comply with:
- California Consumer Privacy Act (CCPA)
- General Data Protection Regulation (GDPR)
- Health Insurance Portability and Accountability Act (HIPAA) — as not applicable to de-identified data
- State privacy laws where applicable
CaseConsult.ai is a service of Family Matters Counseling Services.