Passalong Privacy Policy

Effective date: July 10, 2026 · Last updated: July 10, 2026

Passalong ("we," "us") provides a closed communication and workflow app for ABA therapy clinics, their staff, and the parents/guardians of the children they serve. This policy explains what we collect, why, and your choices. Passalong is intended for use by adults (clinic staff and parents/guardians). Children do not create accounts or use the app.

Information we collect

• Account information: your name, email address, role, and clinic, provided by your clinic administrator when your account is created.
• Content you or your clinic create: messages, clinic announcements, session notes (which may include health-related information about a learner, such as mood, food intake, and therapy targets), and photos you choose to upload. Location metadata is removed from photos before upload.
• Learner records: a learner's name, photo, and care-team/parent assignments, entered by clinic administrators.
• Technical records: account identifiers, a device token for push notifications, and security audit logs of sign-ins and data access, kept for safety and legal compliance.

What we do NOT do

• No advertising, no sale or sharing of personal data with data brokers, ever.
• No tracking across other companies' apps or websites.
• No third-party analytics or crash-reporting inside the app.
• Push notifications never include names, message text, or health information.

How we use information

Solely to operate Passalong: deliver messages, notes, announcements, and photos to the right people; enforce role-based access (each user sees only their own clinic and assigned learners); secure and audit the service; and comply with legal obligations, including health-records laws.

Service providers

We process data on secured infrastructure provided by Amazon Web Services (hosting, authentication, email delivery) and deliver push notifications via Apple. These providers process data only on our behalf.

Retention and deletion

Clinical and session records may be retained where required by law or by your clinic's records-retention policy. To request deletion or deactivation of your account, use Profile → Request Account Deletion in the app or email support@passalong.io. We respond within 30 days. Personal data not subject to retention obligations is deleted; records under retention are deactivated and access-restricted until their retention period ends.

Security

Data is encrypted in transit (TLS) and at rest, access is enforced with role-based, row-level security, and security-relevant actions are audit-logged.

Your choices

• Manage notification permissions in iOS Settings.
• Request access, correction, deletion, or deactivation at support@passalong.io.
• Parents/guardians: questions about your child's records can also be directed to your clinic.

Contact

Passalong · support@passalong.io · passalong.io/support