1. Who We Are
AbaPeak is a web-based tool that helps Board Certified Behavior Analysts (BCBAs) and Board Certified Assistant Behavior Analysts (BCaBAs) generate structured ABA session notes in DAP format for CPT codes 97155-HN (Protocol Modification) and 97156-HN (Caregiver Training).
AbaPeak is operated by IT Integrated Solutions LLC. If you have questions about this policy, contact us at hello@abapeak.com.
2. This Service Is Not a HIPAA-Covered Entity
AbaPeak is not a HIPAA-covered entity and does not function as a Business Associate under HIPAA. AbaPeak is designed so that client identifiers are replaced with placeholders on your device before any request is transmitted to our servers, so that our servers are not intended to receive Protected Health Information (PHI) as defined by HIPAA. The on-device scrubber runs automatically, but no automated scrubber can be guaranteed to detect every possible identifier; entering real PHI is a misuse of the Service, and you remain responsible for the content you submit.
You remain responsible for how you use AbaPeak in your clinical practice and for ensuring your documentation practices comply with applicable laws, regulations, and your organization's policies.
3. What Information We Collect
a. Email address
If you join our waitlist, we collect your email address to send you product updates. Waitlist signups are routed through Formspree (see §7) to our inbox. If you purchase a subscription, Lemon Squeezy collects your email at checkout and we use it to communicate trial status, billing, and subscription details.
b. Payment information
Subscription payments are processed by Lemon Squeezy, which serves as the Merchant of Record. AbaPeak does not collect, store, or have access to your payment card details. Lemon Squeezy's privacy policy governs payment data.
c. Usage analytics
AbaPeak does not currently use third-party web analytics or advertising trackers. If we introduce a privacy-focused, cookieless analytics service in the future, we will update this policy to name it before it is enabled.
d. License key
When you enter your license key, it is stored locally on your device and sent over an encrypted (HTTPS) connection to our servers only to verify that you hold a valid license through our payment provider, Lemon Squeezy. Our servers do not retain your raw license key; for abuse-prevention logging it is recorded only in one-way hashed form.
e. Trial abuse-prevention data (free trial only)
To keep the free trial fair and prevent circumvention of trial limits, AbaPeak's trial mode processes two pieces of technical metadata:
- A device fingerprint derived from your browser's user-agent string, kept only for your current browser session and transmitted only as a one-way (SHA-256) hash.
- Your IP address, used only in hashed form.
These are used solely to enforce daily trial-note limits and prevent abuse. They are not linked to any session note content, client information, or account identity; are never used for advertising or cross-site tracking; and are not collected once you activate a paid license. This metadata is processed at our edge network purely for rate-limiting, under the same no-identifiable-PHI-logging posture as the rest of the service.
4. How AbaPeak Handles Session Data
AbaPeak's architecture is designed to minimize the clinical information that leaves your device:
- You enter session information using a client alias (e.g., "Client-07"), not a real client name or identifier.
- Before any request is transmitted, a built-in scrubber runs entirely on your device. It identifies and replaces any detected client identifiers with placeholders.
- What is transmitted to generate a note is already de-identified. Our servers and our AI provider receive only the scrubbed, placeholder-containing content — not your original input.
- Generated notes are not stored on our servers. Notes are saved only in your browser's local storage (IndexedDB) on your own device.
5. What We Do Not Collect
AbaPeak does not collect:
- Real client names, dates of birth, Social Security numbers, or other personal identifiers
- ICD-10 codes, diagnostic information, clinical notes, or session content in readable form
- Any Protected Health Information (PHI) as defined under HIPAA
- Behavioral session recordings (screen replays, heatmaps, or similar tracking tools)
6. Security
We implement reasonable technical and organizational measures to protect the information we hold about you, including encrypted transmission (HTTPS), one-way hashing of license keys in our server logs, and edge-infrastructure security via Cloudflare. No method of transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.
7. Third-Party Services
AbaPeak uses the following third-party services:
- Lemon Squeezy — payment processing and license management (Merchant of Record). Privacy Policy
- Cloudflare — web hosting, edge network, and DNS. Privacy Policy
- Anthropic — AI model provider for note generation. Receives only the scrubbed, de-identified request from your device. Privacy Policy
- Formspree — waitlist and contact form submission routing. When you join our waitlist or contact us via our support form, your email address and message are transmitted through Formspree to our inbox. Privacy Policy
8. Data Retention
We retain your email address for as long as you have an active subscription or open trial. You may request deletion at any time by emailing hello@abapeak.com and we will respond within 30 days. Generated notes and session data are stored only on your device and can be cleared from within the app at any time.
9. Your Rights
You may request access to, correction of, or deletion of any personal information we hold about you. Contact us at hello@abapeak.com. We will respond within 30 days.
10. Children's Privacy
AbaPeak is intended for licensed clinical professionals and is not designed for, marketed to, or knowingly used by individuals under 18. If you believe a minor has provided personal information through our service, contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify users who have provided their email address of material changes. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of AbaPeak after changes take effect constitutes acceptance of the updated policy.
12. Contact
Questions about this Privacy Policy? Email us at hello@abapeak.com.