BocaPress LLC ("we", "us") operates EMDR Assist. This policy describes how we handle personal information for therapists who use the product and for visitors to our website.
Information we collect
- Account data: email, name, password hash, billing identifiers.
- Usage data: pages visited, feature use, device and browser metadata.
- Therapist-submitted content: session notes, pseudonymous client labels, assessment scores. The product is designed so therapists do not enter Protected Health Information identifiers (names, DOB, contact info). See our security overview.
How we use it
- Operate, maintain, and improve the service.
- Authenticate users and prevent abuse.
- Send transactional and product-update email (opt out anytime).
- Provide AI-assisted summaries the therapist initiates.
Sharing
We share data only with the subprocessors on our inventory, and Business Associate Agreements are signed or in progress with every provider that handles clinical data. We do not sell personal information and we do not use therapist or client content to train third-party AI models.
Retention
- Account data: while the account is active, plus 30 days after deletion.
- Clinical content: until the therapist deletes it, plus 30-day grace period.
- Audit logs: 6 years (compliance requirement).
- Billing records: 7 years (tax requirement).
Your rights
You can export your data or request deletion from Security settings. California, EU, and UK residents have additional rights under CCPA / GDPR / UK GDPR; email privacy@emdrassist.com to exercise them.
Security
TLS 1.2+ in transit, AES-256 at rest, per-user row-level security, audit logging, optional MFA, and 60-day breach notification. Details in our security overview.
Children
The product is intended for licensed clinicians. We do not knowingly collect information from anyone under 18.
Changes
We will post material changes here and notify users by email at least 14 days before they take effect.