This page explains our role under HIPAA, how we safeguard PHI, and how responsibilities are shared with our customers. Effective Date: August 15, 2026 · Last Updated: September 28, 2026
1. About This Notice
TheraFunnel, a product of TheraFluence LLC, provides a CRM, communications, and marketing platform to behavioral health and wellness practices. Many of our customers are “covered entities” under the Health Insurance Portability and Accountability Act (HIPAA). When their use of our platform involves PHI, we act as their business associate.
2. Our Role: Business Associate
We use and disclose PHI only as needed to provide the Services to our customers, as permitted by our Business Associate Agreement (BAA), or as required by law. We do not sell PHI and do not use it for our own marketing.
3. Business Associate Agreements
We offer a BAA to every customer as part of onboarding at no additional charge, and a customer must sign it before entering PHI. Under the BAA we agree to, among other things: use appropriate safeguards; report security incidents and breaches; ensure subcontractors that handle PHI agree to the same restrictions; help customers meet certain patient-rights requests; and return or destroy PHI at the end of the relationship as the BAA provides.
4. How We Protect PHI
Our Services run in a HIPAA-enabled environment provided through our platform vendor. Safeguards include:
- Encryption of covered data types in transit and at rest;
- Role-based access controls and unique user logins;
- Audit logging of access to covered data;
- Written security policies, workforce training, and limited staff access; and
- Subcontractor agreements with vendors that handle PHI.
5. Subcontractors
We use subcontractors that may handle PHI. Our CRM platform provider handles PHI as our subcontractor, and we have a Business Associate Agreement on file with that provider. Each subcontractor that handles PHI is required to protect it under a written agreement. The Hushmail email account included with the Bundle plan is provided under a separate agreement with Hushmail, and customers must obtain a BAA for it directly from Hushmail at [email protected]. Payment data is processed by Stripe and is not PHI; we do not send PHI to our payment processor. [Confirm telephone/messaging subcontractor BAA coverage]
6. Where PHI Should and Should Not Go
Appropriate: the HIPAA-enabled features inside your secure TheraFunnel account, as configured by you.
Not appropriate unless we tell you in writing that the feature is covered:
- Our public marketing website, public forms, and demo booking;
- Social media integrations and third-party integrations you connect;
- AI features;
- Community forums and mastermind calls; and
- Support tickets and emails to our general support address.
Standard text messages to patients may not be encrypted in transit by carriers or email providers. Customers should obtain patient consent and limit PHI in those messages.
7. Shared Responsibility
| TheraFunnel is responsible for | Our customer is responsible for |
|---|---|
| Safeguarding the platform and PHI we host | Their own HIPAA compliance program, policies, risk analysis, and training |
| Signing and honoring the BAA | Providing patients a Notice of Privacy Practices |
| Subcontractor agreements and oversight | Every access grant: who receives an account, their permissions, credential and device security, and prompt removal of access (applying the minimum-necessary standard) |
| Notifying the customer of incidents | Deciding whether and how to notify patients and regulators |
| Helping with certain patient-rights requests | Responding to patient requests and patient consents |
8. Incident and Breach Notification
If we discover a security incident or breach involving a customer’s PHI, we will notify that customer without unreasonable delay and and in any event within five (5) days after our discovery of the incident, as set out in the BAA. The customer is responsible for notifying affected individuals and regulators where required.
9. If You Are a Patient or Client of One of Our Customers
We hold your information on behalf of your provider and generally cannot respond to your requests directly. Please contact your provider to access, amend, or ask questions about your information. If you contact us, we will direct your request to the appropriate customer.
10. Security and Privacy Contacts
To report a security concern or ask about this notice, contact our Security Officer, Ken Clark, at [email protected]. Please do not include PHI in your message.
11. Updates
We may update this notice as our Services or the law change. The current version will always be posted here. This page is informational and is not legal advice.