Privacy Policy
MySBT LLC ("MySBT," "we," "us") builds software for behavior analysts. This policy explains what information we collect through mysbtapp.com and through the MySBT application, how we use it, and the choices you have.
This policy covers two very different categories of information, and the distinction matters:
- Information about you, our user or visitor — your name, your work email, how you use our site and app. This policy governs it directly.
- Information you enter about the people you serve — clinical records about your clients or students. We hold this on your organization's behalf, under your organization's direction and under a separate written agreement with your organization, which governs it. Your organization's own privacy notices govern its use.
Who we are
MySBT LLC, a Massachusetts limited liability company, 82 Wendell Ave, Suite 100, Pittsfield, MA 01201. Privacy questions: privacy@mysbtapp.com.
Information we collect
Information you give us. When you contact us or request beta access, we collect your name, organization, role, email address, and whatever you write in the message. When your organization sets up MySBT accounts, we collect account details for each user: name, email, role, and organizational affiliation.
Information collected automatically on our website. Our infrastructure providers generate standard server and security logs recording IP address, browser type, pages requested, and referring page. We use these for security, abuse prevention, and diagnosing site problems.
We do not run analytics software on this site. We do not use advertising trackers, cross-site tracking technologies, or third-party marketing pixels.
Information collected in the app. We collect device type, operating system version, app version, crash reports, and diagnostic logs. We collect usage events describing which parts of the app are used and when, so we can understand where the product is working and where it isn't.
Information we do not collect. We do not collect precise location. We do not access your contacts, photos, microphone, or camera except where you explicitly initiate a feature that requires it. We do not purchase personal information from data brokers.
Client and student records
When you use MySBT to record clinical data, you are entering information about people you serve. We process that information solely to provide the service to your organization, under the terms of our written agreement with your organization.
Specifically, we do not:
- Sell it, or share it for anyone else's marketing purposes
- Use it for advertising
- Use it to train machine learning or artificial intelligence models
- Access it except as necessary to operate the service, resolve a support request you've raised, or comply with law
- Disclose it to third parties other than the service providers described in §6, each selected on the condition that they not use it for their own purposes
Where your organization is a HIPAA covered entity, we will enter into a Business Associate Agreement governing our handling of protected health information. Where you are a school or educational agency subject to FERPA, we operate under a written agreement with your organization designating us as a school official with a legitimate educational interest, and we do not use education records for any other purpose.
Your organization controls this data. Requests from individuals — access, correction, deletion — should go to the organization that entered the record. We will support your organization in responding.
How we use information
- To provide, maintain, and secure the MySBT application
- To respond to your inquiries and support requests
- To administer the beta program and gather feedback
- To diagnose crashes and fix defects
- To understand aggregate usage patterns and improve the product
- To send service communications about availability, changes, and security
- To comply with legal obligations and enforce our Terms
We do not use your information for automated decision-making that produces legal or similarly significant effects.
Marketing communications
If you request early access or contact us, we may email you about the beta program and about MySBT's availability. Every such email includes an unsubscribe link. Service and security communications are not optional while you hold an account.
Service providers
We rely on a small number of third parties to operate our business. They fall into these categories:
- Cloud infrastructure and hosting, including Amazon Web Services and Cloudflare
- Email delivery and business communications
- Error monitoring and diagnostics
- Professional services, such as legal and accounting advisors, bound by professional confidentiality obligations
We select providers on the condition that they use information only to provide services to us, and not for their own purposes.
For a current list of the specific providers we use, including any that process client or student records, email privacy@mysbtapp.com and we will provide it. Organizations under a Business Associate Agreement or a school data-sharing agreement receive this list as part of that agreement, along with advance notice of changes.
We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under US state privacy laws.
We may disclose information if required by law, subpoena, or valid legal process, or where necessary to protect the rights, safety, or property of MySBT, our users, or the public. Where we are permitted to notify you, we will.
If MySBT is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.
Data retention
We keep information only for as long as reasonably necessary for the purposes described in this policy, and no longer. Account information is kept for as long as your organization maintains an account, and for a reasonable period afterward to meet legal and operational obligations. Clinical records are retained according to your organization's agreement with us and its own retention obligations, which are often lengthy for records concerning minors; on termination, we return or delete data as that agreement provides. For our current retention schedules for a specific category of record, email privacy@mysbtapp.com.
Security
We use encryption in transit and at rest, access controls limiting staff access to what their role requires, audit logging, and regular review of our security practices. No system is perfectly secure, and we don't claim otherwise. If a breach affects your information, we will notify you and any required authorities as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, to opt out of sale or sharing (we do neither), and to be free from discrimination for exercising these rights. Residents of US states with comprehensive privacy laws have rights under those statutes.
To exercise any of these rights, email privacy@mysbtapp.com. We will verify your identity before acting and respond within the time the applicable law allows. You may appeal a denial by replying to our response.
If you want more detail than this policy gives — the specific providers who process your information, our retention periods for a particular category of record, or how a specific requirement applies to your organization — email privacy@mysbtapp.com and ask. We would rather answer a direct question than publish a document nobody finishes reading.
Again: for records about the people you serve, direct the request to the organization that entered them.
Children
Our website and our marketing are directed to professionals, not to children, and we do not knowingly collect personal information directly from children through them.
Our application is used by clinicians and educators to record information about people they serve, who are frequently minors. That information reaches us only through a professional user acting for an organization, under that organization's authority and its own consent practices. We handle it as described in §3.
Cookies
This site uses only cookies strictly necessary for it to function and to protect against abuse, including security cookies set by our infrastructure providers. We do not use analytics cookies, advertising cookies, or any cookie that tracks you across other websites.
You can block cookies in your browser. Strictly necessary cookies are required for parts of the site to work.
If we ever introduce analytics or other non-essential cookies, we will update this section and seek consent where the law requires it.
International
We operate in the United States and store information there. If you access MySBT from elsewhere, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.
Changes
We may update this policy. Material changes will be announced by email to account holders and by a notice on this page at least thirty days before taking effect. The effective date above always reflects the current version.