Privacy Policy

1. A note on client health information

Willow is used by therapy Practices to store information about their Clients, which may include clinical/session notes and other sensitive health information. For that data, the Practice is the data controller — it decides what's collected and why, and is responsible for its own obligations under applicable health-privacy and professional-conduct laws (for example, Ontario's Personal Health Information Protection Act or an equivalent law in another jurisdiction). Sulo Systems acts as a service provider/processor on the Practice's behalf: we store and transmit this data to operate the Service, and we don't access, use, or share it except as needed to provide, secure, or support the Service, or as required by law.

2. Information we collect

• Account information: name, email, and role, for Practice staff and for Clients who use the client portal.
• Practice data: client records, appointments, session/clinical notes, forms, messages, and invoices, entered by a Practice or its Clients.
• Payment information: handled directly by our payment processor, Stripe — Sulo Systems does not receive or store full card numbers.
• Usage information: basic technical data (like log-in timestamps and error logs) used to operate and secure the Service.

3. How we use information

We use information to provide the Service (scheduling, messaging, forms, invoicing, video calls), to communicate with users about their account, to process payments, to maintain security and prevent abuse, and to comply with legal obligations. We do not sell personal information, and we do not use client health data for advertising.

4. Who we share information with

We share information with service providers who help us run Willow, under confidentiality obligations, including: Supabase (database and authentication), Vercel (hosting), Stripe (subscription billing, and — for a Practice that connects its own Stripe account — Client invoice payments made directly to that Practice), Resend (transactional email), and Daily.co (video calls for telehealth appointments, for Practices that use that feature). We may also disclose information if required by law or to protect the rights, safety, or property of Sulo Systems or others.

5. Data security

We use industry-standard measures to protect information, including encryption in transit, access controls, and database-level isolation between Practices. No system is perfectly secure, and we can't guarantee absolute security.

6. Data retention

We retain Practice and Client data for as long as the Practice's account is active, plus a reasonable period afterward, unless a Practice requests earlier deletion or longer retention is required by law or professional record-keeping obligations.

7. Your choices

Practice staff can access and update their account information directly in Willow. Clients with portal access can do the same for their own portal account. To request access to, correction of, or deletion of personal information, contact your Practice directly (as the data controller for your health information) or reach us at the email below.

8. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll provide reasonable notice (for example, by email or an in-app notice) before they take effect.

9. Contact

Questions about this policy? Reach us at sulosystems@gmail.com.