Privacy Notice

Scope and initial availability

This Privacy Notice explains how Somatic Compass LLC collects, uses, discloses, and retains information through the Somatic Compass website and application. Clinician accounts and paid access are initially offered only in the United States. A treating clinician may display a therapist-controlled remote BLS session to an adult or minor client; the invited client does not create a Somatic Compass account and cannot control the session.

Information we collect

We collect clinician account information such as name, email, password-verification data, professional role, licensure jurisdiction, and EMDR-training status. We also maintain account-creation and trial dates, entitlement and subscription status, subscription source, billing-period and cancellation status, and versioned records of legal and professional-eligibility acceptance. Passwords are not stored in readable form.

If you submit product feedback, a safety report, support request, privacy request, or billing question, we collect the information you choose to provide, contact preference, relevant product version, and limited technical information such as page, device type, operating system, browser, and screen size. Do not include client names, initials, exact dates, quotations, distinctive narratives, or other client-identifying information. Hosting and security providers may process ordinary request information such as IP address, timestamps, browser or device information, requested page, and security or diagnostic events.

Temporary Somatic Reflection content and exports

Embedded Somatic Reflection uses clinician-selected body areas, cue labels, and processing context to display curated, prewritten educational ideas and sources. The clinical-reflection workspace is designed to remain in the current browser tab’s memory and to clear on refresh, when the session is ended, or after four hours of inactivity. Reflection text, selected cues, possible explanations, and support choices are not intended to be submitted with account registration, product analytics, or feedback.

Generative AI Reflection is not part of the initial commercial service and is disabled. If that functionality is considered later, it will undergo separate legal, clinical, privacy, vendor, and consent review before activation, and this Notice will be updated before information is sent to an AI provider.

If you copy, print, download, screenshot, save, or otherwise export Reflection content, the resulting copy leaves the temporary workspace and is outside our control. An export is not automatically a complete clinical record. The clinician is responsible for reviewing, securing, storing, disclosing, and deleting it in accordance with applicable law, ethics, informed consent, and workplace policy.

Somatic Pulse and therapist-controlled remote sessions

Somatic Pulse settings—including the selected Living Form or Light Bar, movement, speed, width, size, color, background, audio choice, and volume—are ordinarily handled in the therapist’s browser. When a therapist creates a remote session, Somatic Compass generates a random temporary session code and therapist-control credential and stores the permitted BLS settings and session status so the presentation can be synchronized to the invited client’s browser. The therapist controls the session. The client link does not provide therapist controls, an account, clinical notes, or access to Somatic Reflection.

The remote-session service necessarily processes requests from the therapist’s and invited participant’s browsers. Depending on hosting and security configuration, those requests may include the temporary session identifier, IP address, timestamp, browser or device information, requested endpoint, BLS control settings, connection status, and security or diagnostic metadata. The session record is designed to expire within four hours and can be ended earlier by the therapist. The session is not designed to contain names, contact information, diagnosis, target material, clinical notes, video, microphone input, or recordings.

Before sharing a client link, the therapist is responsible for determining that remote BLS is appropriate; providing any notice and obtaining any informed consent, assent, or parent or guardian authorization required for the client; sharing the link only with the intended participant; and avoiding client-identifying information in the link or session.

Browser storage and cookies

The Service uses browser storage and security cookies or tokens to remember account access, preferences, usage counters, analytics choice, and agreement status on a device. Clearing browser data may remove local settings or access from that device, but it does not restart a server-recorded trial, cancel a subscription, or necessarily delete the underlying account.

Optional product analytics

Limited product analytics begin only after you select “Allow limited analytics.” When allowed, we record a defined set of events, such as opening a public page, starting or completing a Reflection pathway, returning in another browser session, or submitting product feedback. Events use randomly generated browser and session identifiers that are hashed before database storage. These identifiers are pseudonymous rather than anonymous and may be associated with a registered clinician account.

Analytics are designed not to collect Reflection text, selected cues, clinical possibilities, support choices, exports, free-text clinical material, client information, precise location, advertising identifiers, or cross-app activity. We do not use session replay, keystroke capture, advertising pixels, or cross-site behavioral tracking. We do not sell personal information or share it for cross-context behavioral advertising.

You can decline analytics without losing access. You may change your choice through Privacy & Account. Turning analytics off stops future journey-event transmission from that browser and requests deletion of journey events associated with that browser’s identifier from the active analytics database.

How we use information

We use information to create and secure clinician accounts; administer trials and subscriptions; verify entitlement; synchronize therapist-controlled remote sessions; provide support; maintain safety and security; evaluate nonclinical product usage when permitted; review product feedback; improve the Service; communicate service, legal, billing, or security notices; enforce our agreements; and comply with law. We do not use temporary clinical-reflection content for advertising, profiling, or model training.

Service providers and disclosures

Somatic Compass uses OpenAI Sites infrastructure and Cloudflare services for hosting, database storage, request processing, and security. Square is the planned processor for website subscription payments; Somatic Compass does not need to receive complete payment-card numbers when payment is collected through Square. Additional email, support, security, legal, accounting, and insurance providers may process only the information reasonably necessary for their services.

We may disclose information when reasonably necessary to provide or secure the Service, comply with law or legal process, protect rights or safety, investigate misuse, complete a business transaction or reorganization, or respond to a valid user request. We do not sell personal information or use personal information for targeted advertising.

Retention and account deletion

Temporary remote-session records are designed to expire within four hours. Journey events may be retained for up to 13 months. Product feedback may be retained for up to 24 months after final activity. Routine support communications are ordinarily retained only as long as reasonably needed to resolve the request. Active account information is retained while the account exists. After account deletion, Somatic Compass may retain the minimum records reasonably necessary for legal acceptance, completed transactions and tax obligations, fraud and security prevention, dispute resolution, insurance matters, or a legal hold.

Account deletion removes the active account and linked ordinary account information from active Somatic Compass systems. Information in backups is removed through ordinary secure backup rotation rather than necessarily disappearing immediately. Information processed by a service provider may be subject to that provider’s applicable deletion and retention process. Aggregate or irreversibly de-identified statistics may be retained. Deleting an account does not itself cancel a subscription; cancellation must be completed separately through the applicable payment-management method.

Information submitted contrary to our instructions

If we learn that PHI or client-identifying information was submitted, we may restrict access to it, stop unnecessary transmission, investigate the systems involved, contact the submitting clinician, remove or securely return the information when appropriate, assess applicable notification duties, correct the cause, and retain only the limited incident record reasonably necessary to document the response. Users should report suspected improper submission promptly to kat@somaticcompass.app.

Your privacy choices and requests

Through Privacy & Account, you may allow or decline analytics, clear browser-held Somatic Compass data, or request deletion of an account. Subject to applicable law and appropriate identity verification, you may also request access, correction, or deletion; withdraw consent where processing depends on consent; or ask how we handled a request. You may use an authorized agent where applicable law permits and we can verify the authorization.

We will not discriminate against you for exercising an applicable privacy right. If we deny a request, you may reply to the decision and ask us to reconsider it. Rights and response periods vary by state. Send requests to kat@somaticcompass.app.

Security

No system is perfectly secure. We use access restrictions and platform security controls intended to protect information appropriate to the Service. You are responsible for protecting your device, credentials, and client-session links and for avoiding client-identifying information.

Children and remote-session links

Clinician accounts are not available to people under 18, and Somatic Compass is not offered directly to children for self-directed use. For the initial launch, remote Somatic Pulse links may be sent only to adults age 18 or older and may not be used with minors. This restriction does not prohibit a clinician from displaying therapist-controlled BLS from the clinician’s own screen when otherwise lawful and clinically appropriate. An invited adult participant does not create an account, submit clinical information, or control the session through the client link. Somatic Compass does not intentionally request the participant’s name, age, contact information, diagnosis, or treatment content through the client link.

Changes and contact

We may update this Notice as the Service or applicable requirements change. We will update the effective date and provide notice or request renewed acceptance when appropriate.