Privacy Policy

Continuva provides technology services to licensed mental health professionals and practices (“Providers”). When Continuva creates, receives, maintains, or transmits protected health information on behalf of a Provider, Continuva acts as the Provider’s business associate under HIPAA and processes that information under a Business Associate Agreement.

Continuva is not a healthcare provider and does not provide therapy, psychotherapy, counseling, diagnosis, treatment, crisis support, clinical monitoring, emergency services, or medical or mental health advice. Your care relationship is with your Provider.

Depending on how the Platform is used, Continuva may collect or process: (a) account and contact information, such as name, email address, telephone number, login credentials, and user role; (b) Provider information, such as practice information, licensure information, administrative settings, billing information, and support requests; (c) patient information provided by or on behalf of a Provider, including information discussed during sessions, documentation, transcripts, summaries, messages, forms, and related care or administrative information; (d) audio, text, or other information processed for transcription, AI-assisted scribing, summarization, documentation, or communication support; (e) technical information, such as device information, IP address, browser type, access logs, audit logs, and usage data; and (f) de-identified, aggregated, or statistical information.

Continuva uses information to provide, operate, maintain, secure, and improve the Platform; support Provider documentation, transcription, AI-assisted scribing, summarization, scheduling, billing support, coding support, and patient communication support; authenticate users; provide technical support; maintain audit logs; detect and prevent misuse; comply with legal obligations; and perform analytics, security, and service improvement activities permitted by applicable law and applicable agreements.

The Platform may use artificial intelligence technologies to assist Providers with transcription, scribing, summarization, organization of information, documentation support, and patient communication support. AI-assisted outputs may be incomplete or inaccurate and are intended to support Provider review and professional judgment.

Continuva will not use identifiable patient information to train, fine-tune, validate, benchmark, or improve generalized artificial intelligence models or third-party artificial intelligence models unless expressly authorized in writing by the Provider and permitted by applicable law. Continuva may use de-identified or aggregated information for internal analytics, security, system performance, and Platform improvement in accordance with applicable law.

Continuva may disclose information: (a) to the Provider and the Provider’s authorized users; (b) to service providers, subcontractors, hosting providers, AI vendors, transcription vendors, analytics providers, support providers, and other vendors that help us provide the Platform and are subject to appropriate contractual obligations; (c) as required by law, court order, subpoena, government request, or legal process; (d) to protect rights, safety, security, or the operation of the Platform; (e) in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to applicable confidentiality and privacy obligations; and (f) as otherwise directed or authorized by the Provider or permitted by law.

Continuva does not sell identifiable patient health information or use identifiable patient health information for unrelated commercial purposes.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties or affiliates for marketing or promotional purposes. See Section 14.

For protected health information processed on behalf of a Provider, your HIPAA rights are generally exercised through your Provider. These may include rights to access, amend, or request an accounting of certain disclosures of protected health information, subject to applicable law. Questions regarding your medical records, treatment information, or HIPAA rights should be directed to your Provider. This Policy is not a HIPAA Notice of Privacy Practices for your Provider and does not replace your Provider’s Notice of Privacy Practices.

Continuva may use cookies, log files, analytics tools, and similar technologies to operate the Platform, authenticate users, maintain security, understand usage, troubleshoot performance, and improve functionality. Where required by law, Continuva will provide additional notices or choices regarding these technologies. Continuva does not knowingly use tracking technologies in a manner that discloses PHI to third parties unless permitted by applicable law and applicable agreements.

The Platform may be used in connection with minor patients only as directed by a Provider and with consent or authorization determined by the Provider under applicable law. Laws governing minor consent, confidentiality, and parent or guardian access vary. Providers are responsible for determining who may consent and what information may be shared with a parent, guardian, minor patient, or other authorized representative.

Continuva uses administrative, technical, and physical safeguards designed to protect information processed through the Platform. No system can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their login credentials and promptly reporting suspected unauthorized access.

Continuva retains information for as long as necessary to provide the Platform, comply with legal obligations, resolve disputes, enforce agreements, maintain audit logs, support security, or as directed by the Provider. Return, deletion, or retention of protected health information after termination of services is governed by the applicable BAA and agreements with the Provider.

Depending on where you live and the nature of the information, you may have additional privacy rights under state law. Continuva will honor applicable rights as required by law. For protected health information processed on behalf of a Provider, requests should generally be directed to the Provider.

The Platform is intended for use in the United States. If you access the Platform from outside the United States, you understand that information may be processed in the United States, where privacy laws may differ from those in your jurisdiction.

Continuva may update this Policy from time to time. The updated Policy will be posted or made available through the Platform. The effective date above indicates when this Policy was last updated.

If you provide a mobile phone number through the Platform, Continuva may use it to send you text (SMS) messages that you have opted in to receive: clinical safety alerts about your clients (Continuva Provider Alerts) and one-time verification codes for account security. Message frequency varies. Message and data rates may apply.

We collect your mobile phone number and your SMS consent, including the date and time you opted in, solely to deliver these messages, to verify your identity, and to maintain records of your consent as required by law and by wireless carrier rules.

We do not share, sell, rent, or provide your mobile phone number or your SMS opt-in consent data to third parties or affiliates for marketing or promotional purposes. Mobile information is disclosed only to the service providers that deliver messages on our behalf, and only for that purpose.

You may opt out at any time by replying STOP to any message or by removing your phone number in your account settings. Reply HELP to any message for assistance, or contact us at support@continuva.com.

Questions about your care, clinical information, medical records, or HIPAA rights should be directed to your Provider. Questions about this Policy or Continuva’s Platform privacy practices may be directed to Continuva at: support@continuva.com