Elevate Clinicians

Elevate Clinicians ("we," "us," or "our") operates the platform located at app.elevateclinicians.com. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our platform, which connects licensed clinical supervisors with residents seeking supervision for professional licensure in the mental health field.

Elevate Clinicians is operated by AskQuala LLC on behalf of Jami Smithson.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Email address
Password (stored only in hashed form; we never have access to your plaintext password)
First and last name

1.2 Supervisor Profile Information

If you register as a clinical supervisor, we collect additional professional information that is displayed publicly on your profile:

Professional credentials and license type (LPC, LCSW, LMFT, Psychologist)
License state and license number
Professional biography
Clinical specialties
Supervision format preferences (individual, group, in-person, remote)
Practice location (city, state, zip code)
Phone number
Website URL
Profile photograph
Years of clinical experience
Supervision style description

Important: Supervisor license information, credentials, and profile details are displayed publicly on the platform to help residents find appropriate supervision. By creating a supervisor profile, you consent to this public display.

1.3 Contact Form Submissions

When you submit a contact form, we collect:

Your name
Email address
Message content

1.4 Network and Waitlist Signups

If you join our network or waitlist, we collect:

Name
Email address
Role (supervisor or resident)

1.5 Payment Information

Payment processing is handled entirely by Stripe, Inc. We do not collect, store, or have access to your full credit card number, CVV, or bank account details. We store only:

Your Stripe customer identifier (an internal reference number)
Subscription status (active, canceled, etc.)

For information on how Stripe handles your payment data, please review Stripe's Privacy Policy.

1.6 Automatically Collected Information

When you use our platform, we automatically collect:

Profile View Analytics: When a supervisor profile is viewed, we record the supervisor ID, viewer IP address (used solely for deduplication of view counts), and timestamp. We do not use IP addresses to identify individual visitors or build browsing profiles.
Authentication Tokens: Session tokens managed by Supabase Auth to keep you signed in securely.

2. How We Use Your Information

We use the information we collect for the following purposes:

Providing our service: Displaying supervisor profiles to residents seeking supervision, facilitating connections between supervisors and residents, and managing your account.
Processing payments: Managing subscriptions for supervisor listings through Stripe.
Communications: Sending transactional emails (account verification, password resets, subscription confirmations) and responding to contact form inquiries.
Platform improvement: Using aggregated, non-identifying profile view data to understand platform usage patterns and improve the user experience.
Security: Detecting and preventing fraud, abuse, or unauthorized access to accounts.
Legal compliance: Meeting our obligations under applicable laws and regulations.

3. Legal Basis for Processing

We process your personal information based on the following legal grounds:

Contract performance: Processing necessary to provide our platform services, manage your account, and fulfill subscription agreements.
Consent: Where you have voluntarily provided information (such as creating a public supervisor profile or submitting a contact form).
Legitimate interests: Improving platform functionality, preventing fraud, and ensuring platform security, where these interests are not overridden by your rights.
Legal obligation: Where processing is required to comply with applicable laws.

4. How We Share Your Information

4.1 Public Display

Supervisor profile information (as described in Section 1.2) is displayed publicly on the platform. This is the core function of our service — helping residents find and evaluate potential clinical supervisors.

4.2 Third-Party Service Providers

We share personal information with the following service providers who process data on our behalf:

Supabase, Inc. — Database hosting, user authentication, and file storage (profile photos). Data is stored on servers located in the United States.
Stripe, Inc. — Payment processing for supervisor subscriptions. Stripe receives only the information necessary to process payments.
Resend — Transactional email delivery (account verification, password resets, notifications). Resend receives your email address and name for message delivery.
Vercel, Inc. — Application hosting. Vercel processes requests to serve our platform but does not store personal data independently.
Cloudflare, Inc. — DNS resolution and network security. Cloudflare may process IP addresses in the course of routing traffic to our platform.

4.3 We Do Not Sell Your Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We do not share your information with data brokers. We have not sold personal information in the preceding twelve months.

4.4 Legal Requirements

We may disclose your information if required to do so by law, or if we believe in good faith that such disclosure is necessary to:

Comply with a legal obligation, subpoena, or court order
Protect and defend our rights or property
Prevent fraud or abuse of our platform
Protect the personal safety of users or the public

5. Data Retention

Active accounts: We retain your account information and profile data for as long as your account remains active.
Closed accounts: Upon account deletion, we remove your personal information within 30 days. Certain data may be retained longer if required for legal compliance (such as payment transaction records for tax purposes, retained for up to 7 years).
Contact form submissions: Retained for up to 2 years, then deleted.
Waitlist and network signups: Retained until you unsubscribe or request deletion.
Profile view analytics: IP addresses used for deduplication are retained for no more than 90 days. Aggregated view counts (without IP addresses) are retained indefinitely.
Payment records: Stripe customer IDs and subscription status records are retained for 7 years after the last transaction for tax and accounting compliance.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

All data transmission is encrypted using TLS/SSL (HTTPS)
Passwords are cryptographically hashed — we never store plaintext passwords
Authentication is managed through Supabase Auth with secure session token handling
Database access is restricted through row-level security policies
Payment information is handled exclusively by PCI-DSS Level 1 certified Stripe
File uploads (profile photos) are stored in access-controlled storage buckets
Administrative access to production systems is limited to authorized personnel

While we take reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Your Rights and Choices

7.1 All Users

Regardless of your location, you have the right to:

Access your personal information by logging into your account
Update or correct your profile information at any time
Delete your account and associated personal data
Opt out of non-essential communications

7.2 Virginia Residents (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act provides you with the following rights:

Right to access: Confirm whether we are processing your personal data and access that data.
Right to correct: Correct inaccuracies in your personal data.
Right to delete: Request deletion of your personal data.
Right to data portability: Obtain a copy of your personal data in a portable, readily usable format.
Right to opt out: Opt out of the processing of personal data for targeted advertising, sale of personal data, or profiling.

We do not engage in targeted advertising, sell personal data, or conduct profiling that produces legal or similarly significant effects. You may exercise your other rights by contacting us at info@elevateclinicians.com. We will respond within 45 days. If we deny your request, you may appeal by contacting us with the subject line "VCDPA Appeal."

7.3 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) provides you with the following rights:

Right to know: Request information about the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the third parties with whom we share it.
Right to delete: Request deletion of your personal information, subject to certain exceptions.
Right to correct: Request correction of inaccurate personal information.
Right to opt out of sale or sharing: We do not sell or share your personal information for cross-context behavioral advertising.
Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of information collected in the preceding 12 months:

Identifiers (name, email address, IP address)
Professional or employment-related information (license credentials, specialties)
Internet or network activity (profile view analytics)
Commercial information (subscription status)

To exercise your rights, contact us at info@elevateclinicians.com. We will verify your identity before processing your request and respond within 45 days.

7.4 Exercising Your Rights

To submit a privacy rights request:

Email: info@elevateclinicians.com

We will acknowledge receipt of your request within 10 business days and fulfill verified requests within 45 days. If additional time is needed, we will notify you of the extension and the reason.

8. Cookies and Tracking Technologies

Our platform uses the following cookies and similar technologies:

Essential/Authentication cookies: Session tokens set by Supabase Auth that keep you logged in. These are strictly necessary for platform functionality and cannot be disabled.
Security cookies: Cloudflare may set cookies for bot detection and DDoS protection purposes.

We do not use advertising cookies, social media tracking pixels, or third-party analytics cookies. We do not participate in cross-site tracking or behavioral advertising.

9. Children's Privacy (COPPA)

Elevate Clinicians is designed for licensed mental health professionals and residents pursuing licensure. Our platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 13 (or under 16 in certain jurisdictions).

If we learn that we have collected personal information from a child under 13, we will take immediate steps to delete that information. If you believe a child under 13 has provided us with personal information, please contact us at info@elevateclinicians.com.

10. Health Information and HIPAA

Elevate Clinicians is a professional directory and marketplace platform. We are not a telehealth provider, electronic health records system, or healthcare delivery platform. We do not collect, store, or process protected health information (PHI) as defined under HIPAA.

The information on our platform pertains to supervisors' professional credentials and supervision offerings — not to patient care, diagnoses, treatment plans, or therapy sessions. While HIPAA does not directly apply to our platform, we are committed to maintaining high standards of data protection appropriate for the mental health professional community we serve.

11. Data Storage and Transfers

All personal data is stored on servers located in the United States. Our service providers (Supabase, Stripe, Resend, Vercel, Cloudflare) maintain their primary infrastructure in the United States.

If you access our platform from outside the United States, your information will be transferred to and processed in the United States. By using our platform, you consent to this transfer. We ensure that our service providers maintain appropriate data protection standards.

12. Third-Party Links

Supervisor profiles may include links to external websites (such as a supervisor's practice website). We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party websites you visit through links on our platform.

13. Account Deletion

You may delete your account at any time. Upon account deletion:

Your profile will be immediately removed from public display
Your personal data will be deleted from our systems within 30 days
Profile photographs will be removed from file storage
Aggregated, non-identifying analytics (such as total view counts) may be retained
Payment transaction records required for tax compliance will be retained as described in Section 5

To request account deletion, you may use the account settings within the platform or contact us at info@elevateclinicians.com.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

We will update the "Last Updated" date at the top of this policy
We will notify registered users by email of material changes
We will provide at least 30 days' notice before material changes take effect

Your continued use of the platform after the effective date of changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:

Email: info@elevateclinicians.com

For Virginia residents: If you are not satisfied with our response to your privacy request, you may contact the Virginia Attorney General's office at www.oag.state.va.us.

For California residents: If you are not satisfied with our response, you may contact the California Attorney General's office at oag.ca.gov/privacy.