Privacy policy

What we collect

From website visitors

If you fill in the contact form, we collect your name, email address, practice name, the software you use, and anything you write in the message.

We don’t use analytics or tracking cookies on this website.

From people who use the application

For practice staff who sign in: name, email address, role, sign-in activity, and a record of actions taken in the application.

Practice data

The schedules, client records, clinical documentation, rates and expenses a practice enters or imports.

Financial account data

Balances and transactions from a practice’s business bank account — only if the practice chooses to connect it through Plaid.

How we use it

To run the service a practice has signed up for, to keep accounts secure and detect misuse, and to reply to people who contact us. We don’t use it for anything else.

Bank connections and Plaid

Third & Maple uses Plaid Inc. to connect to a practice’s business bank account.

With the practice’s explicit consent, given when they connect, we collect account balances and transactions. We use them to show cash on hand and to reconcile expected costs against what actually cleared.

Third & Maple does not move money, hold funds, or process payments.

A practice can disconnect at any time from the Cash page in the application, or by emailing privacy@thirdandmaple.co.

By connecting an account, you also agree to Plaid’s handling of your data under the Plaid End User Privacy Policy.

Health information

Therapy practices record protected health information about the people they care for.

The practice is responsible for its clients’ health information. Third & Maple processes it only on the practice’s behalf, as a business associate under a Business Associate Agreement with each practice, and only to provide the service.

If you’re a patient, or a family member of one, and have questions about records, please contact the practice directly.

Children

This website and the application are not directed at children. They’re used by practice staff.

The application may hold information about minors because practices record it. That information belongs to the practice and is handled as described under health information.

Who we share it with

We never sell personal information.

We share information only with:

• Service providers that host and run the application — database hosting, application hosting, and email delivery — and Plaid. Each receives only what it needs, under agreement.
• Authorities, when the law requires it.

How long we keep it

• Account and practice data is kept for as long as the practice’s account is active.
• When a practice closes its account, we delete its data within 90 days, except where the law requires us to keep it longer.
• Health records may be kept for as long as the practice’s own legal obligations require.
• Bank connections can be removed at any time. Disconnecting stops any new data being collected.
• Deletion requests sent to privacy@thirdandmaple.co are handled within 30 days.

Security

Information is encrypted in transit, access is limited by role, multi-factor authentication is required for owner and administrator accounts, and actions in the application are logged.

Your rights

You can ask what information we hold about you, ask us to correct it, or ask us to delete it. Email privacy@thirdandmaple.co.

Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make a material change, we’ll email account holders.