CodaPath Privacy Policy

Effective date: September 16, 2026

This Privacy Policy includes CodaPath's Washington Consumer Health Data Privacy Notice. It explains how CodaPath LLC ("CodaPath," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information through codapath.net, our public marketing website, the authenticated clinician application, client-portal functions, and related communications and support (collectively, the "Service").

This policy should be read with the CodaPath Clinician Terms of Service and any separate Client Portal Terms. It does not replace any privacy notice or consent that a clinician, clinic, school, employer, or other organization is independently required to provide.

1. Scope and our privacy roles

This policy applies to individual clinician subscribers, website visitors, adults who access the client portal, and people who contact CodaPath. The individual subscription is intended for clinicians, not for independent use by children. Organization use is governed by a separate written license and may be subject to additional privacy terms.

CodaPath determines how clinician account, billing, website, support, and security information is handled for its own business purposes. For coded client information entered by a clinician, the clinician generally selects the information and directs its use through the Service, and CodaPath processes it to provide the requested functionality. Our legal role may vary by data, relationship, and applicable law.

CodaPath is not a healthcare provider and the individual subscription is not an electronic health record. It is designed for coded, non-identifying information and is not intended or authorized to receive protected health information ("PHI"). CodaPath does not enter into a HIPAA business associate agreement for individual subscriptions. This policy is not a HIPAA Notice of Privacy Practices.

2. Information we collect

We collect information according to how a person uses the Service. The principal categories, examples, and purposes are listed below.

3. Client information the Service is designed not to collect

CodaPath does not request or provide fields for client names, initials, schools, email addresses, dates of birth, street addresses, telephone numbers, diagnoses, medical-record numbers, health-plan numbers, or a key that maps a client code to a person. CodaPath does not store clinician narrative journal notes. The Service uses structured fields and technical controls designed to prevent prohibited identifiable information from being submitted or uploaded.

A random client code is not derived from client information. Any external mapping between a client code and a person must remain outside CodaPath and under the clinician's control. Users must not place identifying information in goals, titles, filenames, metadata, screenshots, support messages, or other fields.

The Service stores session dates. Users must not combine a date with information that identifies or reasonably permits identification of a client. Whether information is personal information, consumer health data, PHI, or deidentified is determined by applicable law and the surrounding facts, not by this policy alone.

4. Sources of information

We collect information directly from clinician subscribers and people who contact CodaPath; from a clinician's use of the Service, including structured entries, configuration choices, exports, and content authorized for the client portal; from adult client-portal visitors when they enter a client code and use the portal; automatically from browsers, devices, cookies, servers, and security systems; from payment, authentication, hosting, email, support, and other service providers acting for CodaPath; and from an employer or organization when it lawfully provides account or licensing information under a separate written arrangement.

5. How we use information

We use information to provide, personalize, maintain, secure, and support the Service and requested features; create accounts and authenticate users; manage subscriptions and payments; provide service communications; generate clinician-requested tracking views, progress displays, exports, approved summaries, and portal materials; protect accounts, client codes, systems, and users; investigate errors, misuse, and security events; enforce our Terms; respond to questions and complaints; comply with law and valid legal process; and improve reliability, accessibility, performance, and features as permitted by law.

We may send promotional communications where permitted and according to the recipient's choices. Each promotional email includes an unsubscribe method. Account, billing, security, and other service messages are not promotional.

CodaPath does not use identifiable Subscriber Content or coded client data to train public or third-party artificial-intelligence models. No AI feature or vendor processes Service data.

6. How we disclose information

We disclose information to service providers that host or store the application, authenticate users, process payments, deliver email, monitor errors, provide support, secure systems, or perform other functions for CodaPath. They may process information only to perform contracted services and as permitted by law.

We may also disclose information at a clinician's direction, including to an adult given a client code or through an export; to government agencies, courts, advisers, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or establish or defend legal claims; to participants and advisers in a potential or actual financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable restrictions; and with valid permission or other lawful authorization.

The public marketing website uses Wix.com Ltd. and relevant Wix entities for website hosting and related website services. Stripe, Inc. and relevant Stripe entities process clinician billing and transaction data and do not receive coded client tracking data for payment processing. CodaPath also uses application hosting, database, authentication, transactional-email, and security service providers to operate the authenticated Service. Current provider information relevant to a privacy request is available by contacting CodaPath at lcross@codapath.org.

CodaPath does not sell personal information or consumer health data. CodaPath does not share personal information for cross-context behavioral advertising, use coded client data for targeted advertising, or allow advertising networks to collect data in authenticated areas. CodaPath does not use identifiable Subscriber Content or coded client data to train public or third-party AI models.

7. Cookies and online tracking

The public marketing website is hosted on Wix. Wix may use cookies and similar technology to provide the site, maintain security, remember choices, process forms, and provide basic site measurement. The authenticated CodaPath application is hosted separately from Wix.

CodaPath does not use advertising pixels or session-replay tools in authenticated areas. The authenticated Service may use essential cookies, authentication data, and operational logs necessary to provide, secure, debug, and improve the Service.

You can adjust browser settings and, where available, use the cookie controls displayed on the public website. Blocking essential cookies may prevent parts of the Service from working.

Some browsers offer a Do Not Track signal. Because there is no uniform industry response, the Service does not separately respond to that signal. CodaPath honors legally required opt-out preference signals, including Global Privacy Control, where they apply. Because CodaPath does not sell personal information or use it for cross-context behavioral advertising, such a signal generally does not change those practices.

8. Coded client data and HIPAA

The individual CodaPath Service is designed for coded information and is not intended or authorized to receive PHI. It does not collect the client identifiers listed in Section 3, a re-identification key, diagnoses, or narrative clinical notes. The Service's acceptance of structured data or session dates is not a representation that a clinician's particular use satisfies a HIPAA deidentification method or an employer's policies.

A clinician remains responsible for deciding whether information may lawfully be entered, maintaining any external mapping separately, obtaining required permissions, and keeping any official medical, educational, or employment record in the required system. If a user believes prohibited information was submitted, the user should use the available removal feature and contact lcross@codapath.org without repeating the prohibited information in the message.

9. Washington Consumer Health Data Privacy Notice

This section provides the disclosures required by Washington's My Health My Data Act when the Act applies. To be conservative, CodaPath treats coded client tracking data as consumer health data if it is linked or reasonably linkable to a consumer under applicable law. Information that meets a statutory deidentification standard may fall outside that definition.

Consumer health data may include structured speech-language goals, therapy or intervention categories, tracking selections, materials selected, approved summaries, structured performance entries, counts, percentages, levels, observations selected from permitted fields, trends, visualizations, session dates, activity associated with clinician-approved sharing, and the random client code and clinician-approved content available through it. CodaPath may generate progress trends or summaries from permitted structured entries but does not use them to diagnose a person. Client-portal IP address and device information are not stored with client records.

Sources are the clinician subscriber, the clinician's use of CodaPath, an adult client-portal visitor's entry of a random code, and the operation of requested Service functions. CodaPath collects and uses this information only to provide requested tracking, visualization, export, approved-summary, material-sharing, client-portal, support, security, and compliance functions; maintain the Service; and perform other purposes disclosed here or separately authorized as required by law.

CodaPath may share these categories only as necessary to provide a requested product or service, at a clinician's direction, with valid consent where required, or as otherwise permitted by law. Recipients may include application hosting and database providers; authentication and security providers configured to process the information; the clinician and recipients authorized through a client code or export; legal or safety recipients where permitted; and a successor in a qualifying business transaction. Current third-party and affiliate information associated with a verified consumer health data request, including an active contact method when required, may be requested at lcross@codapath.org.

CodaPath does not sell consumer health data, use it for targeted advertising, or use geofencing around healthcare facilities. We do not attempt to reidentify data deidentified under applicable law and require recipients to maintain it in deidentified form where legally required.

Subject to the Act and applicable exceptions, a Washington consumer may request confirmation of whether CodaPath is collecting, sharing, or selling consumer health data concerning the consumer; access that data; obtain a list of applicable third parties and affiliates and an active contact method for each; withdraw consent from future collection or sharing when processing is based on consent; delete consumer health data; and appeal a refusal to act.

Submit a request by emailing lcross@codapath.org with the subject 'Privacy Request.' A person does not need to create a new account. We may request information reasonably necessary to authenticate the request. Do not send a client's name, diagnosis, or health details. For a portal record, provide only the random client code initially. CodaPath will use a secure, proportionate verification process, which may include confirming control of the relevant clinician account or coordinating with the clinician who controls the code.

Where CodaPath processes coded client data solely on a clinician's behalf, the clinician may be the appropriate party to receive and authenticate the request. CodaPath may direct the request to that clinician or assist as required by law. Because CodaPath does not hold the external identity-to-code mapping, it may be unable to connect a named person to a coded record without the code and appropriate verification.

CodaPath will respond without undue delay and within the period required by law, generally within 45 days under the Washington Act, subject to one permitted 45-day extension. Information is provided without charge up to twice annually unless a request is manifestly unfounded, excessive, or repetitive as defined by law.

If a request is denied, appeal by emailing lcross@codapath.org with the subject 'Privacy Appeal.' CodaPath will respond within the period required by law and explain its decision. If the appeal is denied, a consumer may contact the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.

For a verified Washington deletion request, deletion from archived or backup systems may be delayed until those systems are restored, but not longer than six months after authentication where the Act applies, unless another legal exception permits retention.

10. Data retention

CodaPath keeps personal information only for as long as reasonably necessary to provide the Service, maintain security, resolve disputes, enforce agreements, and meet legal, accounting, and tax obligations. Account and coded client information is retained while an account is active and for a limited period afterward when necessary to complete deletion, permit lawful export, maintain security, or meet legal obligations. Billing and tax records are retained for the period required by applicable accounting and tax law. Authentication logs, support communications, marketing inquiries, privacy requests, and consent records are retained only as long as reasonably necessary for their operational, security, evidentiary, or compliance purpose.

Information may remain temporarily in backups according to CodaPath's backup cycle. For a covered verified Washington deletion request, deletion from archived or backup systems will not be delayed longer than six months after authentication unless a legal exception permits retention. Information may be retained longer when reasonably necessary to comply with law, preserve evidence, investigate misuse or a security incident, resolve a dispute, or exercise or defend legal claims. When information is no longer required, CodaPath deletes, deidentifies, or securely disposes of it according to its procedures.

11. Security

CodaPath uses administrative, technical, and physical safeguards designed for the nature of the information and the Service. These include structured fields and input restrictions intended to block prohibited client identifiers, access controls, account authentication, logging and monitoring appropriate to Service operation and security, vendor management, backups, and incident-response procedures. CodaPath reviews and updates safeguards as the Service changes.

No method of transmission or storage is completely secure. Clinicians must protect credentials and client codes, use secure devices, revoke codes when access should end, and notify lcross@codapath.org promptly of suspected unauthorized access. Do not include client identity or health details in an incident report.

12. Your privacy rights and choices

Depending on where you live and how information is processed, you may have rights to know or access personal information, correct inaccuracies, delete information, obtain a portable copy, withdraw consent, restrict or object to processing, opt out of certain sales, targeted advertising, or profiling, and appeal a refusal. CodaPath does not discriminate against a person for exercising an applicable privacy right.

Submit a request by emailing lcross@codapath.org with the subject 'Privacy Request.' CodaPath will verify the request in a manner proportionate to its sensitivity. An authorized agent may submit a request where permitted, but CodaPath may require proof of authority and direct verification with the consumer. A request may be denied or limited when an exception applies, with an explanation when required.

Clinician account holders may update available profile and billing information through their account settings, use in-Service export functions for available data, cancel a subscription through Account and Billing, and request account deletion by emailing lcross@codapath.org. Canceling renewal does not itself delete the account or its data unless the interface expressly says so.

Marketing emails include an unsubscribe method. Account, billing, security, and other service messages are not promotional and may continue while an account or legal obligation remains.

13. California and other state disclosures

The categories of personal information collected, their sources, purposes, and recipient categories are described in Sections 2, 4, 5, and 6. CodaPath does not sell personal information, share it for cross-context behavioral advertising, or disclose personal information to third parties for their own direct-marketing use. California residents may use the request method in Section 12 to exercise any right that applies to CodaPath's processing.

Wix and the website service providers described in Sections 6 and 7 may collect website interaction information through the public marketing site as described in their applicable notices and CodaPath's website configuration. CodaPath does not permit advertising networks to collect coded client data or track users through authenticated areas. See Section 7 for Do Not Track and preference-signal information.

Residents of other states may submit requests through the same method. CodaPath will apply the law governing the request, including applicable exceptions, verification requirements, and appeal rights.

14. Children and minors

Clinician accounts are for adults age 18 or older. The client portal is intended for access by an adult client, parent, legal guardian, caregiver, or other authorized adult. CodaPath does not knowingly allow a child under 13 to create an account or directly submit personal information. A minor may view clinician-approved material only under the control of an authorized adult or treating professional.

If you believe a child has directly provided personal information contrary to this policy, contact lcross@codapath.org without including the child's sensitive information. CodaPath will investigate and take appropriate action.

15. United States service and data location

The individual CodaPath Service is offered for use in the United States. Information may be processed in the United States and in other locations where CodaPath's service providers operate. When information is transferred across jurisdictions, CodaPath uses safeguards required by applicable law.

16. Changes to this policy

CodaPath may update this policy to reflect changes in the Service, law, or its practices. CodaPath will post the updated policy, revise the effective date, and provide additional notice or obtain consent when required. If a change would add a category or purpose for consumer health data that requires prior disclosure and affirmative consent, CodaPath will provide that disclosure and obtain consent before the new collection, use, or sharing begins.

Prior versions may be requested by emailing lcross@codapath.org.

17. Contact us

CodaPath LLC

15530 Bothell Way NE

Lake Forest Park, WA 98155

Privacy requests and questions: lcross@codapath.org

Security concerns: lcross@codapath.org

Privacy appeals: lcross@codapath.org with the subject 'Privacy Appeal'

General support: lcross@codapath.org

When contacting us, do not include client names, diagnoses, narrative notes, or other prohibited information. Use a random client code only when necessary and requested through a secure process.