Privacy Policy

1. Who we are

Onvelas (“Onvelas,” “we,” “us”) provides a practice management platform for Applied Behavior Analysis (ABA) providers, covering scheduling, clinical documentation, billing, and revenue cycle management. This policy describes how we collect, use, and protect information on our website and platform.

2. Protected Health Information (PHI)

When customers use the Onvelas platform to manage patient care, Onvelas processes Protected Health Information as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). Our handling of PHI is governed by the Business Associate Agreement (BAA) executed with each customer — see our BAA page. We use PHI only as permitted by the BAA and applicable law, and we do not sell PHI or use it for advertising.

Please do not submit PHI through our public website forms (for example, the request-access form); those forms are intended for business contact information only.

3. Information we collect

• Account and contact information — name, work email, practice name, phone, and similar details you provide when requesting access or creating an account.
• Platform data — data customers enter into the platform in the course of operating their practice, processed on the customer’s behalf.
• Usage and device data — log data such as IP address, browser type, pages visited, and actions taken, used for security, troubleshooting, and product improvement.

4. How we use information

• To provide, maintain, and secure the Onvelas service.
• To respond to inquiries and provision workspaces.
• To send service communications (security notices, billing, support).
• To improve the product, using aggregated or de-identified data where possible.
• To comply with legal obligations, including HIPAA and applicable state law.

We do not sell your personal information.

5. Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we process, including encryption in transit and at rest, role-based access controls, audit logging, and organization-level data isolation. No method of transmission or storage is completely secure; we encourage customers to use strong credentials and enable available security features.

6. Data retention & your choices

We retain account information for as long as your account is active or as needed to provide the service and meet legal obligations. Customers control the patient data in their workspace; retention and disposition of PHI follow the customer’s instructions and the BAA. You may request access to, correction of, or deletion of your personal information by contacting us.

7. Connected Google and Meta accounts

A practice can connect its Google Business Profile, Google Analytics property, Facebook Page or Instagram professional account in Settings → Social. The practice administrator signs in with Google or Facebook and grants Onvelas access. For Google Analytics, Facebook and Instagram that access is read-only. Google offers no read-only permission for Business Profile, so connecting it grants Google’s Business Profile management permission; Onvelas uses it only to read the counts described below and never to change the listing.

• What we read — aggregate daily counts only: profile and page views, website clicks, calls, direction requests, engagement, followers, and website visits by traffic source. We never read comments, reviews, messages, post content, page addresses, or information that identifies an individual visitor.
• How we use it — only to show those counts to the practice’s own authorized users in the Onvelas dashboard. We do not sell it, use it for advertising, share it with other customers, or use it to train artificial intelligence models.
• How we store it — access tokens are encrypted at rest and never shown in the product; counts are kept per practice under the same organization-level isolation as all platform data.
• Removing access — disconnecting in Settings → Social deletes the token. Removing Onvelas from your Google Account or Facebook settings also ends our access, and a deletion request made through Facebook deletes the counts too. See Data deletion.

Onvelas’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. Contact

Questions about this policy or our privacy practices: support@onvelas.com.