SoftSpot® Connect Privacy Policy

1) Scope & Who Controls Your Data

This Privacy Policy applies to information processed by PediaMetrix, Inc. when you access or use SoftSpot® Connect in the United States.

If you access the Services from outside the U.S., you are responsible for compliance with local laws. Different terms may apply in other regions.

Controller:
PediaMetrix, Inc.
155 Gibbs St, Rockville, MD 20850, USA
Contact: contact@pediametrix.com

2) Key Definitions

• Personal Information: Information that identifies or can reasonably be linked to an individual (e.g., name, email address).
• De-identified / Aggregated Data: Data that cannot reasonably be used to identify an individual.
• PHI (Protected Health Information): As defined under HIPAA. SoftSpot® Connect is not intended to collect or store PHI and is not a HIPAA-covered service.

3) What We Collect (Data Minimization by Design)

We collect only the information necessary to operate SoftSpot® Connect.

a) Information you provide

Account information

• Name (or business name)
• Email address
• Password (stored in hashed form)
• Account role (parent/caregiver or provider)

Provider profile information (for providers who opt in)

• Practice or provider name
• City/state and service area
• Professional credentials and specialties
• Public contact information (as chosen by the provider)
• Availability or booking links (if provided)

Parent / caregiver information

• Optional display name or nickname
• Search and connection preferences

Messages & inquiries

Messages sent through the platform to initiate contact

⚠️ Please do not include PHI, medical histories, diagnoses, or identifiable child information.

b) Information collected automatically

• Device and usage data (browser type, OS, app version)
• IP address and general location (city/state level)
• Interaction data (searches, clicks, profile views)
• Error logs and performance diagnostics

c) Information from third parties

• Authentication providers
• Scheduling or calendar tools (if linked)
• Cloud hosting, analytics, and infrastructure services

We do not require or request

• Child full legal names
• Dates of birth
• Medical record numbers
• Diagnoses, treatment notes, or images

4) How We Use Information

We use information to:

• Operate the platform: create accounts, enable provider discovery, and facilitate connections
• Improve SoftSpot® Connect: analytics, debugging, performance optimization, and feature development
• Communicate: service notifications, security alerts, and (if you opt in) product updates
• Maintain safety and integrity: prevent misuse, spam, or fraud
• Compliance: enforce Terms of Service and comply with legal obligations

Where feasible, we rely on aggregated or de-identified data.

5) No PHI; HIPAA Status

SoftSpot® Connect is not a clinical service and does not function as a HIPAA Business Associate.

• Do not upload or transmit PHI through the platform
• Providers should not treat SoftSpot® Connect as a medical record or intake system
• If PHI is submitted despite this notice, we may delete it to protect privacy

6) Legal Bases for Processing

We process Personal Information based on:

• Performance of a contract (providing the Services)
• Legitimate interests (platform security, improvement, fraud prevention)
• Consent (where required, such as optional marketing communications)
• Legal obligations

7) Sharing & Disclosure

We do not sell Personal Information.

We may share data with:

• Service providers (hosting, analytics, communications), bound by confidentiality obligations
• Legal authorities if required by law or to protect rights and safety
• Business transfers (merger, acquisition, asset sale), subject to this Policy
• With your direction (e.g., when you choose to contact a provider or share your profile)

8) Data Retention

We retain Personal Information only as long as necessary to:

• Provide the Services
• Meet legal or regulatory requirements
• Resolve disputes and enforce agreements

You may request deletion at any time (see Section 12).

9) Security

We use commercially reasonable safeguards, including:

• Encryption in transit
• Access controls
• Logging and monitoring

No system is 100% secure. You are responsible for safeguarding your credentials and avoiding submission of sensitive information.

10) Children’s Privacy (COPPA)

SoftSpot® Connect is intended for adults (parents/caregivers and providers).

We do not knowingly collect Personal Information directly from children under 13.

If you believe such data has been collected, contact us and we will delete it.

11) Cookies & Similar Technologies

We use:

• Strictly necessary cookies (authentication, security)
• Functional and analytics cookies to improve performance

You may control cookies via browser settings. Disabling some cookies may limit functionality.

Do Not Track: We do not currently respond to DNT signals.

12) Your Privacy Rights

You may request:

• Access / Portability – a copy of your Personal Information
• Correction – update inaccurate data
• Deletion – remove your account and associated data
• Marketing opt-out – unsubscribe from promotional emails

Submit requests to: contact@pediametrix.com

We may verify your identity before fulfilling requests.

California Residents (CCPA/CPRA):
We do not sell Personal Information and do not knowingly share children’s data for advertising.

13) International Users

SoftSpot® Connect is intended for U.S. use. Data is processed in the United States.

If you use the Services from another country, you consent to U.S. data processing.

14) Third-Party Links & Services

The platform may link to third-party websites or tools (e.g., scheduling services).

We are not responsible for their practices. Review their privacy policies separately.

15) Changes to This Policy

We may update this Policy periodically. Material changes will be communicated via the platform or email, with an updated effective date.

16) Contact Us

Email: contact@pediametrix.com

Quick Summary

• SoftSpot® Connect is not a medical or diagnostic service
• We minimize data collection and avoid PHI
• We don’t sell Personal Information
• Providers control what appears on their public profiles
• You can request access or deletion at any time
• Data is processed in the U.S.