What does SA CoParents do?

SA CoParents helps co-parents prepare for relational mediation with a calm, child-centered approach. Personalized assessments generate downloadable PDF reports (Mediation Summary, Special Needs Care Plan, Family Violence & Communication Safety Assessment) parents can bring to mediators, attorneys, or pediatricians.

Is SA CoParents free?

Yes — the core assessments, reports, and one-year sandbox are free. Every parent can complete the flow, download PDFs, and generate share links at no cost.

Your answers are never sold or used to train AI models. You can delete your account and all associated data any time — deletion is complete within 30 days. Locked safety sections (crisis hotlines) always remain in every shared PDF.

Does this replace a mediator, lawyer, or therapist?

No. SA CoParents is an educational preparation tool, not a substitute for legal, therapeutic, or medical advice. Every score is a conversation starter — not the last word.

With Reflection. Build Alignment. Create Better Agreements.

Texas House Bill 300 — codified as the Texas Medical Records Privacy Act at Tex. Health & Safety Code Ch. 181 — extends HIPAA for anyone who assembles, collects, analyses, uses, evaluates, stores, or transmits Protected Health Information ("PHI") on a Texas resident. Its definition of "covered entity" is much broader than HIPAA's.

SA CoParents operates from San Antonio, Texas, and stores safety, trauma, and co-parenting data that would be PHI in a clinical setting. We therefore treat ourselves as a Texas covered entity and adopt HB 300 in full, even where HIPAA alone would not require it.

1. Notice of Electronic Disclosure

HB 300 §181.154 requires clear notice before your PHI is electronically disclosed to a third party — unless the disclosure is one HIPAA already permits (treatment, payment, healthcare operations, court order, etc.).

Inside SA CoParents, an electronic disclosure only happens when:

You accept a Compare share with your co-parent — and even then, only the fields the artefact requires are shared. Findings 1 and 2 of the Safety Lens are never disclosed.
You explicitly email a Joint Report, Joint Agreement, or Professional Introduction to a mediator, attorney, therapist, or court from within the app.
You use the Co-Sign Portal to route a report to a reviewing professional.

Each of those actions requires an on-screen consent step that names the recipient. No electronic disclosure happens in the background.

2. Sale of PHI — prohibited

HB 300 §181.153 bans the sale of PHI without written authorisation. SA CoParents does not sell, rent, or barter PHI under any circumstance. We do not accept marketing money in exchange for access to your data, and we will never do so.

3. Marketing communications — opt-in only

HB 300 requires affirmative opt-in for marketing communications that use PHI. Every account starts with marketing communications turned off. You can turn them on (and off again) from your account settings, and we will never send you marketing based on the content of your safety, trauma, or agreement data.

4. Right of access — 15 business days

HB 300 §181.102 shortens HIPAA's 30-day access window to 15 business days for electronic health records. Your data is available instantly via the Data & Retention page (right-of-export button). If you ever prefer a formal written request, we honour it inside 15 business days.

5. Breach notification

You: notified within 60 days of discovery of any breach involving your PHI.
Texas Attorney General: notified without unreasonable delay, and no later than 60 days after discovery, for any breach affecting 250 or more Texas residents (per Tex. Bus. & Com. Code §521.053, as amended).
US Department of Health & Human Services (OCR): notified for HIPAA-scoped breaches per §164.408.

Our internal breach runbook (60-day clock, AG notice, OCR notice, user notice, credit-monitoring evaluation) is reviewed annually.

6. Workforce training

HB 300 §181.101 requires every workforce member to receive training on state and federal PHI laws within 90 days of joining, and again whenever their duties materially change. Attestations are retained for six years. Because SA CoParents is currently operated by a single owner, the attestation on file covers the owner and any future employees, contractors, or interns.

7. Reasonable safeguards

TLS on every request in transit; strict CORS allow-list on every API.
Bcrypt password hashing; short-lived reset tokens that are never written to application logs.
PHI-access audit log retained for six years — you can pull your own log from your account.
Consent-gated Compare share; automated neutral-language guardrails on every artefact.
Business Associate Agreements with vendors that touch health-adjacent data.

8. Your Texas-specific rights

Access: an electronic copy of your data within 15 business days.
Correction: request amendment of anything inaccurate.
Restriction: ask us to restrict certain uses or disclosures.
Accounting of disclosures: your PHI-access log covers this — self-serve.
Deletion: full account deletion at any time, subject only to the de-identified audit log we must retain by law.
Complaint without retaliation: to us, to the US Department of Health & Human Services (OCR), or to the Texas Attorney General's Consumer Protection Division.

9. Complaints and contact

Privacy Officer, SA CoParents
16607 Blanco #703, San Antonio, Texas 78232
Email mattsossi@bsossi.com · Phone 210-224-1667

You may also file a complaint with the Texas Attorney General's Consumer Protection Division or the US Department of Health & Human Services (OCR).

Acknowledgement

By creating an account, you acknowledge that you have received this HB 300 Notice alongside our Notice of Privacy Practices. A time-stamped record of your acknowledgement is stored in your account audit log.

Just so we're on the same page

The Texas standard, applied to every parent's data.