Back to SA CoParents
HIPAA Notice

Health-adjacent data, treated with clinical-grade care.

Last updated: February 21, 2026

HIPAA (the Health Insurance Portability and Accountability Act) binds healthcare providers, health plans, and healthcare clearinghouses — collectively "Covered Entities" — and their contracted "Business Associates".

SA CoParents is not a healthcare provider, and use of the platform does not, by itself, make information subject to HIPAA. We do not diagnose, treat, or bill for healthcare. When you fill in the Special Needs Co-Parenting Assessment or the Family Safety and Functioning Reflection, you are self-reporting information about your child to help you prepare for co-parenting conversations. That work is a preparation resource, not clinical care.

We nevertheless treat health-related information as sensitive personal information and apply the privacy and security protections described in this notice and in our Privacy Policy. Some of what you tell us — your child's diagnoses, medication routines, therapy attendance, family-violence history — would be Protected Health Information (PHI) in a clinical context. The safeguards below apply to it regardless of whether HIPAA legally reaches it.

Where your health-adjacent data lives

  • Your account: stored in our database, accessible only to you when signed in.
  • Special Needs Assessment answers, Safety-Lens findings, and any drafts: private to your account. The co-parent never sees them unless you both explicitly consent through the Compare flow.
  • Findings 1 (family-violence pattern) and 2 (trauma impact) of the Safety Lens: private to you even after a Compare consent. Only Finding 3 (parenting-plan implications) is ever included in any joint artefact.
  • Emails to professionals you send from the app: transmitted through Resend. The PDF attachment leaves our servers when you press "Send".
  • AI-generated summaries: your prep content is sent to Anthropic's Claude via the Emergent LLM proxy. Anthropic does not train on API traffic. See our Privacy Policy for the exact processing chain and retention limits, and please avoid pasting raw clinical records into free-text fields until the Emergent → Anthropic BAA chain is confirmed.

Safeguards we apply

  • Transport encryption (TLS) on every request between your browser and our servers.
  • Consent-gated sharing: joint artefacts only exist when both parents have accepted a Compare share. Consent is revocable at any time.
  • Neutral-language guardrails: no artefact leaving the platform labels either parent as "correct", "at fault", or "should have custody". Enforced by automated tests.
  • PHI access audit log: every read of a Safety-Lens finding, Special Needs Assessment, or joint report is time-stamped and stored for six years — the HIPAA record-retention standard we adopt voluntarily.
  • Right to export: request a full copy of your data at any time (see the Data Retention page).
  • Right to deletion: request account and full-data deletion at any time. Backups purge on their normal 30-day cycle.
  • Never sold, never advertised against: we do not sell, license, or share your data with advertisers under any circumstance.

Business Associate Agreements (BAAs)

When required by our vendors and by your state law, we maintain BAAs with the third parties that handle health-adjacent data on our behalf. If you or your attorney need a copy of a specific BAA, email us at the address below and we'll respond within ten business days.

State law matters

Some states — notably Texas under HB 300 — apply HIPAA-style protections more broadly than federal HIPAA itself. If you reside in Texas, your data enjoys the more protective of the two standards. We do not weaken any protection based on where you live. See our full Texas HB 300 Notice for the 15-business-day access SLA, the no-sale attestation, and the breach-notification timers.

What to do if something feels wrong

If you believe your data has been mishandled, contact us immediately. We will investigate and, where a breach is confirmed, notify you within 60 days as HIPAA requires of Covered Entities — again, a voluntary standard for us.

Not a substitute for professional advice

Nothing in SA CoParents is a clinical diagnosis, forensic assessment, custody evaluation, or legal opinion. Every artefact carries a universal disclaimer to that effect. Always work with your own licensed professionals for clinical or legal decisions.

Contact

Questions, complaints, BAA requests, or data-handling concerns:

Email mattsossi@bsossi.com or call 210-224-1667.

See also

SA CoParents · 16607 Blanco #703, San Antonio, Texas 78232