Quick summary

1. The Services this policy covers

Attunica, LLC operates more than one product, and what we collect depends on which one you are using.

• Attunica Practice — a clinical simulation and training platform where students practice conversations with simulated clients and receive structured feedback and skill scoring. Its users are students, faculty, supervisors, and program administrators, generally at graduate programs and training agencies.
• Attunica Notes — a clinical documentation tool that helps licensed clinicians turn session notes into structured progress notes and treatment plans. Its users are clinicians, supervisors, and administrators at the practices that license it.
• Our website — including the early-access form and any other public pages.

Where a section below applies to only one product, we say so.

2. Information we collect

We collect the following categories of information:

• Account information — name, email address, organization, and role (for example: student, instructor, clinician, supervisor, administrator).
• Information you submit to us — early-access requests through our website, support inquiries, and other correspondence.
• Content generated in the Services — the material you enter or record while using a product, and the drafts, feedback, scores, plans, and reports our software produces from it.
• Technical and audit information — log data such as IP address, browser and device information, features used, and timestamps, along with records of access to sensitive material and of automated processing performed on your behalf.

Where a product handles clinical or student material, the organization that licenses it determines what is entered and how long it is kept. We collect what the Services need to function and no more.

Attunica Practice simulations are designed for practice with fictional clients. Please do not enter identifying details about real clients into a practice session.

3. How we use information

• To provide, maintain, and secure the Services, including authenticating you and running sessions.
• To generate the drafts, feedback, scoring, and reporting that are the point of each product.
• To make results available to the instructors, supervisors, and administrators responsible for your training or your clinical work, consistent with your organization's policies and role assignments.
• To maintain audit trails and detect misuse of clinical records.
• To communicate with you about the Services, including updates, security notices, and support.
• To troubleshoot problems and protect the rights and safety of users and the public.
• To improve the Services through aggregated or de-identified analysis that cannot reasonably be used to identify any individual.
• To comply with legal obligations.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use your content to train foundation or general-purpose AI models.

4. Artificial intelligence in the Services

Simulated clients, skill scoring, and documentation drafting are powered in part by large language models operated by third-party providers. When you use these features, the relevant content is transmitted to a provider so it can generate a response, an assessment, or a draft.

We contract with these providers on terms that prohibit them from using Attunica content to train their models, and, where protected health information may be involved, under an executed business associate agreement.

Model outputs are generated automatically and can be wrong. In Attunica Notes, a licensed clinician reviews and edits every generated draft before it is saved to a record; nothing our software drafts becomes part of a clinical record without that review. In Attunica Practice, feedback and scoring are a training aid and are not clinical advice, supervision, or an evaluation of anyone's fitness to practice.

5. How we share information

• Your organization — where the Services are provided through a school, program, agency, or practice, that organization and the people it designates may access account information, session content, and assessment or documentation data according to the roles and permissions it configures.
• Service providers — we use trusted third-party vendors (for example: cloud hosting, database management, and LLM API providers) to deliver the Services. These vendors are contractually bound to confidentiality and security obligations consistent with this Policy and FERPA, and, where protected health information is involved, under business associate agreements.
• Legal and safety — we may disclose information where we believe in good faith that disclosure is required by law, or is necessary to protect the rights, property, or safety of Attunica, our users, or the public.
• Business transfers — if Attunica is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a successor policy providing comparable protection.
• With your direction — we share information with anyone else only when you ask us to.

Website forms and third-party requests

When you submit the early-access form, your email address and any message you include are sent to Attunica's own servers, which run on Amazon Web Services in the United States, where they are stored and forwarded to our team by email. We use this information to respond to your early-access request.

This website is hosted on Amazon Web Services. It also requests font files from Google Fonts and animation files from cdnjs. Those network requests may include your IP address and browser or request metadata used to deliver the files.

6. Health information and student records

Some of what the Services handle is governed by laws that go beyond this Policy. Those obligations are set out in separate notices, and where a notice or a signed agreement conflicts with this Policy, that document controls.

Protected health information (HIPAA)

When a practice uses Attunica Notes, we act as a business associate of that practice and handle protected health information only as its business associate agreement with us permits. We maintain business associate agreements with the subcontractors that process protected health information on our behalf. Patients should direct requests about their records to their treating practice, which controls the record. Our full HIPAA commitments are described in our HIPAA notice.

Education records (FERPA)

When Attunica Practice is provided under an agreement with an educational institution, information we maintain about students may constitute an education record under FERPA. In that arrangement the institution controls the record and Attunica acts as a school official with a legitimate educational interest, performing a service the institution would otherwise perform itself. We use education records only to provide the Services to the institution, we remain under the institution's direct control with respect to those records, and we do not redisclose them except as FERPA permits or the institution directs. Students who want to review, correct, or delete their records should contact their institution first. See our FERPA notice for detail.

7. Retention

We keep information for as long as your account is active, as long as needed to provide the Services, and as long as an organization requires us to retain records under our agreement with it — including clinical record retention periods, which are typically set by state law and by the practice. After that, we delete or de-identify the information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Backup copies are purged on a rolling schedule. Audit logs are retained for at least the period required by applicable law.

8. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, role-based access controls with per-record access grants, least-privilege access for our personnel, automatic session timeout after a period of inactivity, and logging of access to sensitive data. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify affected users and organizations without undue delay if we become aware of a breach affecting their information, as required by law and by our agreements.

9. Your choices and rights

• Access and correction — you can view and update most account information in the Services, or ask us for a copy of the information we hold about you.
• Deletion — you can ask us to delete your account and associated data. Where your data forms part of an organization's education records or clinical records, we will refer the request to that organization, which controls the record.
• Google access — you can review or remove Attunica’s access by following Google’s linked-app instructions. Google notes that removing access may make connected features unavailable.
• Email — you can unsubscribe from non-essential email at any time. We will still send messages necessary to operate your account.
• Regional rights — depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act or the EU and UK General Data Protection Regulation, including portability, restriction, objection, and the right to lodge a complaint with a supervisory authority. We will not discriminate against you for exercising any of these rights.

To make a request, email us at the address below. We may need to verify your identity before acting.

10. Children

The Services are built for graduate-level and professional use and are not directed to children under 13. We do not knowingly collect personal information from children under 13 as users of the Services. If you believe a child has provided us information, contact us and we will delete it.

11. International users

Attunica is operated from the United States, and information we collect is processed and stored in the United States. Data protection laws here may differ from those where you live. Where required, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses, for international transfers.

12. Changes to this policy

We may update this Policy from time to time. When we do, we will revise the effective date above, and if the changes are material we will provide additional notice, such as an email or an in-product notice, before they take effect. Continued use of the Services after an update means you accept the revised Policy.

← Back to Attunica