Privacy notice

What we collect

About clients and students

• Contact details: name, date of birth, phone, email and address.
• Information that helps us serve you: your disability and access needs, the technology you use, your preferred formats and language.
• School details and a parent or guardian's contact details, for students.
• Your vocational rehabilitation (VR) counselor, funding authorizations and billing records.
• Records of our services: case notes, assessments, goals, training hours, equipment loans, incident reports and documents you or we upload, including signatures.
• What you send us through the client portal: messages, requests, practice logs, documents and changes to your contact details.
• Consent forms a guardian signs and releases of information you sign (typed name, date and the internet address it was signed from), and survey answers you choose to give.
• Emails you send to our office address may be filed in your record.

About people who refer someone

Your name, email, phone and organization, how you know the person, and what they need help with. For self-referrals, a monthly income range, which only decides whether training is free. We record the internet address a referral was sent from, to stop misuse.

About VR counselors

Your name, email and agency, the clients linked to you, and messages you send through the counselor portal.

About staff

Your name, email, sign-in security settings, working hours, and a record of what you do in the system (the audit log), including the internet address you sign in from.

We do not collect your location.

How we use it

• To provide assistive technology assessment, training and equipment services.
• To schedule sessions, send reminders and keep in touch with you.
• To report progress to your VR counselor or funding agency and to bill for services they authorize.
• To meet our legal, contract and record-keeping duties, and to keep the system secure.

We do not sell your information, and we do not use it for advertising.

Who we share it with

• Your VR counselor or funding agency, when they referred you or pay for your services: progress reports, evaluation reports, authorization requests and invoices.
• Microsoft 365, which sends and receives our email (including sign-in codes and reminders), holds our encrypted off-site backup copies, and lets staff sign in with a Microsoft account.
• Anthropic (Claude), the AI service we use for drafting help. See AI and voice features.
• Linode, which provides the server this system runs on. We set up and manage the server ourselves; Linode provides the computer and its connection, not access to our records.
• Anyone else, such as an employer or a doctor, only when you sign a release naming them (it lasts one year and you can withdraw it), or when the law requires it.

AI and voice features

Staff can use AI to help draft notes, reports, translations and plans. A staff member always reviews AI suggestions before they are saved. Requests go to Anthropic (Claude).

Before a request is sent, the system removes names, email addresses, phone numbers, street addresses and dates of birth. The description of needs and services is still sent, because the draft depends on it. Two kinds of request are not fully de-identified: translations, and spoken requests to the voice assistant.

We record which AI feature was used and how long the request was, not its contents.

On the website, the voice assistant uses your web browser's speech recognition. Some browsers, such as Google Chrome, send the audio to the browser maker to turn it into text. On the iPhone app, speech is turned into text on the phone when the phone supports it, otherwise by Apple. We do not store voice recordings.

Cookies and your browser

We use one cookie, which keeps you signed in and is deleted when you close your browser. Display choices you make, such as text size and colors, are saved in your own browser. We do not use analytics, tracking or advertising cookies, and the site loads nothing from other companies.

How we protect it

• Every connection to this site is encrypted (HTTPS).
• Staff sign in with two-step verification or a passkey, and are signed out after a period of inactivity.
• Each staff member sees only the areas, and where set up only the clients, their role needs.
• Changes, and who opened each client's record, are recorded in an audit log.
• Case notes cannot be changed 30 days after they are written. A correction is added beside the note, and earlier versions are kept.
• Uploaded files are kept outside the public part of the website. Off-site backup copies are encrypted.

How long we keep it

• Service records are kept for as long as our funders, contracts and the law require. Records of closed clients are archived automatically after 10 years.
• Items staff delete go to a trash folder and are permanently removed after 30 days, except authorizations, plans and releases, and records kept on hold.
• Daily backups are kept for 30 days.
• Sign-in records and the audit log are kept to protect the system.

Your choices

• See your information. Ask for a copy of your record in your client portal, or ask us. We answer within 30 days.
• Correct it. Update your contact details in your client portal, or ask there or ask us to correct anything else.
• Withdraw consent. You, or a parent or guardian, can withdraw a consent or a release at any time by contacting us. This does not undo what was shared before.
• Surveys are optional. You can skip any question.

Your rights under HIPAA

We treat your service and health-related records as protected health information under the federal HIPAA rules. You have the right to:

• Get a copy of your records. Ask us in writing; we will provide a copy, usually within 30 days, in the format you ask for where we can.
• Ask us to correct your records. If we disagree, we will tell you why in writing and you can add a statement of your own.
• Know who we have shared your records with, other than for your treatment, payment and running our services.
• Ask us to limit what we share, and to contact you in a particular way or at a particular place. We will say yes to every reasonable request.
• Get a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Choose someone to act for you, such as a legal guardian or someone with medical power of attorney.

We never sell your information, and we will ask for your written permission before using it for marketing or for any purpose not described in this notice. You can withdraw that permission at any time. If a breach of your information ever happens, we will tell you.

If you believe your privacy rights have been violated, you can complain to us (see Questions and requests) or to the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints or 1-800-368-1019. We will not retaliate against you for complaining.

The staff iPhone app

The iPhone app is for Full Circle Assistive Technology staff. It connects only to this website over an encrypted connection.

• Your sign-in is kept in the iPhone's Keychain. Unsent notes, hours and drafts are kept in protected app storage, are not included in iPhone backups, and are removed after 14 days or when you sign out. On an iPhone without a passcode the app keeps none of them.
• If a phone is lost, staff can report it lost from the website: the next time it connects, the app removes everything it keeps and signs out.
• The app asks to use Face ID (to lock the app), the camera (to scan documents), the microphone and speech recognition (for the voice assistant), and Photos (only to save a document image you choose).
• The app contains no analytics, advertising or tracking, and does not collect your location.

Questions and requests

To ask a question, request a copy or correction of your information, or make a complaint, email amena.thomas@fullcircleat.com, or write to Amena Thomas at 825 Berry St, Unit 108, Saint Paul, Minnesota 55114. Amena Thomas handles privacy requests. We will answer as soon as we can. If we change this notice, we will update the date at the top.