Privacy Policy
Effective date: September 29, 2026 · Last updated 2026-10-06
This policy explains what information All Together (train.centercc.com), operated by Center for Cognition and Compassion, collects, where it comes from, why, who receives it, how long it is kept, and the rights you have.
What we collect, and why
| Category | Where it comes from | Why we use it | How long we keep it |
|---|---|---|---|
| Account and contact details (name, username, work email, role, sign-in times, settings) | You, your organization, or Microsoft sign-in | To run your account, secure it, and contact you about it | While the account is active, then only as long as audit and legal obligations require |
| Records and clinical content (documents, records, images, notes, charts, questionnaire answers, scores, reports) — often health information | You, your practice, and patients who complete forms or interviews | To provide the Service: charts, record analysis, reports, intake | As long as the practice needs it and as law and record-keeping rules require |
| Phone intake calls (audio recording, transcript, answers) | The caller, during a call with Zani | To complete and check the intake | Answers stay in the chart; the recording and transcript are held by our phone provider under its retention settings |
| Voice dictation (speech sent to our Azure speech service for transcription) | You, only while a microphone button is on | To turn speech into text | The audio is not stored by us; only the text you keep |
| EMDR iTrack eye-movement numbers (blink rate, gaze direction, derived indices) | Computed on your device from the camera | To show your clinician during a session | Held in memory during the session and dropped within hours |
| Payment details (amount, status, billing email; card handled by Stripe) | You and Stripe | To take payment and manage subscriptions | As tax and accounting law requires |
| Security and activity logs (sign-ins, record access, exports, security events) | Generated by the Service | To protect patients and meet audit obligations | As HIPAA and professional audit rules require (generally six years) |
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Sensitive information
Health information, account sign-in details, voice recordings and face-derived measurements are sensitive personal information. We use them only to provide the Service you or your clinic asked for, to keep it secure, and as the law requires — never to infer things about you for other purposes.
Medical information (CMIA and HIPAA)
Medical information in the Service is kept confidential and is used and disclosed only as the California Confidentiality of Medical Information Act (Civil Code §56 and following) and HIPAA permit. Software that stores medical information for a provider is held to the same confidentiality duties as the provider, and we treat the Service that way. Health information is handled under the HIPAA obligations of the clinic or practice that entered it, and under business associate agreements with our service providers where required. Payment and text-message providers receive no clinical content.
Calls, microphones and recording
- Intake calls with Zani, our AI assistant, are recorded and transcribed, and callers are told so at the start of the call. You can ask for a person at any time, or hang up and call the office at (323) 205-5352, or complete the intake in writing instead.
- Microphone features send audio for transcription only while you have the microphone turned on. We do not store that audio.
- Dictation buttons send audio to Microsoft Azure AI Speech, our own Azure service covered by our Microsoft agreement, and not to your browser's maker. The audio is not stored by us.
- We do not use session-replay tools and do not record your keystrokes. For security we log certain events — for example that a screenshot key was pressed or a large block of text was copied — without their content.
EMDR iTrack camera
Face and eye tracking runs entirely in your browser on your device. No video or audio is recorded or stored, and no face images or face geometry are kept or used to identify anyone. The only things that leave your device are the eye-movement numbers listed above, relayed through our server to your clinician’s screen during a session. Camera video never leaves your device, in any session; in a remote session your clinician sees you through their own telehealth service, not through this tool.
Service providers we use
We share information with these providers only as needed to run the Service, and each receives only what its job requires:
- Microsoft — Azure hosts the Service; Azure OpenAI (including real-time voice and transcription) performs AI analysis and drafting; Azure AI Speech handles speech-to-text and text-to-speech; Azure AI Document Intelligence reads uploaded documents; Microsoft 365 provides sign-in (Entra ID), storage (OneDrive/SharePoint) and email and calendar (Outlook, via Microsoft Graph).
- Retell AI — places and answers intake phone calls, and records and transcribes them.
- Twilio — text messages and phone-number checks, where enabled. Messages are sent from fixed templates.
- Stripe — payment processing. Stripe receives the amount, a fixed product label and a de-identified reference — no health information.
- Xero and Gusto — accounting and contractor payments for practice staff; they do not receive patient records.
- Google Fonts — our typefaces load from Google, which receives your browser’s IP address. This is the only third party that can collect information about you across other websites through our pages.
We may also disclose information when required by law, or to protect the safety of a person.
Shine the Light. We do not disclose personal information to third parties for their own direct marketing.
Cookies, browser storage and Do Not Track
We use only essential cookies — the ones that keep you signed in and protect your session. We also use your browser’s local storage to remember preferences and unsaved drafts on your device. We do not use analytics, advertising or tracking cookies, and we do not track you across other websites. Because of that, the Service does not change its behavior in response to a browser’s Do Not Track signal — there is no cross-site tracking for it to switch off.
Your rights, including California residents
We honor these rights for California residents under the California Consumer Privacy Act (CCPA), whether or not the law’s size thresholds apply to us, and we extend them to everyone:
- to know what personal information we have collected about you, where it came from, why, and who received it;
- to get a copy of it;
- to have it deleted, and to have inaccurate information corrected;
- to opt out of the sale or sharing of personal information — we do neither, so there is nothing to opt out of, but you may still ask;
- to limit the use of sensitive personal information — we already use it only to provide the Service;
- not to be treated differently for using any of these rights.
How to ask. Email Ramezani@centercc.com with the subject “Privacy request”. We will confirm we received it within 10 business days and answer within 45 days (we may extend once by another 45 days and tell you why). We verify your identity by matching details we already hold, such as asking you to reply from the email on your account. An authorized agent may make a request for you with your signed permission; we may ask you to confirm your identity directly.
Information in a patient chart is held on behalf of the clinic or practice; we will pass requests about a chart to that practice and help it respond. Some information must be kept by law, and we will tell you when that applies.
Children
The Service is not directed to anyone under 18, and accounts are for adults only. A clinic may keep records about a minor patient in the Service under its own obligations as the minor’s care provider.
Security
Connections are encrypted, access to records is limited by role and logged, and data is stored in our Microsoft tenant. No system is perfectly secure; tell us at Ramezani@centercc.com if you believe your account or data has been exposed.
Changes and contact
When this policy changes we post the new version here with a new “Last updated” date, and for material changes we also email account holders. Questions or requests: Ramezani@centercc.com. Automated emails come from alltogether@centercc.com; replies to that address are not read.