Privacy Policy
Divinity, LLC provides Divinity Behavior Tracker, a facility-facing behavioral documentation service. This Privacy Policy explains how we handle information through our public website at mydivinity.net, our business communications and authorized app services. Our privacy contact is support@mydivinity.net.
1. Two different information streams
Resident documentation. Facilities and authorized users supply resident records for agreed services. We handle those records on the customer's behalf under its instructions, applicable law and the relevant BAA or other data agreement. This public policy is not the facility's HIPAA Notice of Privacy Practices, a BAA or consent to use resident information for advertising.
Business and website information. We handle contact requests, facility purchasing, user administration, support and website operations for the purposes described below. An individual's business contact details are different from the resident records in the documentation system.
2. Information we collect
Business inquiries. When you contact us or ask about a plan, we may receive your name, work email, organization, role, business telephone if supplied, state, facility type, business needs selected from provided choices and the contents of your business correspondence. We use these to respond, arrange the discussion you asked for and manage the requested relationship. Do not include a resident's health information.
Accounts and app administration. We process work contact information, the organization and role associated with your account, authentication and account status, user preferences, and records of required agreement acceptance (which document and version you accepted, when, and from what address and browser). We use these to provision access, maintain security and support authorized use.
Facility documentation. Depending on the customer's authorized scope, records may contain resident identifiers, care-plan context, observations, staff assistance, outcomes, dates and times, source selections, authored notes and edit history. We process them to provide the customer's contracted documentation, storage, support and export functions. We do not independently turn these records into marketing leads.
Billing. We process the purchasing organization's details, selected subscription, invoices, payment status and transaction references. Our payment provider, Stripe, processes the card details entered in its own checkout; Divinity receives the customer and subscription references and the payment status, not the card number. Do not place resident identifiers in orders, notes, payment descriptions or receipts.
Technical and support information. Our systems may record IP address, browser/device information, timestamps, requested public pages, authentication/security events and necessary error details. These support security, troubleshooting and operation, not a claim that all usage is anonymous. Support attachments containing resident data belong only in the approved secure support channel, subject to customer authorization.
3. Sources and purposes
We receive information directly from you, the facility and its administrators, approved service providers, and the platforms through which you choose to contact us. Where a facility connects its own IntakeQ account, we read the client records it directs us to and never write back to IntakeQ. We use information to supply requested services; establish and administer accounts and orders; provide support; protect systems and records; meet lawful requests and preservation duties; and send separately requested product communications.
We do not use resident documentation, care-plan content, diagnoses, staff charting activity or clinical app events to build advertising audiences. We do not sell resident information or use it to train or improve general-purpose AI models. Optional external AI functions, if offered, require a separate approved arrangement identifying their actual purpose and provider; this policy alone does not authorize them.
4. Sharing and providers
We disclose information to approved service providers only for the authorized function, with protections appropriate to the information and relationship. Our current providers are: Google Cloud (application hosting, database, secret storage and builds, in the United States); Firebase Authentication, a Google service, for sign-in; Stripe for subscription payments; IntakeQ only where a facility connects its own IntakeQ account for import; and Meta for advertising measurement on the public website and the sign-up page only, as described in section 5. Services that handle PHI require the applicable contractual and security review. Questions about providers: support@mydivinity.net.
We may also disclose records at the customer's lawful direction, to a verified authorized recipient, or as law permits or requires. We assess legal demands and limit disclosure accordingly. Advisors and incident responders receive information only as needed and under appropriate duties. A genuine corporate transaction must preserve lawful restrictions and safeguards; it is not permission for an unrelated sale or new use of health data.
5. Advertising, social media and cookies
We promote Divinity on platforms such as Facebook, Instagram and professional channels. Those platforms process activity on their own services under their privacy terms. When you submit a business lead form there, we receive the fields and choices the form identifies. Keep resident and sensitive personal health information out of social-media comments, messages and lead forms.
Advertising measurement on the public website and the sign-up page. We use the Meta Pixel on our public marketing pages and on the app's sign-up page, and nowhere else, so we can tell which of our Facebook and Instagram ads bring people to the site and whether they go on to start a free trial. The Pixel sets the _fbp and _fbc cookies and sends Meta your IP address, browser information, the marketing pages you visit, whether you sent an inquiry, and whether a facility account was created. It does not send the contents of any form, the facility name, your name or your email address. Meta processes that information under its own terms, may match it to your Facebook or Instagram account, and may use it to show you Divinity ads. For visitors Meta places in California we enable Meta's Limited Data Use setting. Meta also receives the same events through its Conversions API, a server-to-server route Meta operates so that an event the Pixel reported still arrives if your browser interrupts the connection; it carries nothing the Pixel does not, and when you opt out the Pixel never loads, so there is nothing for it to relay. Under California law this measurement may count as “sharing” for cross-context behavioral advertising, which is why we offer the opt-out below even where that law does not yet apply to us.
You can opt out in any of these ways: turn on Global Privacy Control in your browser, which we treat as an opt-out and do not load the Pixel; use the button below, which stores an opt-out flag in this browser only so the Pixel will not load for you on this site or the sign-up page while the flag is set; or change your advertising preferences in your Facebook or Instagram account settings.
Do Not Sell or Share My Personal Information
Checking your current setting…
Where there is no advertising technology. Past the sign-up page, we do not place the Meta Pixel, or any other advertising or analytics tag, anywhere in the Divinity app: not on the sign-in page and not on any page where resident documentation is entered or shown. The sign-up page switches the Pixel off again the moment you leave it. We never send Meta resident information, facility records, names, email addresses or anything typed into a form. We do not use session replay. The app keeps a sign-in token in your browser so you stay signed in, and signs you out after a period of inactivity. Necessary technical logs support security, authentication and requested functions. A public advertisement on another platform is not a statement that that platform's technology is installed in the app.
Additional analytics or advertising technology will not be added under an inaccurate notice. Any approved change requires an updated description, legally required choices and consent, and controls that prevent prohibited or unauthorized health-data transfer. A cookie choice never overrides a restriction on PHI disclosure or a platform's prohibited-data rules.
6. Retention and safeguards
We retain business information for the period needed for the relationship, requested communications, security, documented legal obligations and legitimate dispute handling. We review inactive leads and unnecessary logs for deletion under our adopted retention schedule rather than keeping everything indefinitely. Customer records follow the applicable data agreement, customer directions, preservation requirements and documented backup-disposition process; ending a subscription is not a request to destroy required records immediately.
We use safeguards appropriate to the information and service. No internet service can guarantee absolute security. Sensitive incident details, keys and internal security procedures are not published as part of this policy.
7. Choices and rights requests
For product emails, use the unsubscribe instruction or contact support@mydivinity.net. Necessary nonpromotional account, billing and security messages may continue. An inquiry is not agreement to recurring marketing texts, prerecorded calls or sale of personal information.
For your business/contact information, contact support@mydivinity.net to request access, correction, deletion or other rights available under applicable law. We verify identity and authority proportionately and respond within the applicable period. We will not require unnecessary health data to verify a business request.
For a resident record, contact the facility responsible for the record. Requests sent to Divinity are routed promptly to that customer, and we assist it as required; this does not eliminate any independent rights or duties. Do not send identity documents or full clinical records through public forms. We provide an appropriate secure channel when necessary.
Where Washington's My Health My Data Act applies to a nonexempt consumer-health-data activity, we provide its required separate policy and rights process through a distinct homepage link before that activity begins. A HIPAA-related relationship does not exempt every dataset or marketing activity. We do not use a generic policy acknowledgment as the separate health-data consent or authorization required by law.
8. Scope, links and changes
The service is designed for authorized adult business users, not child-directed public use. Facilities may submit only records within their approved scope. Public website availability does not mean the app is offered for every jurisdiction, resident population or clinical function.
Linked services have their own privacy practices. We identify policy changes by version and date, provide legally required notices and choices, and do not apply a changed notice retroactively to authorize prohibited or incompatible use of information. Contact support@mydivinity.net with questions or a concern.