Effective date: July 10, 2026 · Last updated: October 21, 2026
Passalong ("we," "us") provides a closed communication and workflow app for
ABA therapy clinics, their staff, and the parents/guardians of the children
they serve. This policy explains what we collect, why, and your choices.
Passalong is intended for use by adults (clinic staff and parents/guardians).
Children do not create accounts or use the app.
Information we collect
Account information: your name, email address, role, and clinic, provided by your clinic administrator when your account is created.
Content you or your clinic create: messages, clinic announcements, session notes (which may include health-related information about a learner, such as mood, food intake, and therapy targets), and photos you choose to upload. Location metadata is removed from photos before upload.
Learner records: a learner's name, photo, and care-team/parent assignments, entered by clinic administrators.
Technical records: account identifiers, a device token for push notifications, and security audit logs of sign-ins and data access, kept for safety and legal compliance.
What we do NOT do
No advertising, no sale or sharing of personal data with data brokers, ever.
No tracking across other companies' apps or websites.
No third-party analytics or crash-reporting inside the app.
Push notifications never include names, message text, or health information.
How we use information
Solely to operate Passalong: deliver messages, notes, announcements, and
photos to the right people; enforce role-based access (each user sees only
their own clinic and assigned learners); secure and audit the service; and
comply with legal obligations, including health-records laws.
Service providers
We process data on secured infrastructure provided by Amazon Web Services
(hosting, authentication, email delivery) and deliver push notifications via
Apple. These providers process data only on our behalf.
Retention and deletion
Your clinic is responsible for its own clinical and session records. Some
information may be retained where required by law. To request deletion or deactivation of
your account, use Profile → Request Account Deletion in the
app or email support@passalong.io.
Do not include any health information in the email.
Security
Data is encrypted in transit (TLS) and at rest, access is enforced with
role-based, row-level security, and security-relevant actions are audit-logged.
Your choices
Manage notification permissions in iOS Settings.
Request access, correction, deletion, or deactivation at support@passalong.io. Requests about clinic records are forwarded to your clinic.
Parents/guardians: questions about your child's records can also be directed to your clinic.