Privacy Policy

LeadDash Marketing LLC, doing business as LeadDash ("LeadDash," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It covers our website, our text messaging program, the LeadDash platform, LeadDash EHR, including the LeadDash EHR app for iPhone and the client portal practices offer their clients, and LeadDash Employees. LeadDash Employees has its own privacy policy at employees.leaddash.io/privacy, and Section 6 below covers Google user data for both LeadDash EHR and LeadDash Employees.

1. Information We Collect

We collect the following types of information:

Personal Information

• Name, email address, phone number, physical address
• Payment information when you make a purchase or request a quote
• Opt-in records and timestamps for all communication channels (SMS, email, and others)

Non-Personal Information

• IP address, browser type, and device information
• Website usage patterns and analytics
• Cookies and similar technologies

Customer Communication

• Records of inquiries and service requests
• Appointment details and preferences
• Service history and feedback

Practice Staff Using LeadDash EHR

• Name, work email address, and, if you add one, a mobile phone number for sign-in codes
• Role, permissions, supervisors, credentials (such as NPI, taxonomy, and license), working hours, and photo, as entered by you or your practice
• Sign-in and activity records, including the time and IP address of sign-ins, signed notes, and changes to records, kept as the audit trail HIPAA requires
• If you turn on notifications, a notification token for your device

Health Information Practices Keep in LeadDash EHR

• What a practice enters or its clients provide: demographics, contact details, appointments, diagnoses, treatment plans, progress notes, forms, assessments, documents, messages, insurance coverage, claims, invoices, and payments
• DashNotes recordings, when a clinician chooses to record a session so a draft note can be written for the clinician to review, edit, and sign

Section 4 explains how we handle this health information.

2. How We Use Your Information

We use collected data for:

• Providing and improving our services
• Processing transactions and payments
• Communicating with you about your inquiries, appointments, and promotions
• Enhancing website functionality and user experience
• Ensuring security and fraud prevention
• Maintaining records of your communication preferences and consent
• Signing people in to LeadDash EHR, keeping accounts secure, and keeping the audit trail
• Sending a practice's appointment reminders, form links, and portal notices, and sending practice staff the notifications they turn on

3. SMS Messaging & Compliance

Text Message Program Terms & Conditions. By opting into our SMS messaging services, you agree to receive text messages related to our services, including appointment reminders, customer support, and important updates.

Opt-In & Consent

• You will only receive messages if you have explicitly opted in
• We maintain timestamped records of all opt-in actions
• We comply with the Telephone Consumer Protection Act (TCPA) and all applicable laws

Opt-Out Instructions

• You can cancel SMS notifications at any time by replying "STOP"
• You will receive a final confirmation message, and no further messages will be sent unless you re-opt in
• All opt-out requests are processed immediately

Message Frequency & Content

• Message frequency varies based on your interactions with our business
• Messages will be directly related to the services you have requested
• We do not send promotional content without specific consent

Help & Support

• Reply "HELP" for assistance, or contact us at [email protected]
• Customer support is available during regular business hours

Carrier Information

• Standard message and data rates may apply
• Carriers are not liable for delayed or undelivered messages
• Supported carriers include AT&T, Verizon, T-Mobile, and most regional carriers

SMS Data Protection Statement

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent, and this information will not be shared with any third parties.

We implement strict data protection measures to safeguard your SMS opt-in information and consent records.

4. LeadDash EHR and Health Information

Each practice that uses LeadDash EHR is a covered entity under the Health Insurance Portability and Accountability Act (HIPAA), and LeadDash is its business associate. The practice owns the client records it keeps in LeadDash EHR. We create, receive, keep, and transmit that protected health information only to provide the services to the practice, as the Business Associate Agreement in our agreement with the practice permits.

• We do not sell or rent health information, and we do not use it for advertising
• We do not use protected health information to train, fine-tune, or improve artificial intelligence models, and we require our AI providers not to use it for training either
• DashNotes recordings are turned into text and a draft note using providers set to keep no data after each request
• Telehealth audio and video pass between the clinician and the client during a session and are not recorded unless the clinician chooses to record for DashNotes

If you are a client of a practice and want to see, correct, or get a copy of your records, or ask how they are used, contact your practice. It decides how its records are used and disclosed.

5. The LeadDash EHR App for iPhone

• Face ID, Touch ID, and passcode. The app locks when it opens and when it is reopened after a minute away. Unlocking is handled entirely by the iPhone. LeadDash never receives your face, fingerprint, or passcode, only whether the unlock succeeded.
• Camera and microphone. Used only during a telehealth session, or when a clinician chooses to record a session for DashNotes. The app asks permission first, and you can change it at any time in the iPhone Settings app.
• Notifications. If you turn them on, we keep your device's notification token so Apple can deliver practice notifications, such as new bookings, cancellations, and messages. Notifications name clients by initials only. Turning notifications off removes the token.
• No tracking. The app has no advertising and no third-party analytics, and it does not track you across other companies' apps or websites.
• Session limits. You are signed out after 60 minutes of inactivity and after 12 hours in any case, and the screen is covered whenever the app leaves the foreground.

6. Google User Data

LeadDash EHR and LeadDash Employees can connect to a Google account when a user chooses to connect it. We request access to Google Calendar events (the calendar.events permission) and use it only for the features the user turns on.

• LeadDash EHR. We read the start and end times of events on the calendars a clinician connects, so those times show as busy and cannot be booked. We add the clinician's scheduled sessions to their Google Calendar and update or remove them when a session is moved or cancelled. Session events show only the word "Session," the client's initials, and the time. No client names, diagnoses, or other health information are written to Google. We do not store the titles, descriptions, attendees, or locations of a clinician's other Google Calendar events.
• LeadDash Employees. We add the events the user approves, as described at employees.leaddash.io/privacy.

Google user data is used only to provide these features. It is not sold, not used for advertising, not used to train or improve artificial intelligence models, and not shared with anyone except as needed to provide these features, to comply with the law, or with the user's consent. A user can disconnect Google at any time from their account in LeadDash EHR or LeadDash Employees, or from their Google Account settings. We then stop accessing their calendar and delete the access we stored.

LeadDash's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Information Sharing & Disclosure

We do not sell, rent, or trade personal information. We may share information with:

Service Providers

• Third-party vendors who assist in our operations, such as payment processing and appointment scheduling
• SMS aggregators and providers solely for the purpose of delivering messages you have consented to receive
• For LeadDash EHR: cloud hosting and email in United States data centers, a claims clearinghouse to send insurance claims and receive payer remittances, speech-to-text and AI note-drafting providers for DashNotes, Apple to deliver notifications to iPhones, and Google Calendar for clinicians who connect it, as described in Section 6
• All service providers are contractually obligated to maintain confidentiality and security. Providers that handle protected health information are bound by business associate terms, and any limit on that coverage is disclosed to the practice in our agreement before the related feature is turned on.

Legal Compliance

• If required by law, legal process, or to protect our rights
• In response to valid law enforcement requests or court orders
• For protected health information, only as HIPAA and the Business Associate Agreement permit

Business Transfers

• In the case of mergers, acquisitions, or sale of assets
• In such cases, your data remains protected under the terms of this policy and, for health information, the practice's Business Associate Agreement

All of the above categories exclude text messaging originator opt-in data and consent. This information will not be shared with any third parties, other than the aggregators and providers of the text message services.

8. Data Security

We implement and maintain reasonable security measures to protect your personal information:

• Encryption of sensitive data in transit and at rest
• Secure access controls and authentication mechanisms, including one-time sign-in codes in place of passwords and access limited by each practice's roles and permissions
• Audit logs of access to and changes in health records
• Regular security assessments and updates
• Employee training on data protection
• Breach notification protocols in accordance with applicable laws, including notice to the practice of any breach of unsecured protected health information as HIPAA and the Business Associate Agreement require
• Secure backup systems and disaster recovery procedures

Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure. We strive to use commercially acceptable means to protect your personal information, but we cannot guarantee absolute security.

9. Data Retention

Health records in LeadDash EHR are kept for as long as the practice's account is active, and practices can export their records at any time. When a practice's account ends, the practice has 30 days to export its records, and we then delete or de-identify them within 90 days, except where the law or the Business Associate Agreement requires otherwise. Copies in backups are overwritten on our normal backup schedule. We keep other information for as long as needed for the purposes in this policy and as the law requires.

10. Cookies & Tracking Technologies

We use cookies and similar technologies on our website to:

• Analyze site traffic and user behavior
• Remember your preferences
• Improve website functionality and user experience
• Measure the effectiveness of our services

You may control cookies through your browser settings. Disabling cookies may limit your ability to use certain features of our website. LeadDash EHR uses browser storage only to keep you signed in and remember your settings, and the LeadDash EHR app for iPhone does not track you across other companies' apps or websites.

11. Your Rights & Choices

You have the right to:

• Access, update, or delete your personal information
• Opt out of marketing emails by clicking "unsubscribe" in our emails
• Opt out of SMS messages by replying "STOP"
• Request information on how we process your data
• Withdraw consent at any time for future communications
• Lodge a complaint with a supervisory authority if you believe your rights have been violated

Practice staff can update their own details in My account in LeadDash EHR, and practice administrators manage team accounts on the Team screen. Clients of a practice should contact the practice about their health records, as described in Section 4. You can turn off notifications, camera, and microphone access for the LeadDash EHR app at any time in the iPhone Settings app.

To exercise these rights, please contact us using the information in Section 15.

12. Children

Our website and LeadDash EHR accounts are not directed to children under 13, and LeadDash EHR accounts are for adult practice staff. A practice may keep records for clients who are minors, which the practice manages with a parent or guardian as the law requires.

13. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices, and we encourage you to review their policies. This Privacy Policy applies only to information collected by LeadDash.

14. Changes to This Privacy Policy

We may update this policy periodically. The latest version will always be available on our website with the effective date. For significant changes, we will notify you by email or through a notice on our website, and we will tell practices that use LeadDash EHR directly.

15. Contact Us

If you have questions about this Privacy Policy or how your information is handled, contact us at:

By using our website and services, you consent to this Privacy Policy.