Privacy Policy

Neo HealthTech LLC dba measurebasedcare.com (“we,” “our,” or “us”) operates Measure-Based Care (“MBC”), a web platform that helps mental health clinicians assign clinical measures, collect patient responses, and review scores over time. We are committed to protecting privacy and handling health-related information responsibly.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when clinicians and their staff use our platform, and when patients complete assessments sent by their care team. It applies to app.measurebasedcare.com and related services operated by Neo HealthTech LLC dba measurebasedcare.com (Neo HealthTech LLC).

Who this policy covers:

• Clinicians and practice staff who create accounts and manage patients
• Patients who receive one-time links to complete measures (patients do not create MBC accounts)

When a HIPAA-covered clinician uses MBC to collect protected health information (PHI), MBC generally acts as a business associate to that clinician or practice (the covered entity controls the patient relationship and health record). See our Business Associate Agreement overview for more information.

Clinician and staff accounts

We collect information you provide when registering or using the platform:

• Name, work email address, and authentication credentials
• Practice or organization name, role, and settings preferences
• Patient roster information you enter (e.g. name, email used for invites)
• Measure assignments, protocols, scores, and analytics you generate
• Support communications and product usage events (see Analytics below)

Patient measure responses

Patients access MBC only through secure, one-time links sent by their clinician. We may collect:

• Responses to clinical measure items and computed scores
• Submission timestamp and language preference (e.g. English or Spanish)
• Technical data needed to deliver the form (browser type, approximate device class)

We do not require patients to create user accounts. Identity is linked to the patient record maintained by the clinician.

Voice input (optional)

Some measures support optional voice input to select answers (e.g. saying “A” or “yes”). MBC does not receive, record, or store audio. Your browser's speech service converts speech to text to match an option; only the selected answer value is submitted to MBC.

Depending on your browser, speech recognition may be processed by your device or by your browser vendor's service (for example, Google's speech service in Chrome). Spoken content in voice mode is limited to short option labels, not free-form clinical narrative.

Device storage

To let patients resume an in-progress assessment, MBC may store draft answers in the browser's local storage on that device. Drafts can contain health-related information. Patients should complete assessments on a private device and close the browser when finished on shared devices.

We use collected information to:

• Operate the platform and authenticate clinician accounts
• Deliver measure invites, collect responses, score instruments, and show trends
• Send transactional emails (invites, reminders, completion notices to clinicians)
• Maintain security, prevent abuse, and troubleshoot issues
• Improve the product using aggregated, de-identified insights where possible
• Comply with legal obligations

Clinicians are responsible for determining the appropriate clinical use of measures and for their own professional obligations to patients.

We do not sell personal information. We share information only as described below:

• With the patient's care team: Measure responses and scores are available to the assigning clinician and authorized staff in the same practice organization, according to visibility settings.
• Service providers: We use infrastructure and service providers that help us host and operate MBC (for example, cloud hosting, email delivery). These providers process data on our instructions and under contractual safeguards. Our primary application infrastructure runs on Google Cloud under a HIPAA Business Associate Agreement where applicable.
• Legal requirements: When required by law, regulation, or valid legal process, or to protect rights, safety, and security.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to continued protection of your information.

Measure invite emails contain a link to complete an assessment. Patient email subject lines and body text use generic wording (for example, “check-in”) and do not name specific clinical instruments, to reduce inadvertent disclosure in shared inboxes or lock-screen previews. Clinician notification emails when a patient completes a measure do not include clinical scores or item-level responses.

Completing a check-in is voluntary. Patients who do not wish to participate may ignore an invite email — no clinical information is submitted unless the patient opens the link and submits responses. When a patient uses an explicit permanent-decline action (via email link or in-app), that choice is recorded, future reminders for that invite are suppressed, and the assigning clinician is notified. Choosing “Not now” on a welcome screen without permanently declining does not notify the clinician; the patient may return using the same link until it expires.

For clinician-facing product improvement, we may use privacy-conscious analytics on authenticated areas of the platform (for example, the clinician dashboard). Patient measure pages (/r/…) do not load third-party analytics scripts. We do not use session recording on clinical workflows.

We implement technical and organizational measures appropriate for health-related data, including:

• Encryption in transit (TLS) for data sent over the internet
• Encrypted database connections and access controls in production
• Hashed storage of invite tokens; single-use submission semantics
• Host and origin restrictions in production environments
• Audit-oriented logging and backup practices for production databases

No method of transmission or storage is completely secure. Clinicians should use strong passwords and follow their organization's security policies.

The following is our proposed retention posture (subject to advisor review and applicable law):

• Measure submissions and patient records: Retained for the duration of the active clinician or organization account and the treatment relationship you maintain, unless a shorter period is required by law or agreed in writing.
• Expired invites (no submission): Invite metadata retained up to 90 days for operational and audit purposes, then deleted or anonymized.
• Declined invites: Decline records retained up to 1 year for audit and dispute resolution.
• Account deletion: Upon confirmed clinician account deletion, PHI is purged or returned within 30 days after any export window you request, except where longer retention is required by law or secure backup schedules (backups roll off per our infrastructure retention policy).

Contact us with questions about export or deletion before these periods elapse.

Clinicians

You may access, update, or delete your account through Settings, subject to organizational policies. You control patient records you create and measure sends you initiate.

Patients

Because patients do not have MBC accounts, requests to access, amend, or delete measure responses should generally be directed to your clinician or practice, who controls your health record. You may choose not to complete a check-in without submitting responses.

Depending on your state of residence, you may have additional privacy rights under state consumer health privacy laws. Contact us and we will work with your clinician where appropriate to honor valid requests.

MBC is intended for adult patients in its current version. We do not knowingly design workflows for minors or parent-proxy completion. If use with adolescents or minors is introduced in the future, we will update this policy and consent flows accordingly.

MBC is US-focused for its initial release. The platform may be accessed from other locations, but we do not represent that our practices satisfy non-US legal requirements. Clinicians outside the United States should evaluate local requirements before use.

MBC measure forms are not monitored in real time and are not a substitute for emergency services. If you are in crisis or thinking about harming yourself, call or text 988 (Suicide & Crisis Lifeline) or your local emergency number immediately.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the “Last updated” date. Material changes may also be communicated to registered clinicians by email or in-product notice.

Questions about this Privacy Policy or our data practices (monitored shared mailbox):

• Privacy: info@measurebasedcare.com
• General support: support@measurebasedcare.com

See also our Terms of Service.