Privacy Policy

This Privacy Policy governs the manner in which AskSAMIE, Inc. ("Company") collects, uses, maintains, and discloses information collected from users (each, a "User") of OTConnected at otconnected.com and the AskSAMIE website at www.asksamie.com. This privacy policy applies to both websites and all products and services offered by the Company.

Information Collection and Use

The Company is the sole owner of the information collected on this site. The Company only has access to and collects information that Users voluntarily provide via email, account registration, or other direct interaction with the platform. Users may be asked for, as appropriate, name, email address, professional credentials, state of practice, practice model preferences, and payment information. This information will be used to fulfill the User's request for information and/or services, personalize their experience (such as Practice Launch roadmaps), and operate platform features. The Company will not sell or rent this information to anyone.

When Users interact with the Knowledge Base AI assistant (SAMIE), queries are processed through third-party AI services (OpenAI) to generate responses. Query logs are retained to measure and improve answer quality. We do not use User queries to train third-party AI models.

SMS Terms and Conditions

By opting in to SMS messaging from AskSAMIE, you consent to receive text messages (SMS) from us regarding our products and services. These messages may be sent via automated systems.

• If assistance is required, customers can reply HELP for more information.
• If customers no longer wish to receive SMS from us, they can unsubscribe by replying STOP to no longer receive messages.
• Message and data rates may apply.
• Message frequency may vary.
• No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent.

Use of Cookies

The Company uses "cookies" to enhance User experience. User's web browser places cookies on their hard drive for record-keeping purposes and sometimes to track information about them. We use session cookies for authentication, Google Analytics for anonymized usage data, and Microsoft Clarity for anonymized session behavior analysis. User may choose to set their web browser to refuse cookies, or to alert them when cookies are being sent. If they do so, note that some parts of the site may not function properly.

Third-Party Service Providers

The Company uses third-party services to operate the platform. These providers process data on our behalf under contractual obligations and include:

• Stripe — Payment processing for subscriptions
• Apple — In-app purchase processing for mobile subscriptions
• OpenAI — AI-powered Knowledge Base responses
• TalentLMS — CEU course delivery
• Amazon Web Services — Cloud hosting and data storage
• Google Analytics — Website usage analytics
• Microsoft Clarity — UX behavior analytics
• Sentry — Error monitoring and reporting
• Cal.com (self-hosted on Google Cloud Platform) — Appointment scheduling and calendar synchronization
• Google Cloud Platform — Hosting for the scheduling service and storage of booking and calendar data
• Amazon Web Services (SES) — Booking and transactional email delivery, under a business associate agreement
• Mailchimp (Mandrill) — Marketing and other non-PHI email delivery
• Cloudflare — Content delivery, network security, and bot protection (Turnstile)

Scheduling, Bookings, and Calendar Integrations

OTConnected offers an appointment-scheduling feature that connects individuals seeking occupational therapy services ("Clients") with participating providers ("Providers").

Booking information. When a Client books an appointment, we collect the Client's name, email address, phone number, the selected provider and service, the appointment date and time, and — if the Client chooses to provide it — an optional free-text reason for visit. A reason for visit is optional and can reveal information about your health. We share the information you enter when booking, including any reason for visit, with the occupational therapy Provider you select so they can schedule and prepare for your appointment; we act as a facilitator that transmits this information at your request, and once your Provider receives it, the Provider is responsible for it under the Provider's own privacy practices. We also use this information to create and manage the booking, send confirmation and reschedule or cancellation notices, and notify the relevant Provider. Because a booking may indicate that an individual is seeking health-related services, we treat booking information as sensitive (see "Protected Health Information" below).

Calendar connections (Google and Microsoft). Providers may choose to connect a Google Calendar or Microsoft Outlook calendar so the platform can check their availability and, if the Provider enables it, add confirmed appointments to their calendar. When a Provider connects a calendar, we request authorization through Google's or Microsoft's standard OAuth consent screen. We use this access only to (1) read free/busy times to prevent double-booking, and (2) create, update, or remove the appointment events that the platform manages on the Provider's behalf. We do not read, store, or use the contents of unrelated calendar events. Providers can disconnect a calendar at any time from their profile settings, which revokes our access and deletes the stored authorization tokens.

Calendar scheduling is provided through a self-hosted instance of Cal.com running on Google Cloud Platform; authorization tokens for connected calendars are stored encrypted.

Google API Services Limited Use. AskSAMIE's use and transfer of information received from Google APIs to any other application adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not transfer or use it for any purpose other than providing and improving the scheduling features described above. Use of information received from Microsoft Graph is likewise limited to providing these scheduling features.

Protected Health Information

Certain information processed through the scheduling and provider-directory features — such as the fact that an individual has booked or inquired about an appointment with an occupational therapy provider, and any reason for visit they provide — may constitute protected health information. We store this information encrypted in transit and at rest, limit access to personnel who need it to operate the service, and host it with cloud providers (Amazon Web Services and Google Cloud Platform) under business associate agreements where applicable. Please see our Terms of Service for additional terms governing the scheduling features.

AskSAMIE is a technology marketplace, not your healthcare provider. In most cases the booking information you give us is governed by this Privacy Policy. In limited cases where a Provider engages us to handle health information on their behalf as a HIPAA "business associate," that protected health information is governed by HIPAA and by the Provider's Notice of Privacy Practices rather than by this Policy.

Communications from the Company

The Company may use User's personal information to send User information and updates pertaining to their account, subscription, or service requests. User may also receive periodic Company news, updates, related product or service information, etc. If at any time the User would like to unsubscribe from receiving future emails, the Company includes detailed unsubscribe instructions at the bottom of each email.

Community Content

Content that Users post to the OTConnected community feed is visible to other authenticated users according to the visibility settings chosen by the User (public, private, or followers-only). Users are responsible for the content they share. Community content may remain visible after account deletion but will be disassociated from the User's identity.

Security

The Company takes precautions to protect User's information. When Users submit sensitive information via the website, their information is protected both online and offline. Wherever the Company collects sensitive information (such as credit card data), that information is encrypted and transmitted in a secure way. Users can verify this by looking for a lock icon in the address bar and looking for "https" at the beginning of the address of the web page.

While the Company uses encryption to protect sensitive information transmitted online, the Company also protects User information offline. Only employees who need the information to perform a specific job (for example, billing or customer service) are granted access to personally identifiable information. Our infrastructure is hosted on Amazon Web Services (AWS) with encryption at rest and in transit.

Data Retention

We retain User account data for as long as the account is active. If a User deletes their account, we will remove personal information within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, financial records). Knowledge Base query logs are retained in anonymized form for platform improvement. Appointment booking records are retained for as long as needed to provide the scheduling service and to meet legal, tax, and recordkeeping obligations. Calendar authorization tokens are deleted when a Provider disconnects their calendar or deletes their account.

User Rights

Depending on location, Users may have the right to access, correct, or delete their personal data, opt out of marketing communications, or request data in a portable format. To exercise any of these rights, contact us at hello@asksamie.com. We will respond within 30 days.

Third Party Links

The website may contain links to other sites. Please be aware that the Company is not responsible for the content or privacy practices of such other sites. The Company encourages Users to be aware when they leave the website and to read the privacy statements of any other site that collects personally identifiable information.

Children's Privacy

OTConnected is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will delete it promptly.

Changes to this Privacy Policy

The Company has the discretion to update this Privacy Policy at any time. When the Company does, it will revise the updated date at the top of this page. User acknowledges and agrees that it is their responsibility to review this Privacy Policy periodically and become aware of modifications.

Acceptance of Terms

By using this website, User signifies their acceptance of this policy and terms of service. If the User does not agree to this policy, please do not use the website. The Company reserves the right to make changes to this policy, or any portion thereof, at any time and in its sole discretion, and User agrees to be bound by such changes.

Contacting the Company

If you have any questions about this Privacy Policy, the practices of this site, or your dealings with this site, please contact the Company at: