Privacy Policy
A Gifted Journey LLC (“A Gifted Journey,” “we,” “us,” or “our”) provides applied behavior analysis (ABA) therapy, behavior consulting, and advocacy services in the Dallas–Mesquite, Texas area. This policy explains what information we collect through agiftedjourney.com and the AGJ Portal mobile application, how we use it, and the choices you have.
A note on your health records. A Gifted Journey is a healthcare provider subject to HIPAA. The way we handle your protected health information in the course of treatment, payment, and healthcare operations is governed by our Notice of Privacy Practices, which is a separate document provided to you at intake. Where this policy and the Notice of Privacy Practices differ regarding your health information, the Notice of Privacy Practices controls. Ask us any time for another copy.
1. Information we collect
Information you give us
| Category | Examples |
|---|---|
| Account information | Name, email address, phone number, password |
| Family and client information | Parent or guardian name, child's name and date of birth, relationship to the child, mailing address |
| Health information | Diagnosis, treatment plans, session notes, progress data, supervision records, insurance coverage and authorizations |
| Billing information | Invoices, balances, payments recorded, insurance explanations of benefits |
| Documents you upload | Insurance cards, evaluations, signed consent forms, correspondence |
| Messages | Secure messages you exchange with your care team through the portal |
| Employment information | For staff: credentials, supervision hours, session logs, signatures |
Information collected automatically
- Device identifiers — a push notification token so we can alert you that something needs your attention in the app
- Basic technical data — device type and operating system version, used to keep the app working correctly
- Sign-in activity — timestamps of account access, kept as a security safeguard
We do not use advertising identifiers, third-party analytics trackers, or advertising networks. We do not track you across other companies' apps or websites. We do not sell your information.
Face ID, Touch ID and fingerprint sign-in
If you enable biometric sign-in, the authentication happens entirely on your device using your phone's own security hardware. We never receive, see, or store your fingerprint or face data. Your device simply tells our app whether the check passed.
2. How we use your information
- To provide ABA therapy, consulting, and advocacy services to your family
- To give you and your care team secure access to records, documents, and messages
- To bill you and your insurance carrier, and to record payments
- To send you notices about invoices, appointments, documents needing signature, and new messages
- To meet our clinical documentation, supervision, and licensing obligations, including BACB supervision requirements for our staff
- To protect the security of accounts and detect misuse
- To comply with legal, regulatory, and accreditation requirements
We do not use your information for advertising, profiling, or automated decision-making.
3. When we share information
We share your information only in these circumstances:
- Your care team. The BCBAs, RBTs, and administrative staff involved in your child's care.
- Insurance carriers. To obtain authorization and submit claims, consistent with the coverage you have given us.
- Service providers who help us operate. These vendors process information on our behalf and are contractually bound to protect it. Where they handle protected health information, we maintain a Business Associate Agreement with them.
- Supabase — secure database, authentication, and encrypted file storage
- Resend — transactional email delivery
- Twilio — text message delivery
- Expo — push notification delivery
- Netlify — website hosting
- Microsoft 365 — practice email
- When the law requires it. In response to a valid subpoena, court order, or mandatory reporting obligation, including our duty to report suspected abuse or neglect under Texas law.
- With your written authorization. Any other disclosure, such as sending records to a school district or another provider, happens only after you authorize it in writing.
We do not sell your personal information, and we never have. We do not share it with advertisers or data brokers.
4. Children's information
Our services are designed for children, but the AGJ Portal app is intended for use by parents, legal guardians, and our staff — not by children directly. Accounts may only be created by an adult who is 18 or older.
Information we hold about a child is provided by that child's parent or legal guardian, or generated by our clinicians during treatment. We do not knowingly permit a child under 13 to create an account or submit information to us directly. If you believe a child has created an account, contact us at (972) 379-9131 and we will remove it.
A parent or legal guardian may review, request corrections to, or request a copy of their child's record at any time.
5. How we protect your information
- All information travels over encrypted connections (TLS/HTTPS). The app will not transmit over an unencrypted connection.
- Information is encrypted at rest in our database and file storage.
- Access is enforced at the database level with row-level security, so an account can only ever retrieve its own records.
- Staff access is limited by role to what each person needs to do their job.
- Optional biometric or password protection secures the app on your device.
- Text messages and push notifications are deliberately kept generic — they never include names, amounts, appointment details, or message previews, because those channels are not secure.
No system is perfectly secure. If a breach affecting your protected health information occurs, we will notify you as required by HIPAA's Breach Notification Rule and Texas law.
6. How long we keep information
Texas law and our insurance agreements require us to retain clinical and billing records for a minimum period — generally seven years after the last date of service, and for a minor, until the child's 21st birthday, whichever is longer. We keep records for at least that long.
Account information that is not part of your clinical or billing record — your login, notification preferences, and device tokens — is deleted when you delete your account.
7. Your rights and choices
You may:
- Request a copy of your or your child's records
- Ask us to correct information you believe is inaccurate
- Request an accounting of certain disclosures we have made
- Ask us to communicate with you in a particular way or at a particular address
- Turn off push, email, or text notifications at any time in the app under Account → Notifications
- Withdraw your consent to text messages by replying STOP to any message
- File a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights, without retaliation
Your full rights regarding health information are described in our Notice of Privacy Practices. To exercise any of them, call us at (972) 379-9131 or email jelisia.thompson@agiftedjourney.com.
8. Deleting your account
You can delete your account at any time from inside the AGJ Portal app: Account → Delete account. You'll confirm with your password. You can also request deletion by calling (972) 379-9131 or emailing jelisia.thompson@agiftedjourney.com, or by visiting our account deletion page.
What deletion does and doesn't do. Deleting your account removes your login, your profile, your notification preferences, and your device tokens. It ends your access to the portal.
It does not delete your child's clinical and billing records. We are legally required to retain those for the periods described in section 6, and we cannot delete them on request. After your account is deleted, those records remain with the practice, no longer connected to a portal login, and continue to be protected under HIPAA and this policy.
9. Text messages and notifications
If you provide a mobile number and check the consent box, we may text you about appointments and account updates. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Consent to receive texts is not a condition of receiving services. Full terms are on our SMS Terms page.
Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party except the messaging provider that delivers the message on our behalf.
Push notifications can be turned off in the app under Account → Notifications, or in your device's system settings.
10. Changes to this policy
If we make a material change, we will update the date at the top of this page and, where the change is significant, notify you through the portal or by email. Continued use of the app after a change means you accept the updated policy.
11. How to contact us
Questions, requests, or complaints about privacy:
A Gifted Journey LLC
Attn: Privacy Officer — Jelisia Thompson, M.S., BCBA, LBA
Mesquite, Texas
Phone: (972) 379-9131
Email: jelisia.thompson@agiftedjourney.com
You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.