Privacy Policy | Traumalis

1. OVERVIEW

Traumalis, LLC, a Georgia limited liability company (“we,” “our,” or “us”), provides a self-guided digital wellness tool. The Service is offered only to users in the United States. This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices available to you.

We make the Service available in two ways, and parts of this Policy apply differently depending on how you use it:

“Individual Users” are individuals who purchase and use the Service directly, without a healthcare organization.
“Organizational Users” are healthcare organizations and the licensed clinicians who administer the Service to their patients, together with those patients.

Where a section applies only to one type of user, we say so.

2. INFORMATION WE COLLECT

2.1 From Healthcare Organizations (Organizational Users):

Account and billing information
Access configurations
Contractual and contact information for agreement purposes
Service usage analytics and support communications

2.2 From Clinicians (Organizational Users):

Name and email for account setup
Session activity and application usage data
Support requests

2.3 From Patients (via Clinician-Administered Sessions):

Patient data is collected through the healthcare organization and processed under clinician oversight. We do not collect information that we use to identify individual patients. Data collected includes:

Session data, including session responses, self-reported distress ratings, cognitive, emotional and physical assessments, and other data generated during use of the Service
Technical data such as session timestamps and device/browser information

2.4 From Individual Users (Direct Users):

When you use the Service directly, without a healthcare organization, we collect:

Your email address -- the only piece of identifying information we ask for. Starting a Session requires a valid email and nothing else: there is no account, we do not ask for your name, and we do not link your email to your screening or session data, so we cannot see who you are or what you worked on. The email is how the first Session per address is free and each one after is paid, and we may use it to send you Service-related and marketing communications, subject to Section 3.
Screening responses you provide before a Session to determine eligibility.
Session data, including your session responses, self-reported distress ratings, cognitive, emotional and physical assessments, and other information you generate during use of the Service. We do not ask you for anything that identifies you personally within the Service, and your session data is stored on its own -- it is never linked or correlated to your email address or to any other identifying information, so it cannot be traced back to you.
Technical data, such as session timestamps, device and browser information, and general location inferred from your IP address.
Payment information, for paid Sessions. Payments are processed by our third-party payment processor, which collects the details needed to complete your transaction (such as name, email, and billing information). We do not store full payment card numbers.
Limited advertising measurement data. When you reach our website from an online advertisement, we and our advertising providers use cookies and similar technologies to measure whether the ad led you to visit our site. This is described further in Section 3 and Section 4.

3. HOW WE USE INFORMATION

3.1 Service Provision: To provide, maintain, and improve the Service.

3.2 Billing: To process payments and manage purchases and accounts. For Individual Users, the first Session is free; each subsequent Session is charged a fee, processed by our third-party payment processor.

3.3 Support: To provide technical support and respond to your requests.

3.4 Product Improvement: To analyze aggregated and de-identified usage in order to improve the Service.

3.5 Advertising Measurement (Individual Users): To understand how people find us and to measure and improve our advertising. For this purpose we use limited, non-identifying signals, such as whether an advertisement click led to a visit to our website. We do not use your session data, your screening responses, or information about your purchases for advertising.

3.6 Communications (Individual Users): To send you Service-related messages (such as confirming a Session or responding to a support request) and marketing communications about the Service, using the email address you provide to begin a Session. You can opt out of marketing communications at any time -- use the unsubscribe link in any marketing email, or contact us at support@traumalis.com. We will still send you Service-related messages.

3.7 Legal Compliance: To comply with applicable laws and to protect our rights, our users, and the public.

We do not sell, share, or give away your session data. Your session responses, distress ratings, and assessments are never used for advertising and are never transmitted to advertising or analytics providers.

We share information only as described below:

Service providers. Providers such as our payment processor and hosting providers act on our behalf under contract, only to deliver the Service you requested, and are not permitted to use your information for their own purposes, including advertising.
Advertising providers. For Individual Users, we share limited, non-identifying signals with advertising providers (such as Meta) to measure and optimize our advertising, for example that an advertisement click led to a visit to our website. We do not send advertising providers your session data, your screening responses, or information identifying your purchases.
Healthcare organizations. For Organizational Users, patient session data is made available to the administering healthcare organization and clinician.
Legal authorities, when required by law or to protect rights and safety.
Business successors, in connection with a merger, acquisition, or sale of assets.

We keep the session data you generate separate from your payment and advertising data, and we do not link your session responses or distress data to your payment identity.

5. DATA SECURITY

We implement appropriate technical and organizational measures to protect information, including encryption, access controls, and regular security assessments. Session data and payment data are maintained separately. No system is perfectly secure, and we cannot guarantee absolute security.

6. DATA RETENTION

We retain information only as long as necessary to provide the Service, operate our business, and comply with legal obligations, after which it is deleted or de-identified.

7. HEALTH DATA AND SENSITIVE INFORMATION

We treat your screening responses and session data as sensitive. We do not sell this information, we do not share it for advertising, and we do not use it for advertising. We collect it only to provide the Service to you.

For Organizational Users, the Service may involve protected health information (“PHI”). Because patient data is collected without information we use to identify individual patients, it does not currently constitute PHI under HIPAA. Should we begin processing identifiable PHI, we will implement HIPAA-compliant safeguards and execute Business Associate Agreements with the relevant covered entities before doing so.

For Individual Users, the Service is a direct-to-consumer wellness product and is not offered through a HIPAA-covered entity, so HIPAA does not apply to that use. Information you provide as an Individual User is handled under this Policy and applicable consumer-privacy and consumer-health-data laws.

8. YOUR CHOICES AND RIGHTS

Cookies. Most browsers let you refuse or delete cookies through your browser settings. Because we do not share personal information with advertising providers for targeted advertising, there is no advertising “sale” or “share” for you to opt out of.

State privacy rights. Depending on where you live, you may have rights to access or delete the personal information we hold about you. To make a request, contact us at support@traumalis.com, and we will respond as required by applicable law.

9. CONTACT INFORMATION

For privacy questions, contact us at support@traumalis.com or by mail at Traumalis, LLC, 8735 Dunwoody Place, Ste R, Atlanta, GA 30350.