This Privacy Policy describes how THE HUB INITIATIVE SLU ("Cited", "we", "us") collects, uses, stores, and discloses information when you use the Cited platform. Cited is currently available only to licensed mental health professionals in the United States.
1. Information we collect
We collect three categories of information:
- Account information: full name, professional email, credential (PsyD, PhD, MD, LCSW, etc.), state of license, NPI number (optional), practice setting.
- Protected Health Information (PHI): clinical notes, assessments, session summaries, billing data, and other patient-related records you create or upload. PHI is processed under our Business Associate Agreement (BAA) and HIPAA Privacy Rule (45 CFR §164.500–534).
- Usage data: log files, IP address, device type, browser, page interactions, feature usage. Aggregated and de-identified for product improvement.
2. How we use information
- To provide the Cited service: clinical reasoning, documentation, billing, compliance.
- To maintain audit trails required for legal defensibility and HIPAA compliance.
- To improve product features (only on de-identified, aggregated data).
- To send transactional emails (account verification, billing, security alerts).
- To comply with legal obligations under HIPAA, CCPA, and state mandatory reporting laws.
3. AI training disclosure
Your patient data is never used to train AI models — ours or anyone else's. The Cited reasoning engines are trained exclusively on peer-reviewed literature, clinical guidelines, and government clinical sources. Patient data is segregated at the database level (Patient Privacy Firewall, ADR-036).
4. Data sharing
We do not sell, rent, or trade personal information. We share data only with:
- Subprocessors who provide infrastructure (cloud hosting, email delivery) under BAAs. Public list available at /security#subprocessors.
- Legal authorities when required by valid legal process (subpoena, court order, statutory mandatory reporting).
- Business successors in the event of a merger or acquisition, with continuation of this Privacy Policy or affirmative consent.
5. Data residency and storage
By default, all PHI is stored in AWS US East (us-east-1) and US West (us-west-2) regions. Data never leaves the United States unless you explicitly opt in to dual-region or EU residency at onboarding.
6. Security
AES-256 encryption at rest. TLS 1.3 in transit. Role-based access control. Immutable audit logs. SOC 2 Type II in progress (Q3 2026). For full security details, see /security.
7. Your rights (CCPA + HIPAA)
You have the right to:
- Access your data (Settings → Data → Export, FHIR R4 or JSON).
- Correct inaccurate data.
- Delete your account and associated data, subject to HIPAA retention requirements (typically 7 years).
- Opt out of any sale of personal information (we do not sell, but we honor the request).
- Receive notice of any data breach affecting you within 60 days (HIPAA Breach Notification Rule).
To exercise these rights, email [email protected].
8. Cookies
See our Cookie Policy for details on tracking technologies. We use only essential and analytics cookies, with no third-party advertising trackers.
9. Children
Cited is for licensed clinicians only. Patients of any age may have their data entered by their treating clinician under the clinician's lawful authority and your practice's consent procedures.
10. Changes to this policy
We will notify users by email at least 30 days before material changes take effect. Continued use after the effective date constitutes acceptance.
11. Andorran data protection notice
THE HUB INITIATIVE SLU is established in the Principality of Andorra. As a result, the company's processing of personal data is also subject to the Llei qualificada 29/2021 de protecció de dades personals and supervised by the Agència Andorrana de Protecció de Dades (APDA). For the full Andorran-law disclosure, including your rights under articles 13 to 22 LQPDP and how to lodge a complaint with the APDA, see our Data Protection Statement.
12. Contact
Questions: [email protected]
Data Protection Officer (once designated): [email protected]
Mail: THE HUB INITIATIVE SLU, Avinguda Doctor Mitjavila 26, AD500 Andorra La Vella, Principality of Andorra.