Privacy Policy

BetweenSets is used by Practitioners (health, wellness, and fitness professionals) and by the Clients they invite. For information about Practitioners and visitors, we decide how it is used. For Client Data, the Practitioner decides what to collect and why, and we process it on the Practitioner’s behalf to run the Platform for them. Clients with questions about how their Practitioner uses their information should ask their Practitioner first.

HIPAA. BetweenSets is not a HIPAA business associate and does not sign business associate agreements. Practitioners who are covered entities or business associates under HIPAA must not use the Platform for protected health information.

Practitioner accounts. Name, email address, password (stored by our sign-in provider in hashed form), specialty, the features you plan to use, bio, profile photo, credentials you upload, availability, time zone, plan and billing status, and, if you connect them, your Stripe account and Google Calendar.

Client Data. Name, email address, and phone number, and the health and fitness information entered by the Practitioner or the Client. That includes intake answers (such as medical history, injuries, surgeries, diagnoses, medications, limitations, pain, and health screening questions), goals, sessions and attendance, session notes and transcripts, homework, daily check-ins (such as energy, pain, stress, sleep, and motivation), progress photos, meal logs and meal photos, nutrition targets, messages, booking requests, and billing records.

Recordings and uploads. When a Practitioner records a session, the audio is streamed from their browser to our transcription provider and is not stored by us; the transcript and the resulting notes are saved. When a Practitioner uploads a session video for transcription, the audio is extracted in their browser and only that audio is sent for transcription; the video is not uploaded. To do this, the browser downloads the extraction tool from a public code-delivery network (unpkg.com), which sees the browser’s IP address. Progress photos, meal photos, profile photos, credential documents, and exercise videos added to a Practitioner’s library are stored in our file storage.

AI conversations. A Client’s conversation with their AI assistant is stored so it can continue later; older messages are condensed into a summary, and the Client can clear it by starting a new conversation. A Practitioner’s conversation with their assistant is not saved on our servers and ends when the page is reloaded, but the notes, homework, and other changes it makes are saved.

Technical information. The cookies needed to keep you signed in, and the request information our hosting providers log to operate and secure the Platform, such as IP address, browser type, and time of request.

Voice dictation. If you dictate a message instead of typing, your browser’s built-in speech recognition handles it, under your browser maker’s privacy terms.

• to provide the Platform: scheduling, session notes, homework, messaging, booking, progress tracking, and billing;
• to run the AI features you use, including transcription, note drafting, summaries, briefs, meal estimates, and the assistants;
• to send account and service emails, such as invitations, booking updates, receipts, and reminders a Practitioner sets up;
• to secure the Platform, prevent abuse, and fix problems; and
• to meet legal obligations and enforce our Terms.

We do not sell personal information, we do not use it for advertising, and we do not use Client Data to train our own AI models.

• Between a Practitioner and their Clients. The Practitioner currently assigned to a Client can see that Client’s information. A Client sees their own information. Clients never see other Clients’ information.
• Public pages and links. Every Practitioner has a public booking page showing their name, specialty, and open times, and a Practitioner who publishes a profile page also shows their bio and photo there. Profile photos, credential documents, and library videos are stored at unlisted links that anyone who has the link can open. A Practitioner’s calendar feed link shows session times, titles, and Client names to anyone who has that link, and each Client’s feed link does the same for their own sessions, so keep these links private.
• Service providers. We share information with the providers below only as needed to run the Platform. Their use of it is governed by their agreements with us.
• Legal and safety. When the law requires it, or to protect the rights, property, or safety of our users, the public, or BetweenSets.
• Business transfers. As part of a merger, acquisition, or sale of assets, subject to this policy.

We use only the cookies needed to sign you in and keep your session secure. We do not use advertising or analytics cookies.

We keep information for as long as the account it belongs to is active. A Practitioner can archive a Client, which hides the Client from their active list but does not delete the Client’s information.

To delete an account and its information, email privacy@betweensets.ai. We will confirm the request comes from the account holder and complete it within 30 days. When a Practitioner’s account is deleted, we also delete or de-identify the Client Data they manage. Residual copies may remain in backups for a limited period until they are overwritten. We may keep information we are legally required to keep, such as billing records.

If a Practitioner connects Google Calendar, BetweenSets requests the calendar.events and calendar.readonly permissions. We use them only to add and remove BetweenSets sessions on the Practitioner’s primary calendar, and to read busy and free times so that booking doesn’t offer times when the Practitioner is busy. We don’t store the calendar events or busy times we read; we store only the access tokens and the ID of each event we create. The Practitioner can disconnect Google Calendar at any time, which revokes our access and deletes the tokens.

BetweenSets’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not use it to train AI models, and people at BetweenSets do not read it except with the Practitioner’s permission, for security, or to comply with the law.

We use encryption in transit, access controls designed to keep each Practitioner’s and Client’s data separate, and providers that encrypt data at rest. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach that affects your information, we will notify you as the law requires.

You can view and update much of your information in the Platform. You can also ask us to access, correct, export, or delete your personal information by emailing privacy@betweensets.ai. Depending on where you live, you may have additional rights under local law, and we will honor them as that law requires. Clients may be redirected to their Practitioner for requests about Client Data the Practitioner manages, and we will help the Practitioner respond.

The Platform is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

We store and process information in the United States. If you use the Platform from elsewhere, your information will be transferred to the United States.

We may update this policy. The “Last updated” date at the top shows the current version. If a change is material, we will tell you by email or on the Platform before it takes effect.

Questions or requests about privacy go to privacy@betweensets.ai.