Plain language first, legal detail second. This page covers the website and your account. Clinical information is covered by the Business Associate Agreement and the HIPAA compliance page.
Soma Health Solutions Inc. ("Soma", "we") is a Canadian company headquartered at 100 Signal Hill Road, St. John's, Newfoundland and Labrador, A1A 1B3, Canada. We build Soma Recoup, software that helps licensed psychologists, therapists and other clinicians draft assessment reports and session notes, transcribe sessions, and work over their own case files. We are a software vendor. We are not a clinic, we do not provide care, and we have no relationship with our customers' clients.
This policy explains what we collect about visitors to this website and about the clinicians and practice staff who hold accounts, and what we do with it. It does not govern the clinical information our customers upload or create in the application. That information is protected health information under HIPAA, and we handle it only as a business associate under the Business Associate Agreement we sign with every U.S. practice. How we protect it is described on our HIPAA compliance page.
When you visit the website. Device and browser type, IP address and approximate location, the pages you view and the links you click, the site that referred you, and — only if you consent — the advertising identifiers described in section 6. We do not collect any information about your clients here, and our forms are not designed to receive it. Please do not include client or patient information in any form, chat or email to us.
When you request a demo, book a call or contact us. Your name, work email, practice name, role, phone number if you give it, the message you write, and the calendar booking details. Our booking page is provided by Calendly and our contact records are kept in Zoho CRM (see section 5).
When you open an account. Name, work email, professional credentials and license number if you choose to give them, practice name and address, role in the practice, billing contact and payment details (handled by our payment processor; we never see your full card number), your settings, and records of your use of the application (sign‑ins, features used, support requests). For U.S. clinics, accounts are created after the Business Associate Agreement is signed.
What we do not collect. We do not ask for or store your clients' real names — the application works with aliases you assign. We do not collect information from your clients. We do not collect wearable or device health data. We do not create voiceprints: session audio is transcribed in memory and never stored.
We do not sell personal information. We do not use clinical information for marketing, and we never combine website or advertising data with anything in the application.
For website visitors and account holders we decide how data is used (we are the "controller" or "business"). For clinical information we act only on our customer's instructions as a HIPAA business associate. Where a U.S. state privacy law applies to you, we honor the rights in section 9 regardless of whether that law's thresholds technically apply to us.
| Recipient | What | Why |
|---|---|---|
| Google (Google Analytics 4, Google Ads) | Browsing events, ad‑click identifiers, hashed email for conversion matching (with consent) | Site analytics and advertising measurement |
| Meta (Meta Pixel and Conversions API) | Page‑view and lead events, hashed contact details (with consent) | Advertising measurement |
| Calendly | Booking name, email, time | Demo scheduling |
| Zoho CRM | Contact and demo‑request details | Sales and support records |
| Payment processor | Billing identifiers | Subscriptions |
| Resend | Your email address and account/authentication messages | Transactional email; never carries clinical information |
| Google Cloud, Amazon Web Services | Hosting of the application and account data | Infrastructure (also our HIPAA subprocessors — see Subprocessors) |
| Professional advisers, successors in a merger or sale, authorities when legally required | As needed | Legal and corporate |
None of these recipients receives clinical information from the website. Calendly, Zoho CRM and the advertising platforms are deliberately kept outside the application: they never see what you upload or create there.
Essential cookies (session, security, consent memory) are always on. With your consent, this website sets first‑party identifiers (click and campaign identifiers from Google and Meta) and loads measurement tools from Google and Meta so we can see which ads bring clinicians to Soma. Hashed contact details may be sent to those platforms for the same purpose. We do not name clinical conditions in the events we send, and we never send anything about your clients or your clinical work.
Nothing is set until you choose. You can change your mind at any time: change your cookie choices, or use the Your Privacy Choices link in the footer. We honor the Global Privacy Control browser signal as an opt‑out of advertising sharing.
Inside the application we run no advertising pixels, load no advertising or third‑party analytics scripts, and set no advertising cookies.
| Website analytics | 14 months |
| Demo and contact records (CRM) | 24 months after last contact |
| Account data | While your account is open; deleted when you close it or ask us to |
| Billing records | Seven years, as tax law requires |
| Clinical information | Not governed by this policy — see the retention table: short, clinician‑controlled lifetimes and return‑or‑destroy at offboarding |
Account and clinical information for U.S. practices is stored and processed in the United States (Google Cloud, Northern Virginia; Amazon Web Services, N. Virginia). Website and CRM data may be processed in the United States, Canada and wherever our listed vendors operate. Soma is a Canadian company: our staff administer the service from Canada under the safeguards on the Security & HIPAA page, and Canadian privacy law (PIPEDA) also applies to how Soma, as an organization, handles personal information. We do not host U.S. clinical information in Canada.
Wherever you live in the United States, you can ask us to: tell you what personal information we hold about you; give you a copy; correct it; delete it; stop using it for marketing or advertising; and we will not discriminate against you for asking. If you are a California, Colorado, Connecticut, Texas, Virginia or other state resident with statutory rights, we honor them on the same terms. To exercise a right, email privacy@soma-recoup.com. We verify requests against the email on file and answer within 45 days (extendable once by 45 days where the law allows). Authorized agents may act for you with written permission. If you are a clinician's client, your rights over your clinical record run through your clinician; we support their obligations under the BAA.
This website and the application are for licensed professionals and practice staff. We do not knowingly collect personal information from anyone under 18, and the site is not directed to children. Information about minor clients that a clinician enters in the application is protected health information handled under the BAA; the clinician is responsible for the consents their law and license require.
We protect personal information with encryption in transit and at rest, access controls with two‑factor authentication, logging, workforce training and the written security program described on our Security & HIPAA page. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as the law requires.
Material changes (new data categories, new sharing, reduced rights) will be announced by email to account holders at least 30 days before they take effect; other changes are posted here with a new effective date.
Privacy & Security Officer: Ian Vardy · privacy@soma-recoup.com · Soma Health Solutions Inc., 100 Signal Hill Road, St. John's, NL A1A 1B3, Canada. We acknowledge within 5 business days and respond within 45 days. You may also contact your state attorney general's consumer‑protection office or, for Soma's Canadian obligations, the Office of the Privacy Commissioner of Canada.
This policy is governed by the laws of the Province of Newfoundland and Labrador and the federal laws of Canada applicable there. Nothing in it limits the rights you hold under U.S. federal or state law, which we honor as described above. The Business Associate Agreement and the Terms of Service each state their own governing law.
Soma creates, receives, maintains and transmits PHI on your behalf, so the HIPAA Security Rule applies to us directly. We sign a Business Associate Agreement with every U.S. practice before any clinical information is uploaded; your first account is created after the countersigned BAA is on file. Clinic seats are invited by your administrator under the clinic's BAA. Soma is a drafting workspace, not a clinic and not a system of record.
Google Cloud us‑east4 (Northern Virginia) runs the application, database, document storage, de‑identification, transcription and logs. AWS us‑east‑1 is called per request for text extraction (Amazon Textract) and AI model inference (Amazon Bedrock, Anthropic Claude models). Both are under executed BAAs. U.S. and Canadian data are never mixed.
Identifier removal is a privacy control layered on top of BAA‑grade handling.
Every case carries a destroy date you set, 7 to 180 days from last activity, default 30. Deletion is immediate; there is no recycle bin. AI working sessions are deleted within 7 days of completion. Audit records are kept six years, as HIPAA requires. When you leave, you choose return or destruction of everything we hold and we confirm in writing. Reading and downloading never stop, even if billing lapses.
Report a suspected incident to security@soma-recoup.com. We triage, contain, assess under HIPAA's four‑factor test and notify your practice within the window in your BAA, never later than HIPAA's 60‑day maximum. On request we produce a client's records in readable electronic form, apply amendments you approve, and supply the disclosure log; because clients are stored under aliases, you supply the case identifier.
Soma's HIPAA program, seventeen signed policies and forty‑five evidence artifacts, went through a gap analysis with Carbide, a compliance advisory firm, which found all 74 Security Rule controls in its framework implemented as of October 2026. Google Cloud and AWS hold SOC 2 and ISO 27001 for the infrastructure layers they operate beneath Soma. 42 CFR Part 2 programs: tell us before onboarding.
| Who | Service | Data | Where | Agreement |
|---|---|---|---|---|
| Google Cloud | Hosting, database, storage, logs, de‑identification, transcription | PHI, account data | us‑east4 | BAA executed |
| Amazon Web Services | Text extraction (Textract), model inference (Bedrock, Anthropic Claude) | Documents in transit, identifier‑reduced text | us‑east‑1 | BAA executed |
Vendors that never receive clinical information (account email, billing, source control) stay outside the data path under signed no‑PHI determinations. We notify you before adding a subprocessor that will receive clinical information.
Who this is for. Visitors to www.soma-recoup.com and people who contact us. It does not cover protected health information in the Soma Recoup application, which is governed by HIPAA and protected under our Business Associate Agreements instead.
What consumer health data we collect. None, by design. This website is for clinicians and practice staff. The information we collect — contact details, practice details, browsing and advertising measurement data — is about you as a professional and is not intended to reveal anything about your physical or mental health, treatment, or health‑care seeking. We do not collect biometric or precise geolocation data, we do not geofence health‑care facilities, and we do not infer health status from your browsing. If you volunteer health information about yourself in a message, we keep it only to answer you and delete it afterwards.
Sources. You (forms, email, calls); your browser (with consent, section 6 above).
Sharing. We do not share consumer health data with anyone. Our advertising and analytics vendors receive the professional‑marketing data described above, never health data.
Sale. We do not sell consumer health data and will not without the separate written authorization the Act requires.
Your rights. Confirm whether we collect, share or sell consumer health data about you and access it; withdraw consent; have it deleted (including from our vendors). Email privacy@soma-recoup.com; we respond within 45 days (one 45‑day extension where permitted). If we deny a request you may appeal by replying to our decision; we answer appeals within 45 days and tell you how to contact the Washington Attorney General.
What the AI does. Soma uses artificial intelligence to draft: it prepares first drafts of assessment reports from the test results, history and documents you provide; drafts session notes from a transcript; transcribes sessions; and answers your questions over your own case files. Every output is a draft for you.
What the AI does not do. It does not make clinical or therapeutic decisions. It does not communicate with your clients in any form. It does not interpret test results for you, diagnose, or assess risk, mood or mental state. It does not finalize or send anything. Treatment‑plan content, where present, is a draft that exists only for your review and approval. The AI has no professional title and is not a licensed professional; it is software you supervise.
Who is responsible. You are the author of record. You review, edit, approve and sign every note and report before it enters a client's record or is shared. Soma recommends the practice the American Psychological Association's 2025 ethical guidance describes: transparency with clients, human oversight, and professional judgment as the final authority.
How session data is handled — the facts many state laws ask you to disclose to clients:
Consent. Obtaining your clients' informed consent to transcription and to AI‑assisted documentation is your responsibility under your license and your state's law (for example Illinois, Maine and Rhode Island require written consent when AI is used in transcribed sessions; Utah and Texas require disclosure). Your licensing board and professional association publish guidance; the facts above are written so you can complete your own disclosure.
Questions. privacy@soma-recoup.com.
The U.S. Terms of Service, the Business Associate Agreement and the data‑processing terms are provided at signup and on request. Request the BAA →
Soma Recoup