Privacy Policy

Last updated: October 17, 2026 · A summary of the Privacy Notice and Data Processing Terms and the HIPAA Business Associate Agreement every agency signs. Where this page and a signed agreement differ, the signed agreement applies.

1. Who we are

ABARecords, the Applied Behavior Analysis Office System, is operated by Netzach Sof Dev LLC, d/b/a ABARecords Software, in Hialeah Gardens, Florida. Applied Behavior Analysis provider agencies use it to run their clinical records, scheduling, billing, staff and administration.

2. Your agency's data belongs to your agency

Everything an agency enters into ABARecords belongs to that agency, and only to that agency, forever. For protected health information the agency is the covered entity and ABARecords is its business associate under HIPAA. ABARecords uses the data only to provide the service and as the Business Associate Agreement allows.

It never sells data, never uses it for advertising or marketing, and never contacts an agency's clients.
It never shares one agency's information with another agency.
It never uses an agency's data to train, tune or evaluate AI models.

3. Nothing works before the Business Associate Agreement

An agency works in ABARecords only after its authorized signer signs its agreements, the HIPAA Business Associate Agreement among them, and ABARecords countersigns them. Until then the agency's workspace cannot change anything.

4. Where the data is kept

In the United States only, and each party in a cloud account it owns. Your agency's clinical and personnel records are kept in your agency's own database, in a cloud account your agency owns, under your agency's own business associate agreement with that cloud provider. ABARecords' own account holds only platform data: agencies, user accounts, sign-in, access grants and audit records. Platform data contains no information about a client.

5. What ABARecords processes to run the platform

Organization data: the agency profile, its officers, its authorized signer and its notice addresses.
Account data: names, work email addresses, roles and credentials. Passwords are stored only as one-way hashes and can never be read.
Security data: sign-in times, IP addresses, browser details, access grants and audit records.
Support and billing data: messages with ABARecords, invoices and the billing contact.

6. How it is protected

Encryption in transit (TLS 1.2 or later) and at rest.
Each agency kept apart from every other: every request is limited to the agency of the person making it.
Role-based access, two-step sign-in and audit logs the agency can review.
No standing access: ABARecords' staff do not see an agency's data because of their role. They see it only under a written, time-limited access grant from the agency's director, for a stated purpose.
Signed agreements and documents are sealed: they cannot be changed, and every PDF carries a verification code and a QR code that opens the sealed original with the document's security PIN.

7. How long it is kept

Platform data: while the agency uses ABARecords, then for the periods the law requires (audit and security records for 6 years), and deleted afterwards.
Agreements and their signature records: 7 years after the relationship ends.
The agency's own records: as the agency's policy and the law require. When an agency leaves, it keeps read-only access for 90 days to export everything; then its data is returned or destroyed as the Business Associate Agreement provides.

8. Requests from individuals

Clients and caregivers exercise their HIPAA rights (access, amendment, an accounting of disclosures) with their provider agency, which controls the record. ABARecords forwards any such request it receives to the agency within 2 business days. A user may ask ABARecords about the platform data held about them, and ABARecords answers within 30 days.

9. Contact

Your agency's administrator is your first contact. ABARecords' address for notices is printed in every agreement an agency signs.