Privacy Policy
Effective October 2, 2026
Sagebrook Practice ("Sagebrook", "we", "us") provides cloud practice-management and electronic health record software to behavioral health practices. This policy explains what information we handle, why, and how we protect it.
If you are a client of a practice that uses Sagebrook: your practice controls your health records, and its own privacy practices apply to them. We process that information only on the practice's behalf, under a Business Associate Agreement as required by HIPAA. To see, correct or get a copy of your records, contact your practice directly.
1. Two kinds of information
Information we process for practices (patient health information)
Practices enter information about their clients into Sagebrook, such as contact details, appointments, clinical notes, questionnaires, medications and messages. Under HIPAA this is protected health information. The practice is the covered entity and Sagebrook is its business associate. We use this information only to provide the service to that practice, as our Business Associate Agreement and the law allow. We do not use it for any other purpose, and we never sell it or use it for advertising.
Information about our own users and visitors
- Account information: name, work email, role and practice for staff accounts, and the details a practice gives us when it signs up.
- Security and usage records: sign-in times, IP addresses, browser type and an audit log of actions in the app. We use these to keep accounts secure and to investigate problems.
- Messages you send us: for example when you email us for support or a demo.
- Demo sign-ups: if you try our demo, the name, email and practice details you enter. The demo holds only fictional data and must never be used for real patient information.
2. Cookies and tracking
The Sagebrook app uses only the cookies it needs to keep you signed in securely. We do not use advertising or analytics cookies, tracking pixels or third-party analytics. This website sets no cookies and loads no content from other companies.
3. How we use information
- to provide, maintain and secure the service;
- to send transactional emails, such as invitations, password resets and security notices (see our Email Policy);
- to respond to support requests and to communicate with practices about their account;
- to meet legal obligations.
We do not sell personal information, share it for cross-context behavioral advertising, or use patient health information to train products for anyone else.
4. Service providers
We use a small number of providers to run Sagebrook. Each may handle information only to provide its service to us, and those that handle patient health information do so under a Business Associate Agreement:
- Amazon Web Services (United States): hosting, database and encrypted backups.
- Google Workspace (United States): delivery of the app's transactional emails, and our own company email.
- E-prescribing network partners, only when a practice turns on electronic prescribing: to send prescriptions to pharmacies and retrieve medication history.
We may disclose information if the law requires it, for example in response to a valid court order. Where allowed, we will tell the affected practice first.
5. Security
We protect information with encryption in transit and at rest, encrypted off-site backups, required two-step login for staff, role-based access, separation of each practice's data, a tamper-resistant audit log, and monitored, regularly updated servers. No system is perfectly secure; if a breach affects information we hold, we will notify the affected practices as required by law and our agreements.
6. Retention
We keep patient health information for as long as the practice's agreement with us requires, then return or delete it as that agreement sets out. Practices remain responsible for their own record-retention obligations. Account and security records are kept as long as needed to secure the service and meet legal obligations.
7. Your choices and rights
Staff users can update their account details in the app or through their practice. Clients of a practice should contact that practice about their records. Anyone can ask us about the information we hold about them as a user or visitor by emailing hello@sagebrookpractice.com. We will respond as the law in your state requires.
8. Children
Sagebrook is software for healthcare practices and is not directed at children. Information about minors who are clients of a practice is entered and controlled by that practice.
9. Changes
We may update this policy. We will post the new version here with a new effective date, and tell practices about material changes before they take effect.
10. Contact
Sagebrook Practice, United States ·hello@sagebrookpractice.com