This policy explains what Sunshine Intake does with personal information, including information it receives from Google when a staff member signs in.
1. Who this policy is for
Sunshine Intake is an internal practice management application. Accounts exist only for authorized employees and contractors of Sunshine ABA (“the Practice”). There is no self-registration, no public account creation and no patient login — an administrator at the Practice creates every account.
This policy therefore describes the handling of staff information. It is not the Practice's Notice of Privacy Practices, which is the separate HIPAA document describing how patient health information is used and disclosed. Patients and guardians should ask the Practice for that document.
2. Information collected about staff
2.1 Account information
The Practice's administrators record, for each staff account:
- Name and work email address
- Assigned role, permissions and clinic location(s)
- A salted hash of the password, where password sign-in is used — never the password itself
2.2 Information received from Google at sign-in
Where the Practice enables Google sign-in, Sunshine Intake requests only
the identity scopes openid, email and
profile. From the resulting ID token it reads and stores:
- The Google account identifier (
sub) - The email address and whether Google reports it as verified
- The display name, used to fill in the staff record
- The hosted Google Workspace domain (
hd), used to check the account belongs to the Practice's domain
Signing in does not read Gmail, Drive, Calendar, Contacts or any other Google service. A Google account that does not already match a staff record is refused sign-in, and the attempt is recorded.
2.3 Mailbox access, only if Mail Import is enabled
The optional Mail Import module reads a mailbox that the Practice
designates — a referral inbox, not a personal mailbox — so that
referral emails become intake records automatically. Where that mailbox is
hosted on Google, this uses the
https://www.googleapis.com/auth/gmail.modify scope, which Google
classifies as a restricted scope. It is used solely to list messages in that
mailbox, read their contents and attachments, and mark them as processed.
Nothing in that mailbox is used for any purpose other than creating and de-duplicating referral records for the Practice. The module is off unless the Practice switches it on.
2.4 Security and audit records
Because this application holds protected health information, access to it is logged. Each entry records who acted, what they did, when, from which IP address and user agent, and on which route. Audit entries deliberately do not contain the patient values themselves — an update records that a field changed, never the old and new values.
3. How the information is used
- To authenticate staff and decide what each account may see and do
- To attribute every action to a person, as HIPAA requires
- To detect and investigate unauthorized access
- To create referral records from the designated mailbox, where Mail Import is enabled
- To send operational messages, such as appointment reminders the Practice configures
4. Google API Services Limited Use disclosure
Sunshine Intake's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data obtained from Google APIs is:
- used only to provide and improve the features described above;
- never sold, and never transferred to third parties except as necessary to provide those features, for security or legal reasons, or as part of a merger or acquisition;
- never used for advertising, advertising personalization, or credit assessment;
- never read by a human, except with the affirmative agreement of the mailbox's user for the specific messages concerned, where reading it is necessary for security purposes such as investigating abuse, to comply with applicable law, or where the use is limited to internal operations and the data — including any derivations of it — has been aggregated and anonymized.
5. Advertising, analytics and service providers
Patient records are held in the Practice's own database. Nothing in this application is used for advertising, advertising personalization, analytics, behavioral profiling or cross-site tracking. No advertising, analytics, social-media or content-delivery service is loaded by any page here: the application's content security policy permits scripts, styles, fonts, images and network connections from its own origin only, so no third-party code runs in your browser and no third-party site is contacted by a page you open. Personal information is never sold.
Information does reach a small number of service providers, but only where a feature the Practice has switched on requires it, and only the information that feature needs:
- Hosting. The application, its database and its uploaded documents run on Google Cloud Platform, on infrastructure the Practice engages and controls, under a business associate agreement executed between the Practice and Google.
- Google sign-in, where the Practice enables it — the identity fields listed in §2.2 are exchanged with Google when a staff member signs in.
- The designated referral mailbox's provider, where Mail Import is enabled (§2.3) — Gmail through the Google API, or another mail provider over IMAP.
- Google Calendar, where that module is enabled — read-only. The application reads events from a calendar the Practice names; it cannot create, change or delete anything in Google.
- Outbound email. Messages the Practice configures, such as appointment reminders and notifications, are sent through an SMTP provider the Practice chooses, which necessarily handles the content of those messages.
- Text messages, where the Practice enables SMS — delivered through Twilio, and from there across carrier networks.
- The Practice's public website. Enrollment forms submitted on the Practice's website are posted to a token-authenticated endpoint in this application. That flow is inbound only — a submission arrives as a pending referral for staff to review and never becomes a patient record on its own, and this application sends nothing back to the website.
A business associate agreement covering the hosting of this application is in place with Google, and the application is configured to use only services covered by it. Where the Practice enables a feature above that puts protected health information in the hands of another provider — an SMTP provider, Twilio, or a mail or calendar service outside that agreement — the Practice executes a business associate agreement with that provider before switching the feature on, and leaves it off until it has.
6. How the information is protected
- Identifying patient fields are encrypted individually with AES-256-GCM before being written to the database
- Uploaded documents are encrypted and integrity-checked on every read
- Sessions are stored server-side, expire on idle, and can be revoked by an administrator
- Access can be restricted to approved network addresses
- Permissions are enforced before any page runs, and default to refusing access
The application is operated on infrastructure controlled by the Practice. No part of this policy can promise perfect security, and none is claimed.
7. How long information is kept
Audit records are retained for at least six years, as required by HIPAA §164.316(b)(2), and the purge routine refuses to run inside that window. Patient record retention is configured by the Practice, seven years by default. Staff account records are kept while the account exists and for as long afterwards as the audit trail requires.
8. Your choices
Staff may see and correct their own name and contact details on their account page, and may review and revoke their own active sessions. To ask what is held about you, or to have it corrected, contact the Practice using the details below.
You can revoke this application's access to your Google account at any time at myaccount.google.com/permissions. Doing so ends Google sign-in for your account; the Practice may still hold records about your employment and your past activity in the audit trail.
9. Changes to this policy
Material changes will be reflected on this page with a new effective date. The current version is always the one published here.
10. Contact
Questions about this policy, or about information held about you:
Sunshine ABA
443 S. Landmark Ave., Bloomington, IN 47403
admin@sunshineabatherapies.com
8123294155