Privacy Policy

Relationship Theory is a practice platform for professionals and their clients, operated by Love Hacks LLC, a Tennessee limited liability company doing business as Relationship Theory (“Relationship Theory,” “we,” “us,” or “our”). Two kinds of people use it, and this policy covers both:

• Professionals: the coaches, therapists, and other practitioners who hold an account with us and use the portal to run their practice.
• Clients: the people a Professional invites into their practice to work through trainings, reps, reflections, and sessions.

For information a Professional collects about their own Clients (client notes, reflections, session history, intake forms, and any health information), the Professional is the party who decides how that information is used. We handle that information on the Professional’s behalf under our Terms of Service and, where it is protected health information, our Business Associate Agreement. If you are a Client with a question about your own records, the best first contact is your Professional, who manages that relationship.

For information about the Professionals themselves (their account, subscription, and use of the platform), Relationship Theory decides how it is used and this policy applies directly.

Account information. Name, email address, timezone, and the password you set (stored only as a secure, one-way hash, so we never see your actual password). If you turn on two-factor authentication, we store the authenticator secret and recovery codes in encrypted form.

Client content. Journal notes and a Professional’s responses to them, reps, reflections, trainings assigned and completed, intake forms and signed agreements, check-ins, and any information a Professional or Client enters into the portal. Depending on the Professional’s practice, this can include health information about a Client. We treat all client content as the most protected data on the platform, and where it is protected health information we handle it as a Business Associate under HIPAA.

Scheduling and session information. Availability, session times, locations or meeting links, attendance (including in-person check-ins), and the Professional’s booking and cancellation rules.

Calendar connection. If a Professional chooses to connect Google Calendar, we ask Google only for permission to create and manage a separate Relationship Theory calendar in their account, to read the names, times, and status of the events on their own primary calendar, and whether they accepted or declined an invitation, so we can show those events on their portal calendar, and to read when they are busy, so we do not double-book. We never read the descriptions, locations, guest lists, or attachments of their events. The events we create show the Client’s initials and the service name, for example “JS Individual Session”, never a Client’s full name. A Professional can disconnect this at any time.

Video call connection. If a Professional chooses to connect Zoom, we ask Zoom only for permission to create, update, and delete meetings in their account and to read their basic profile (the connected account’s email and identifiers). Each online session then gets its own Zoom meeting; the meeting carries the Client’s initials, the service name, date, time, and duration, never a Client’s full name or content. We store the connected account’s email and identifiers, an encrypted credential that lets us act on the Professional’s behalf, and each session’s meeting number and join link. We never store the host start link, and we never read a Professional’s other meetings, recordings, or contacts. Disconnecting in the portal, or removing the app in Zoom, deletes the credential. Google Meet links work through the Google Calendar connection described above.

Payment information. When money changes hands, card details are entered directly into forms hosted by our payment provider, Stripe, and never touch our systems. We share the cardholder’s name and email address with Stripe to create their customer record, and we keep limited billing records (amounts, dates, the card brand and last four digits, and a token that lets us reference a charge). A Professional who receives payouts provides identity, tax, and bank information directly to Stripe under Stripe’s own terms; we do not see or store it.

Community membership. For Professionals whose plan includes the Relationship Theory Community, we share the Professional’s name and email with our community provider to grant and manage that membership. Clients are never added to the community.

Usage and device information. Basic technical data such as IP address and browser type, used to keep the service secure, prevent abuse, and diagnose problems. We also keep an audit trail of significant actions in the portal (who did what, and when), which records the action, never the content of a note or session.

We use the information above to:

• Provide and operate the portal: accounts, client content, scheduling, trainings, and community access.
• Process payments, subscriptions, and payouts to Professionals.
• Send necessary service messages: invitations, session reminders, billing notices, and security notices.
• Keep the platform secure: authentication, fraud and abuse prevention, and rate limiting.
• Improve and support the service and respond to your requests.
• Meet legal, tax, and accounting obligations.

We do not sell your personal information, and we do not use client content to advertise to you or to anyone else. We do not send client content to any artificial-intelligence service, and we do not use it to train models.

The emails we send to Clients are notifications only. They tell you something is waiting in the portal (a session, a form, a reminder) and never include the content of your notes, sessions, or forms.

We do not use your information to make decisions about you by automated means alone that produce legal or similarly significant effects.

If you are in the European Economic Area or the United Kingdom, we process personal information on these legal bases:

• To perform our contract with you: providing the portal, your account, and the features you use.
• For our legitimate interests: securing the service, preventing abuse, and improving what we offer, balanced against your rights.
• To comply with legal obligations: such as tax and accounting requirements.
• With your consent: for anything that requires it, such as connecting an optional integration; you can withdraw consent at any time.

Where a Professional inputs their Clients’ information, the Professional is responsible for having a lawful basis and any consents required for that information.

The platform is built to hold sensitive client information, including health information, and we run it to HIPAA standards for every practice, whether or not HIPAA applies to that practice. Where a Professional is a covered entity under HIPAA and uses the Service to create, receive, maintain, or transmit protected health information (PHI), Relationship Theory acts as the Professional’s Business Associate and handles that PHI under our Business Associate Agreement and HIPAA’s Privacy and Security Rules. The Professional remains responsible for the lawfulness of the information they collect and for the consents and notices their clients require.

We share information only with the service providers we need to run the platform, and only what each needs to do its job. Each provider that handles protected health information does so under a HIPAA business associate agreement. Our current providers are:

• Neon (a Databricks company): our database, including login credentials and all client content.
• Amazon Web Services: private file storage for lesson media and attachments, and secure archives.
• Paubox: delivery of the emails we send.
• Stripe: payment processing, billing, and payouts to Professionals.
• Google: optional calendar syncing and meeting links, only for Professionals who connect it. Calendar events carry the Client’s initials and the service name, never a full name.
• Zoom: optional video meetings, only for Professionals who connect it. Meetings carry the Client’s initials, the service name, and time, never a full name.
• Circle and Zapier: community membership for Professionals whose plan includes it. They receive a Professional’s name and email only, never Client information.
• Vercel: hosting and delivery of the website.

All of these systems are located in the United States. Each provider is bound to protect the information and use it only to provide their service to us. We will update this list before adding a provider that handles your information. We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a business transfer (such as a merger or acquisition), in which case we will continue to protect it under this policy.

A Professional’s Client information is not shared with other Professionals. Each practice is walled off from every other, enforced at the database level.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We protect information with layered safeguards, including encryption in transit and at rest, database-level access rules that isolate each Professional’s data from every other, private file storage served only through short-lived signed links, hashed passwords, breach-password screening, two-factor authentication (required for Professionals, available to Clients), automatic sign-out after inactivity, an append-only audit trail, a history of edits to journal entries so nothing is silently lost, and rate limiting on sensitive actions.

No system is perfectly secure, but we design for the sensitivity of client health information and review our security regularly. If we ever learn of a breach affecting your information, we will notify you and the appropriate authorities as required by law, and we will notify a Professional of a breach affecting their Clients’ information as described in our Business Associate Agreement.

We keep account and client information for as long as the account is active and as needed to provide the service.

When a Professional deletes a Client, that Client’s personal content (journal entries and their edit history, the Professional’s responses, reps, trainings, progress, check-ins, and intake forms) is permanently erased, the Client’s identity is removed, their login is disabled, and any saved payment method is removed. Session and payment history is retained without the Client’s identity, because we need it for accounting and for the Professional’s records. Signed agreements are retained as a legal record for the Professional, since they are the Professional’s own paperwork.

Journal entries cannot be deleted one at a time by a Client, because a Professional may have read and responded to them as part of the working record. Edits are kept in a history. A Client who wants their entries erased can ask their Professional to delete their client record, which erases them as described above.

When a Professional’s plan ends, their Clients keep read-only access for a limited window shown in the portal, so they can view their own journal. After that window, access ends. Because client records may be health records, we do not erase them when a Professional’s plan ends; we retain them, protected as before, for the period that health-record and compliance laws require, and we return or destroy protected health information as described in our Business Associate Agreement. A Professional’s own account can be deleted only once it holds no client records.

Our audit trail is retained for at least six years. Records we are required to keep for accounting, tax, or legal reasons are retained for as long as those obligations require.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain uses, and to withdraw consent. These rights apply to residents of the European Economic Area and the United Kingdom (under GDPR) and to California residents (under the CCPA/CPRA), among others.

Clients can view their own journal in the portal and can update their own account details in Settings. Because a Professional controls their Clients’ information, a Client should direct other requests, including a request for a copy of their records, to their Professional, who can act on them directly in the portal. For information we control (your Professional account), contact us using the details below and we will respond as the law requires.

We will not discriminate against you for exercising any of these rights. We aim to respond to requests within the time the applicable law requires (for example, within 45 days under the CCPA). We may need to verify your identity before acting on a request.

If you are in the EEA or the UK and believe we have not handled your information properly, you also have the right to lodge a complaint with your local data protection supervisory authority.

We use only the cookies necessary to run the service, chiefly to keep you signed in and to protect your session. These cookies expire when you sign out or after a period of inactivity. We do not use analytics, advertising, or third-party tracking cookies. Because these cookies are essential to the service, the portal will not work correctly without them.

Because we do not track you across other sites or serve advertising, we do not sell or “share” your information for cross-context behavioral advertising. We honor recognized browser opt-out signals, such as Global Privacy Control (GPC), to the extent the law requires; since we do not sell or share personal information, there is nothing to opt out of, but such a signal is treated as a valid request.

The portal is intended for adults (18 and older). It is not directed to children, and we do not knowingly collect information from anyone under 18 for our own account holders. Where a Professional is authorized to provide services to a minor, the Professional is responsible for obtaining any consent the law requires before entering that minor’s information. If you believe a child has provided us information directly, contact us and we will delete it.

We operate from the United States, and all of our systems and providers process information there. If you use the portal from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. Where required, we rely on appropriate safeguards for these transfers.

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above, and Professionals will be asked to review and accept the updated policy at their next sign-in. Your continued use of the portal after a change means you accept the updated policy.

For privacy questions or to exercise your rights, email us at support@relationshiptheory.com. If you are a Client asking about your own records, please also contact your Professional, who manages that information.