Privacy Policy
Last updated: September 24, 2026. How AltraSync collects, uses, shares, keeps and protects information for the companies, staff and families who use it.
Who this covers
AltraSync is a software platform for therapy and ABA organizations ("customers"). It supports audits of session notes, billing and insurance work, client intake, authorizations, accounting, team communication and support.
This policy covers three groups of people:
- Company users: staff and admins of a customer, invited by that customer. What each user can open is set by their company admin.
- Parents and guardians: families invited by a customer to the AltraKids Parent portal (parents.altrasync.com) to see their child's information, sign forms, upload documents and message the provider.
- Website visitors: people who visit the public AltraSync website or send the contact form.
Information we process
| Type | Examples |
|---|---|
| Account and login | Username, company, role and permissions, recovery email, password (stored only as a secure hash), two-step verification settings, login attempts, sessions, IP address and browser type. |
| Client and clinical records | Children's names, dates of birth, insurance and member IDs, authorizations, session notes, service logs, treatment and assessment documents, appointment notes, including voice notes recorded in AltraKids. |
| Billing and payment records | Claims, ERA/EOB remittances, eligibility (271) results, invoices, patient balances and payments. |
| Uploaded files | PDFs, spreadsheets, images and ZIP batches uploaded by users or parents, plus the text and results AltraSync extracts from them. |
| Work records | Audit findings and corrections, Clients CRM changes, team chat messages and attachments, support tickets and replies, e-signatures and disclaimer acknowledgments. |
| Parent portal | Parent/guardian account, linked children, forms and signatures, uploaded documents, messages and consents. |
| Other | Job applicant resumes (if a company uses the Resumes page), and website contact form entries (name, email, company, message). |
How we use it
- To provide the service: run audits, build reports, check eligibility, process EOBs and claims, create invoices, deliver messages and support replies.
- To keep accounts secure: sign-in, two-step verification, session control and security logs.
- To keep a record of who did what (activity and audit history) for customers' compliance and our support.
- To send emails that the service needs, such as verification codes, password resets, support replies and correction reports.
- To answer questions sent through Support or the website contact form.
We do not sell personal information or use customer records for advertising.
PHI and children's information
Records in AltraSync often contain protected health information (PHI) about children receiving services. AltraSync processes this information on behalf of the customer that provides the services. The customer decides what is uploaded and who may see it.
- Upload only what is needed for the work.
- Don't put unnecessary PHI in chat, support tickets or free-text notes. Use job IDs, request IDs or screenshots with details hidden when possible.
- Parents see only the children their provider linked to their account.
For questions about Business Associate Agreements (BAA), contact support@altrasync.com.
AI features
AI features use OpenAI and are off by default. An admin must turn them on in AI Settings. When they are on:
- Dashboard summary: sends only counts, document types, issue categories and the company name. No documents or client names.
- Note review: sends the Summary/Notes text of the note being reviewed. Before sending, AltraSync replaces the client, provider and supervisor names, dates and long ID numbers. Other details written in the note (for example a caregiver's name) may still be included.
- EOB code help: sends claim details such as payer, service dates, claim IDs, CPT codes, amounts and file names.
AI answers are suggestions. Users must review them before relying on them. AI usage is logged and visible only to Super Admin.
Who can see what
- Company users see only the menus and records their company admin allows.
- Company Admins manage their own company's users and settings and may review their company's team chat.
- Billing agencies can see the client companies they manage.
- AltraSync Super Admin (platform support) can see all companies to provide support and review records, including team chat, deleted or cleared messages, and support tickets.
- Parents see only their linked children.
How long we keep it
- Uploaded audit, insurance, intake, EOB, billing export, invoice and revenue files are deleted automatically after the company's retention period (30 days by default; admins can change it). The cleanup runs every night when automatic cleanup is on. When PHI-safe mode is on (the default), client details in old results are cleared at the same time, while counts and status history are kept.
- Other records are kept until removed by the company or AltraSync. This includes support attachments, chat, AltraKids and parent portal documents, clinical notes, authorizations and resumes.
- Activity and audit logs are kept so companies have a history of who did what.
- Backups are made when Super Admin runs one and automatically before updates or restores. A backup can contain copies of files, so it may keep a file after the original was removed.
- Failed login records are kept for 2 days.
Cookies and website visits
| Cookie | Purpose |
|---|---|
| aba_audit_session | Keeps you signed in (signed; page scripts cannot read it) |
| altrasync_working_company | Remembers the company you selected (30 days) |
| altrakids_session | Keeps AltraKids users signed in |
| altrakids_parent_session, altrakids_parent_pre_auth_csrf | Parent portal sign-in and form protection |
| audit_assigned_return | Returns you to the assigned audit list |
We don't use advertising cookies. On the public website we count page visits and button clicks with the page, referrer, browser type and a scrambled (hashed) version of the IP address using first-party analytics. Optional Google Analytics 4 is loaded only after you choose Accept analytics in the public-site privacy choices. If you reject that choice, the Google tag is not loaded; if you withdraw it later, no new Google Analytics events are sent. You can change this choice with the Privacy choices control.
Access, export and deletion
- Company records belong to the customer. Requests from patients or families about their records should go to their provider (the customer). We help customers answer them.
- Removing a user or a company in AltraSync turns off access; the records stay stored so history is not lost.
- To ask about exporting or permanently deleting a company's data, contact support@altrasync.com.
Customer responsibilities
Each customer is responsible for its own HIPAA program, including its Notice of Privacy Practices, patient and parent consents, deciding who gets access, workforce training and payer requirements. AltraSync does not replace these.
Security incidents
If we learn of a security or privacy incident involving customer data, we will review the logs, keep the evidence and notify the affected customer without unreasonable delay so it can meet its own notice duties.
Report suspected incidents through Support or to support@altrasync.com.
Changes and contact
We will update this page when our practices change, and change the "Last updated" date above. Questions: support@altrasync.com or the Support Center.
General HIPAA information is available from the U.S. Department of Health and Human Services (hhs.gov/hipaa).