Privacy Policy

Last updated: April 26, 2026

This Privacy Policy describes how Cultivate Hours ("we," "us," or "our") collects, uses, and shares information when you use cultivatehours.com and its related services (the "Service"). We built Cultivate Hours for mental health professionals and take your privacy seriously.

1. Information We Collect

Account information. When you create an account, we collect your email address and password (stored as a secure hash). You may optionally provide your full name.

Profile and licensure data. You may enter your state, pre-licensure designation, license number, and license issue date. This information is used to display your progress toward licensure requirements.

Supervision hour logs. You enter hour logs that include date, duration, activity category, an optional supervisor name or site, and optional notes. We do not ask for and you must not include any patient or client information in these fields. See our Terms of Service.

Supervisor relationship data. If you invite a supervisor, we store their name and email address and a record of the relationship between your accounts. Your supervisor can view your logged hours, category totals, and any documents in your shared document space.

Uploaded documents. Documents you upload to a supervisor relationship (supervision agreements, etc.) are stored in our cloud storage. Both you and your linked supervisor can access these documents.

Payment information. Payments are processed by Stripe. We do not store your card number or full payment details. We retain a Stripe customer ID and subscription status to manage your plan.

Usage data. Our hosting provider (Vercel) automatically collects standard server logs including IP addresses, browser type, and pages visited. We do not use third-party analytics trackers.

2. How We Use Your Information

To provide, operate, and improve the Service
To display your licensure progress and generate hour reports
To send transactional emails (account confirmation, supervisor invitations, signature requests, subscription receipts)
To process and manage your subscription through Stripe
To respond to support requests

We do not use your data for advertising and do not sell your personal information to third parties.

3. Third-Party Service Providers

We share data with the following providers solely to operate the Service:

Provider	Purpose	Privacy Policy
Supabase	Database, authentication, and file storage	supabase.com/privacy
Stripe	Payment processing and subscription management	stripe.com/privacy
Vercel	Application hosting and delivery	vercel.com/legal/privacy-policy
Brevo	Transactional email delivery	brevo.com/legal/privacypolicy

We do not share your information with any other third parties except as required by law.

4. Supervisor Access

When you link a supervisor to your account, that person can view your hour log entries (dates, durations, categories, supervisor names, sites, and notes), your total hours by category, and any documents stored in your shared document space. This access continues until you remove the supervisor link. Removing the link ends their access to your data going forward; it does not delete previously shared documents unless you delete them manually.

5. No Protected Health Information

The Service is not intended to store protected health information (PHI) as defined under HIPAA, and we are not a HIPAA-covered entity. Do not enter any patient or client identifying information. All data you enter should be limited to administrative records of your own supervision hours.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account, your hour logs, profile data, supervisor relationships, and uploaded documents are permanently deleted. Stripe may retain billing records as required by law. Server logs maintained by Vercel are subject to their retention policies.

7. Security

We use industry-standard security practices including encrypted connections (HTTPS), hashed passwords, and access controls. Your database is hosted on Supabase with server-side access controls. No system is perfectly secure, and we cannot guarantee absolute security. We encourage you to use a strong, unique password for your account.

8. Children

The Service is not directed to anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it.

9. Your Rights and Choices

You can update your profile information at any time from the Account section of the app. You can delete your account and all associated data from Account > Security > Delete account. If you have questions about your data or would like to request a copy, contact us at admin@cultivationclinical.com.

If you are located in the European Economic Area or United Kingdom, you may have additional rights under applicable data protection laws, including the right to access, rectify, or erase your personal data. Contact us to exercise these rights.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the app. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

Questions or concerns about this Privacy Policy? Email us at admin@cultivationclinical.com.