VillageMetrics

Privacy Policy

Last Updated: September 29, 2026

VillageMetrics is a platform designed to help families and caregivers track behavioral observations, medication schedules, journal entries, and therapeutic data to support children with neurodevelopmental and behavioral conditions. We take privacy and data protection seriously, especially when it comes to sensitive health information. Although VillageMetrics is not a HIPAA-covered entity, we protect your data using safeguards modeled on HIPAA standards, described below.

This Privacy Policy outlines the types of data we collect, how it is used, who can access it, and how we protect it. We align our data-protection practices with the principles of HIPAA (United States), the GDPR (European Union), and PIPEDA (Canada) to provide strong protection for all our users.

1. Information We Collect

We collect the following types of information when you use the VillageMetrics app:

User Information

  • Name and email address of parents and caregivers
  • Role in the child's caregiving team (e.g., parent, therapist, teacher)
  • Confirmation of parental/guardian status when creating child profiles
  • Account, subscription, and email-preference status

Child Information

  • Child's full name, preferred name, and nicknames
  • Date of birth (optional)
  • Child's photo (optional)
  • Conditions that may apply to the child (optional, multiple selections allowed)
  • Behavior ratings submitted by parents and caregivers
  • Journal entries (transcribed via voice)
  • Medication and supplement information (e.g., names, dosages, timing)
  • AI-generated summaries, behavior scores, and insights derived from submitted data

Push Notification Token

  • A device token is collected solely for the purpose of delivering push notifications using Firebase Cloud Messaging (FCM).
  • We do not collect advertising IDs or use third-party analytics services for push notification delivery.

Application Logging and Analytics Data

  • We collect application logs and usage analytics to maintain service quality, diagnose technical issues, and improve the user experience.
  • This includes app events (e.g., screens viewed, actions taken), device information (platform, app version, device model and name, network type), and session information.
  • Analytics events are identified by your account's internal user ID (a pseudonymous GUID) and a session ID — never by your name or email address, which are stored separately.
  • No protected health information (PHI) — such as journal content, child names, or medication details — is included in these logs or analytics.
  • This data is encrypted both in transit and at rest using HIPAA-eligible infrastructure and is retained for a limited time period.

Account Communications

  • For current parent/guardian customers, we use name, email address, parent/guardian role, subscription status, and email preferences to send service messages and occasional first-party communications about VillageMetrics, such as product updates, surveys, requests for feedback, referral opportunities, and other company news. Invited caregivers are not included in nonessential marketing campaigns.
  • We do not use child profiles, conditions, journal entries, medication information, behavior data, or derived health insights to select recipients for or personalize marketing communications.
  • You may opt out of nonessential emails at any time using the unsubscribe link in an email or the "No emails" option in the App. We may still send essential account, security, legal, or transactional messages.

Website Data, Analytics & Secure Correspondence

Our website (villagemetrics.com) does not set cookies or use advertising trackers. Its cookie-free aggregate traffic measurement does not require a cookie consent banner.

Our separate Consumer Health Data Privacy Notice describes additional rights and appeal procedures that may apply to health-related information.

  • We measure website traffic using Plausible Analytics, a privacy-first analytics service hosted in the EU. Plausible uses no cookies and no persistent identifiers: visits are counted using an anonymized, daily-rotating hash, so individual visitors cannot be identified or tracked over time or across sites. See Plausible's data policy for details.
  • We do not run Plausible measurement on the Contact page and do not send contact-form visits, field values, query parameters, or submission outcomes to Plausible. On other website pages, URLs are reduced to the origin and path before measurement.
  • Our website's content delivery network (Amazon CloudFront) also keeps request logs that we use to count aggregate website traffic. Each entry records the time, the page or file requested, the response, the referring page, the browser user-agent string, and the country the request came from. These logs do not record IP addresses, cookies, query parameters, or anything submitted through a form, and they are deleted automatically after 90 days. The aggregate traffic counts derived from them contain no user-agent strings or referring page addresses. Request logs kept from August 30 to September 1, 2026, under an earlier logging configuration, include IP addresses; we do not keep those addresses in the traffic counts, and those logs are deleted automatically one year after they were written.
  • If you submit our website contact form, we collect the name, email address, and message you provide so authorized VillageMetrics staff can review and respond to your request. The submission is encrypted in transit and at rest and is available only to explicitly authorized staff.
  • We do not add your raw IP address or full browser user-agent string to the correspondence record. The form uses a first-party hidden field to deter automated spam without sending your submission to another abuse-prevention provider.
  • Resolved website correspondence is deleted after 90 days unless an authorized, documented legal hold with an expiration applies. Unresolved correspondence is reviewed when it reaches one year. You may request access to or deletion of correspondence after we authenticate the request.
  • We do not sell website correspondence or share it for advertising. AWS processes the encrypted storage and generic staff notification for us; the notification contains no sender identity or message content.
  • Content-free security and accountability audit metadata, including an opaque record identifier and authorized staff actions, is retained for up to one year. After the live correspondence is deleted, that metadata cannot identify the sender through VillageMetrics systems.

2. Legal Basis for Processing (GDPR & PIPEDA)

We process your personal data based on the following legal grounds:

For EU Users (GDPR):

  • Consent: For processing sensitive health data and optional features (e.g., quality assurance reviews, community insights)
  • Contractual Necessity: To provide the VillageMetrics service you've subscribed to
  • Legitimate Interests: For service improvements, security, and fraud prevention

For Canadian Users (PIPEDA):

  • We identify purposes for data collection upfront and obtain your consent
  • Processing is limited to purposes that a reasonable person would consider appropriate in the circumstances

Marketing Communications:

  • We send marketing communications only when permitted by applicable law, based on consent, a legally recognized existing customer relationship, or legitimate interests where available. You may opt out at any time.

3. HIPAA & Data Security

Although VillageMetrics is not a HIPAA-covered entity, we protect your data using safeguards modeled on HIPAA standards. We build on HIPAA-eligible infrastructure and maintain signed Business Associate Agreements (BAAs) with the third-party providers that process protected health information on our behalf.

  • All data is encrypted both in transit and at rest.
  • Access to sensitive information is strictly controlled and limited to authorized users.
  • Infrastructure hosting is provided by Amazon Web Services (AWS) with a signed BAA.
  • Push notifications use Firebase Cloud Messaging through Google Cloud Platform (GCP) with a signed BAA.
  • We do not use Firebase Analytics or other Firebase services that are not HIPAA-eligible.
  • Voice transcription is performed using Deepgram with a signed BAA.
  • AI processing is performed using Amazon Bedrock on HIPAA-eligible AWS infrastructure under our BAA.
  • We temporarily cache encrypted model requests and responses to improve performance. These copies expire on a fixed short schedule measured from creation, rather than when a deletion request is received. Cached responses can be reused for up to 24 hours; stored cache objects are scheduled for deletion after two days, with deletion completed asynchronously by our storage provider.

Additional third-party services support specific features of the app:

  • Subscription purchases are processed by the Apple App Store or Google Play and managed through RevenueCat, which receives your account's internal user ID and subscription status — never any health data or child information.
  • Paubox may be used to send and manage email communications. It receives the contact information, message content, delivery and engagement data, and unsubscribe choices needed to provide that service. We do not provide Paubox with child profiles, journal entries, medication information, behavior data, or derived health insights for email targeting or personalization.

4. International Data Transfers

Data Processing Locations:

Your data may be processed in the United States where our primary servers are located. We ensure appropriate safeguards are in place for international transfers:

For EU Users:

  • We use Standard Contractual Clauses (SCCs) approved by the European Commission for data transfers outside the EU
  • All third-party processors are required to implement appropriate technical and organizational measures
  • We ensure an adequate level of protection for your personal data regardless of where it is processed

For Canadian Users:

  • We ensure comparable protection to PIPEDA requirements for any data processed outside Canada
  • All third-party processors must comply with PIPEDA standards

5. Parent Control & Permissions

Only parents or legal guardians can create child profiles in VillageMetrics, and must confirm their parental/guardian status during profile creation. Parents are the primary data owners and controllers for each child profile.

The same individual may have different roles for different children (e.g., parent to their own child, caregiver to another family's child). Parents determine:

  • Who is invited into the child's caregiving "village"
  • What permission level each caregiver has:
    • Contribute-only access (can add journal entries but cannot read)
    • Read journal entries
    • View behavior data and analyses
    • Access medical information (medications, treatment correlations)

Parents can modify or revoke caregiver permissions at any time. They can also:

  • Export analysis reports as PDF documents (via device share functionality)
  • Export raw journal entry data in CSV format (via device share functionality)
  • Request secure data export by contacting us at hello@villagemetrics.com
  • Delete their child's data at any time

Professional caregivers (therapists, teachers, etc.) remain responsible for maintaining their own licensing requirements, professional standards, and ethical obligations when using VillageMetrics.

6. Your Privacy Rights

All Users Have the Right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Export your data in a portable format (available via in-app export or by contacting us for secure delivery)
  • Withdraw consent for optional processing

Additional Rights for EU Users (GDPR):

  • Right to data portability in machine-readable format
  • Right to lodge a complaint with your local data protection authority
  • Note: Processing of your data only occurs when you actively submit new information. You can effectively pause all processing by not submitting new data, or permanently stop it by deleting your account

Additional Rights for Canadian Users (PIPEDA):

  • Right to challenge our compliance with PIPEDA
  • Right to access personal information in a format that is generally understandable
  • Right to know how we use and disclose your information

To exercise any of these rights, contact us at: hello@villagemetrics.com

We will respond to your request within 30 days (or as required by applicable law).

7. Notification Preferences & Optional Data Use

Email Communications:

VillageMetrics may send current parent/guardian customers service messages and occasional first-party emails about product updates, surveys, feedback requests, referral opportunities, and company news. For nonessential marketing messages, we use only name, email address, parent/guardian role, subscription status, and email preference; we do not use child-profile or clinical-content fields. Invited caregivers are excluded from these campaigns. You can opt out at any time through the unsubscribe link or the "No emails" option in the App.

Push Notification Options:

We collect push notification tokens to deliver notifications about your child's data. Parents can choose between generic notifications (default, no PHI) or enriched notifications that may include the child's name and other protected health information. For families with multiple parents, both parents must opt-in to enriched notifications. Caregivers receive notifications based on the parents' preferences.

Quality Assurance Consent (Optional):

During account setup, you may optionally consent to allow VillageMetrics staff to review your journal entries and "Ask Anything" conversations for quality assurance purposes to verify the app is functioning as intended. This consent is off by default and only a small percentage of users participate. This access is used solely for internal quality assurance and is not shared with third parties.

8. Data Sharing & Community Insights

We do not sell or disclose child profiles, conditions, journal entries, medication information, behavior data, derived health insights, or other health information to third parties for their own marketing, advertising, or unrelated analytics. Service providers such as Paubox may process the limited account and contact data described above solely to deliver VillageMetrics' first-party communications under contract.

Parents may optionally opt in to share anonymized data to contribute to aggregated Community Insights, which may help others discover trends across similar profiles. No names, journal entries, or direct identifiers are ever included in these insights.

9. AI Analysis & Data Export

VillageMetrics uses AI to analyze submitted data and generate:

  • Behavior trends and patterns
  • BCBA-style behavioral analyses (AI-generated, not from licensed BCBAs)
  • Hashtag categorization and summaries
  • Automated empathy responses to journal entries
  • Responses via the "Ask Anything" tool, which uses AI to analyze your data and answer questions
  • Periodic analysis reports
  • Semantic search capabilities using vector embeddings of your journal entries for intelligent content discovery

These AI features are for informational purposes only and should not be relied on as medical or clinical advice. AI-generated analyses, insights, and "Ask Anything" responses are computer-generated inferences, not professional evaluations from licensed practitioners. Always consult your healthcare provider for medical decisions.

The App tracks correlations between medications, therapies, activities, caregivers, and behavior scores to provide you with data to share with your healthcare providers. These correlations are not recommendations to start, stop, increase, decrease, or change any medications or therapies. All medication and therapy decisions should be made in consultation with qualified healthcare professionals.

Journal entries and AI-generated empathy responses are processed automatically without human review or monitoring. We do not monitor content for safety concerns and do not report concerning content to authorities or third parties. If you have immediate safety concerns, contact appropriate emergency services or healthcare providers directly.

Parents or caregivers with appropriate permissions may export this data as PDF or CSV files through the app's export feature, which uses your device's native sharing functionality. Once exported through your device's share sheet, these files are outside of the VillageMetrics system and under your control. These files may contain protected health information (PHI), and you are responsible for how they are shared. Note that your device's share options may include services that are not designed to protect health information. For a secure data export, you may contact us at hello@villagemetrics.com.

External AI Assistant Access (MCP Tokens)

You may optionally generate secure tokens that allow external AI assistants (such as Claude Desktop) to access your VillageMetrics data through the Model Context Protocol (MCP). This feature requires explicit consent because external AI tools may not be HIPAA-compliant.

Before generating a token, you must consent to these conditions:

  • Non-HIPAA Environment: AI tools may not be HIPAA-compliant and data will be processed outside VillageMetrics' secure environment
  • External Storage Risk: AI assistants may store conversation history including your data responses in their systems
  • Ongoing Access: Tokens provide ongoing access to all your children's data until expired or revoked
  • Parent/Guardian Access Only: Tokens only access children for whom you are the parent or guardian, not children where you serve as a caregiver (those parents control access to their children's data)
  • User Responsibility: You are responsible for keeping tokens secure and controlling any sharing with caregivers or others
  • Read-Only Access: MCP tokens can only read your data, not modify or delete anything - changes must be made through the VillageMetrics app. The only thing they can submit is product feedback about Village Metrics
  • User-Controlled: You generate, configure, and can revoke tokens at any time through the app
  • Configurable Expiration: You choose token lifespan (90 days to 2 years) when generating
  • Basic Access Tracking: Token usage updates "last used" timestamps and basic access logs

Important: Once your data is accessed by external AI tools, VillageMetrics cannot control how that data is stored, processed, or secured by those systems. You accept this risk when generating MCP tokens.

10. Account Ownership & Data Deletion

VillageMetrics operates on a per-family subscription model. Each subscription covers one family with unlimited children and caregivers. Subscriptions are owned and paid for by parents/guardians only. Caregivers receive free access when invited by parents. Professional caregivers (therapists, teachers, etc.) are invited by each family they work with.

Parents and caregivers can delete their account from within the app. Deletion works as follows:

  • If a parent or guardian deletes their account and they are the sole owner of a child profile, all associated data will be permanently deleted.
  • If a caregiver deletes their account, their personal profile is removed. Journal entries, behavior ratings and other contributions they made remain with the child's records without name attribution. Insight cards and their associated feedback and delivery records remain with the child until the child's records are deleted.
  • Deletion removes data from the live service as described below. Backup retention and the limited records retained after deletion are explained in Section 11.

11. Data Retention

We retain family and child data indefinitely unless a deletion request is received. This includes data from active accounts and inactive accounts (e.g., expired subscriptions). We retain inactive account data so users can return and access their historical information at any time. When an account is deleted:

  • Personal data is permanently deleted within 30 days
  • Backup copies may persist for up to 90 days in secure backup systems
  • Anonymized aggregate data used for Community Insights (if opted-in) may be retained
  • We retain a limited deletion-request record containing the subject identifier, authenticated request time and internal version markers so that we can reapply deletion after a backup restore. It contains no journal, behavior or health content and is not itself removed by a deletion request. These accountability records follow our seven-year audit-retention schedule. Restored data is kept out of service until the required deletion has been reapplied.

We strive to maintain high service availability but cannot guarantee 100% uptime due to maintenance, updates, or unforeseen circumstances.

12. Children's Privacy & Age Requirements

VillageMetrics is not intended for use by children under 13. Account creators must be at least 18 years old. Parents may authorize family members under 18 to contribute data under parental supervision.

All accounts are created and managed by adults. Any data about children is entered and controlled solely by their parents or authorized caregivers.

We design the service to comply with the Children's Online Privacy Protection Act (COPPA).

13. Regional Compliance Information

For EU Users:

We align our practices with the General Data Protection Regulation (GDPR). While we do not currently have an EU representative under Article 27, we are committed to GDPR-aligned practices and will appoint one if required based on our processing activities.

For Canadian Users:

We align our practices with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

For U.S. Users:

Although we are not a HIPAA-covered entity, we apply safeguards modeled on HIPAA to protect health information, and we design the service to follow the Children's Online Privacy Protection Act (COPPA) for children's privacy.

14. Changes to This Policy

This policy may be updated as VillageMetrics evolves. We will notify parents and caregivers of any material changes through the app or by email. Material changes will not apply retroactively without your consent.

15. Contact Us

If you have questions about this policy or your data, please contact:

All inquiries: hello@villagemetrics.com
Data Protection Officer: hello@villagemetrics.com

Wellbeing Applications LLC
New Jersey, United States

This Privacy Policy is governed by New Jersey law, regardless of your location, except where local privacy laws apply (such as GDPR for EU residents or PIPEDA for Canadian residents).