Privacy Policy

Path4ABA — Operated by Marlon FM Services Corp · Sunrise, Florida

Effective Date: May 24, 2026  ·  Last Updated: August 8, 2026

1. Introduction

Marlon FM Services Corp ("Company," "we," "us," or "our") operates Path4ABA, a clinical intelligence platform accessible at path4aba.app and through the Path4ABA browser extension ("Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Platform.

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Platform.

2. Who We Are and What We Do

Path4ABA is a software-as-a-service (SaaS) platform designed for Applied Behavior Analysis (ABA) professionals, including Registered Behavior Technicians (RBTs), Board Certified Behavior Analysts (BCBAs), and Board Certified Assistant Behavior Analysts (BCaBAs). The Platform provides tools for clinical documentation, session note generation, scheduling, and supervision management, along with an optional browser extension that helps users draft and enter clinical notes.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Professional role (RBT, BCBA, BCaBA)
• Password (encrypted)
• Billing information (processed by Stripe — we do not store payment card data)

3.2 Clinical Data

Users may upload assessment documents and enter clinical information related to their clients. We collect:

• Behavioral assessment data (behaviors, behavior functions, interventions, replacement skills, activities)
• Session notes and supervision notes
• Scheduling and attendance records
• Clinical profiles and uploaded assessment files

Important: We are designed to minimize the collection of Protected Health Information (PHI) as defined under HIPAA. Users are responsible for ensuring they do not enter unnecessary PHI into the Platform beyond what is required for clinical documentation purposes.

3.3 Automatically Collected Information

When you use the Platform, we automatically collect:

• IP address
• Browser type and version
• Device information
• Pages visited and features used
• Time and date of access
• Referring URLs

3.4 Communications

If you contact us for support, we collect the content of your communications.

4. How We Use Your Information

We use collected information to:

• Provide, operate, and maintain the Platform
• Generate AI-assisted clinical documentation using your session inputs
• Process payments and manage subscriptions
• Send transactional emails (account confirmation, billing receipts)
• Respond to customer support inquiries
• Monitor and analyze usage to improve the Platform
• Detect and prevent fraud or abuse
• Comply with legal obligations
• Enforce our Terms of Service

5. HIPAA Compliance and Protected Health Information

Path4ABA is designed to support HIPAA-compliant workflows. As a Business Associate under HIPAA, Marlon FM Services Corp:

• Implements administrative, physical, and technical safeguards to protect PHI
• Does not use or disclose PHI except as permitted by our Business Associate Agreement (BAA) and applicable law
• Maintains audit logs of access to clinical data
• Encrypts data at rest and in transit
• Processes and stores clinical data only within U.S.-based, BAA-covered infrastructure (see Section 8)

If you are a Covered Entity under HIPAA, you must execute a Business Associate Agreement (BAA) with us before using the Platform to process PHI. Please contact us at privacy@path4aba.app to request a BAA.

Users are solely responsible for obtaining appropriate patient/client authorizations and consents required under HIPAA and applicable state law before entering any PHI into the Platform.

6. AI-Generated Content

Path4ABA uses the Microsoft Azure OpenAI Service (GPT-4o model) to generate clinical documentation. When you submit session data to generate notes:

• Session inputs are transmitted to the Azure OpenAI Service, which we operate within U.S. data regions
• This AI processing is covered by our Business Associate Agreement (BAA) with Microsoft Azure
• Azure OpenAI does not use your data to train or improve its models, and your prompts and outputs are not shared with the public OpenAI service or any other customer
• Generated notes are returned to you and stored in your account

Users should not include unnecessary PHI in session inputs beyond what is required for note generation.

7. Path4ABA Browser Extension

The Path4ABA browser extension is an optional tool that lets you generate clinical notes and enter them directly into supported systems. When you use the extension:

7.1 Authentication Token

When you sign in through the extension, we store an authentication token in your browser's local extension storage. This token is used solely to authenticate your requests to the Path4ABA backend on your behalf. It is not used for tracking, advertising, or profiling, and it remains on your device until you sign out or remove the extension.

7.2 Clinical Note Content

When you ask the extension to generate or refine a note, the session inputs you provide (such as behaviors, behavior functions, interventions, and activities) are transmitted to the Path4ABA backend for AI-assisted note generation, exactly as described in Sections 6 and 8. This clinical data flows only to our BAA-covered backend — it is never sent to a third party that is not covered by our BAA, and it is never sold.

7.3 Electronic Health Record (EHR) Integrations

The extension can read from and fill forms on supported third-party clinical systems, including ABA Matrix (app.abamatrix.com) and OfficePuzzle (officepuzzle.com), to help you place completed notes and data into those systems. This activity is always user-initiated: the extension acts only when you invoke it on a page, and only to read the fields needed to draft a note or to write the values you have chosen to enter. We do not continuously monitor these sites in the background, and the content of those systems is governed by your own agreements with those providers.

The extension requests only the browser permissions needed for these functions (access to our backend, the supported EHR sites, and the tab you are actively using). It does not collect your general browsing history.

8. Data Sharing and Disclosure

We do not sell your personal information. We may share information with the following service providers, each of which is bound by a data processing agreement and, where PHI is involved, a Business Associate Agreement:

Service Providers:

• Microsoft Azure — cloud hosting, database (Azure Database for PostgreSQL), and AI processing (Azure OpenAI Service). All Path4ABA clinical data is hosted and processed in U.S. Azure regions under a Business Associate Agreement.
• Stripe — payment processing. Stripe handles card data directly; we do not store payment card numbers.

Each service provider is bound by data processing agreements and is prohibited from using your data for their own purposes.

Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of our Company, users, or the public.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Platform.

9. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Upon account termination:

• Account data is deleted within 30 days
• Clinical documentation may be retained for up to 7 years as required by applicable healthcare regulations
• You may request earlier deletion subject to our legal retention obligations

The authentication token stored by the browser extension is removed when you sign out of the extension or uninstall it. You may request deletion of your account and associated clinical data at any time by contacting privacy@path4aba.app.

10. Security

We implement industry-standard security measures including:

• AES-256 encryption for data at rest
• TLS 1.2+ encryption for data in transit
• Role-based access controls
• Audit logging
• Regular security assessments

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

11. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your information
• Object to or restrict processing
• Data portability
• Withdraw consent

To exercise these rights, contact us at privacy@path4aba.app. We will respond within 30 days.

California Residents: You have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt-out of the sale of personal information. We do not sell personal information.

Florida Residents: You have rights under the Florida Digital Bill of Rights applicable to certain controllers.

12. Cookies and Tracking

We use essential cookies necessary for Platform operation, including authentication session cookies. We do not use third-party advertising cookies or tracking pixels.

13. Children's Privacy

The Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us personal information, contact us immediately at privacy@path4aba.app.

14. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the Platform at least 30 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.

16. Contact Us

For privacy-related questions, requests, or to execute a Business Associate Agreement: