Privacy policy
Effective November 6, 2026 · ShiftOS is operated by Boulder Hypnotherapy Institute (“BHI”, “we”).
Who this covers
ShiftOS is software used by independent hypnotherapy practitioners (“practitioners”) to run their practices. Practitioners are responsible for the client relationship; ShiftOS processes client information on their behalf as a business associate under HIPAA. This policy covers practitioners who use ShiftOS and clients who book or attend sessions through it.
Information we handle
- Practitioners: name, email, phone, practice details, sign-in and security settings, subscription and billing status.
- Clients: the details a client gives when booking (name, email, phone, reason for booking) and the records a practitioner creates (appointments, session notes, consents, invoices, and, only with the client's consent, session transcripts).
- Technical data: IP address and browser type for security and audit logging.
How we use it
- To provide the service: booking, reminders, video sessions, notes, payments and support.
- To send transactional email: booking confirmations, appointment reminders, sign-in and account notices. We do not send marketing email to clients and do not sell or rent any personal information.
- To keep the service secure, including an audit log of access to client records.
AI features
Optional AI drafting of notes and scripts runs on Amazon Bedrock inside our AWS environment. A client's records are only sent for AI drafting after the practitioner records the client's consent, names are removed where possible, and every AI draft must be reviewed and finalized by the practitioner.
Video and transcription
Video sessions run on Amazon Chime SDK. Sessions are not recorded. A session is transcribed only if the client agrees on their own screen during that session; the client can stop it at any time. Only the text is kept, in the client's record.
Who we share with
We use service providers bound by contract, and by Business Associate Agreements where they handle client health information: Amazon Web Services (hosting, database, email, video, transcription, AI), Stripe (payments; payment details only, never clinical information) and, if a practitioner connects it, Google Calendar (appointment times only, never client names). We disclose information if required by law.
Security and retention
Data is encrypted in transit and at rest, stored in the United States, and protected by multi-factor authentication and automatic sign-out. Practitioners can export all of their practice data at any time and can delete their practice; deleted practices are permanently removed after 30 days. Audit logs are retained for six years as HIPAA requires.
Every email we send relates to an appointment or account the recipient set up. Delivery failures and complaints are tracked automatically and those addresses are suppressed from further sending. To stop appointment emails, contact your practitioner or email us.
Your choices
Clients can ask their practitioner to access, correct or delete their records. Practitioners can export or delete their data in Settings. Questions or requests: info@boulderhypnotherapyinstitute.com or (720) 694-5760.