1. About Mantle
Mantle is operated by Humantold Psychotherapy, an assumed name of Douglas Psychotherapy Services LCSW, PC, a New York professional corporation. This policy covers the mantleEHR mobile app and the supporting services that provide its features to authorized practice users.
Practices using Mantle are responsible for their clinical records and healthcare privacy notices. Our handling of practice records is also governed by the applicable service agreement and business associate agreement. For Humantold’s healthcare privacy notice, see Humantold’s Privacy Practices.
2. Information we handle
- Support: your name, contact details, practice information, and information you provide when requesting help with the app.
- Accounts: account identifiers, authentication information, practice membership, roles, permissions, and preferences.
- Practice records: information authorized users enter or upload, including client details, appointments, clinical notes, documents, insurance information, and billing records.
- Technical information: device and app information, service activity, diagnostic information, and audit records used to operate and protect the service.
Ordinary support email is not intended for clinical records, passwords, or patient-identifying information. Use your practice’s approved channels for sensitive data.
3. How information is used
Information is used to provide and administer the app, authenticate users, apply practice permissions, support authorized practice workflows, respond to requests, troubleshoot problems, protect the service, and meet applicable legal obligations.
Our policy is not to sell clinical information or use it for targeted advertising.
4. Access and disclosures
Practice records are available to authorized users according to their roles and permissions. Service providers may process information on our behalf for hosting, authentication, communications, support, and other service functions. They are permitted to use information only for authorized purposes and subject to applicable contractual safeguards.
Information may also be disclosed as required by law, to respond to valid legal process, protect rights and safety, or carry out an authorized practice instruction. Disclosures of protected health information are subject to applicable law and agreements.
5. Retention
We retain information until we receive and act on a verified deletion request from the person or practice authorized to make that request. Removing app access or signing out does not automatically delete records held by Mantle or the practice.
- App support communications: retained until an authorized, verified deletion request, including copies in our email systems.
- Account information and preferences: retained until an authorized, verified deletion request. Removing account access does not automatically delete associated practice records.
- Clinical, billing, and practice records: retained until the practice requests deletion, subject to applicable law and governing agreements. Requests about a client’s clinical records should be directed to the practice.
- Security and audit records: deletion requests are reviewed against applicable legal, security, and contractual retention requirements.
Some information must remain where required by law or governing agreements. Information retained for those purposes remains protected and restricted to those purposes. Deleted information may remain in protected backups until those backups are replaced or expire. Temporary device files and technical caches follow the cleanup behavior described below and are separate from the retention of records held by Mantle.
6. Access, correction, and deletion requests
Contact your practice for access to or correction of clinical records. For Mantle account assistance or a privacy request, email privacy@mantle-ehr.com. We may verify your identity and authority before acting on a request.
Our service targets are to acknowledge privacy requests within five business days and respond within 30 days, subject to applicable legal deadlines. If more time is permitted and needed, we will explain the reason and expected timing.
For a verified deletion request, we remove access and delete eligible personal information. Clinical, billing, audit, or other records may need to remain under applicable law or agreements. We will explain any applicable retention requirement or restriction.
7. Mobile storage, permissions, and diagnostics
The mobile app stores sign-in information and the selected practice identifier using the device’s secure storage. Clinical information retrieved for display is held in memory; signing out clears that information and the selected practice. This does not delete clinical records held by the practice.
Viewing, uploading, or exporting a document may create a temporary copy containing health information in the app’s device cache. These files rely on the device’s operating-system protections and app storage isolation. Preview copies may remain after the viewer closes or you sign out. The app attempts to remove eligible preview files older than 24 hours when another preview is opened, while retaining files handed to a viewer or share action during the current app session. This is not a guaranteed 24-hour deletion deadline.
Files you choose to export or share may remain in the destination you select and are subject to that destination’s storage and deletion controls. The current mobile app does not send push notifications or use third-party mobile analytics or crash reporting. Requests to Mantle’s servers can still generate operational and security logs.
We request device access relevant to the features you choose to use, such as selecting a document to upload. You can manage available permissions through your device settings.
8. Security
We use administrative, technical, and organizational safeguards appropriate to the information handled. Users and practices also have responsibilities, including protecting credentials, assigning appropriate access, and promptly reporting suspected misuse. No storage or transmission system can guarantee absolute security.
9. Changes and contact
We will publish changes to this policy here with an updated effective date. Material changes will be communicated through an appropriate service notice or direct communication, with consent obtained where required. Privacy questions can be sent to privacy@mantle-ehr.com.