Privacy policy

Effective October 10, 2026

This policy explains what information AuliaFlow.ai, Inc. (called “Aulia” or “we” in this policy) collects, how we use it, and the choices you have. It covers this website (auliaflow.ai) and the Aulia application (app.auliaflow.ai).

1. Visiting this website

This website does not use cookies, analytics or advertising trackers, and it has no forms. Like any website, our hosting provider keeps standard server logs — such as the IP address, browser type and pages requested — to keep the site running and secure. If you email us, including to join our waitlist, we receive your email address and whatever you write, and use them only to reply.

2. Information in the Aulia application

Aulia is used by applied behavior analysis practices to run their work. Inside the application, a practice and its staff enter and manage:

• Client and family information — such as names, contact details, insurance, treatment plans, session data, notes and signatures. This is protected health information under HIPAA.
• Staff information — such as names, contact details, credentials, schedules, time records and hiring documents.
• Practice business information — such as billing and claims, payments, and the practice's books.
• Account and usage information — such as sign-in details and a log of who viewed or changed records, kept for security and auditing.

This information belongs to the practice. We process it on the practice's behalf and under its direction, to provide the service. Where it is protected health information, we handle it as a business associate under HIPAA. Questions about a specific client's records should go to that client's practice.

3. Bank account information (Plaid)

A practice can connect its own business bank and credit card accounts to Aulia's bookkeeping. We use Plaid Inc. (“Plaid”) to make that connection. When a practice connects an account:

• The bank sign-in happens inside Plaid. Aulia never receives or stores bank usernames or passwords.
• Through Plaid, Aulia receives the account name, type and last four digits, balances, and transactions (date, amount, description and check number).
• We use this only to keep the practice's books: matching deposits to insurance and family payments, categorizing expenses, and reconciling accounts. Aulia cannot move money.
• The connection token Plaid issues is encrypted before we store it. Transaction details stay in Aulia and are not sent to any other data service.

By connecting an account, the practice also agrees to Plaid's collection and use of its information under the Plaid End User Privacy Policy. A practice can disconnect a bank at any time from Aulia's Finance settings, or manage connections at my.plaid.com. Transactions already imported stay in the practice's books unless the practice deletes them.

4. How we use information

We use information to provide and support Aulia, keep it secure, prevent misuse, meet legal obligations, and improve how it works for the practices that use it. We do not sell information, and we do not use it for advertising.

5. When information is shared

We share information only:

• With service providers that run parts of Aulia — cloud hosting (Amazon Web Services), bank connections (Plaid), insurance claims and eligibility (a healthcare clearinghouse), text messages and email, fax, and telehealth video — only as each needs to do its job.
• At the practice's direction — for example, a claim to an insurer or records faxed to a provider the family has authorized.
• When the law requires it, or to protect the safety of a person or the security of the service.

Aulia's AI features run on Amazon Bedrock, within our AWS account and covered by Amazon's Business Associate Agreement. Information is not used to train AI models.

6. How long we keep information

We keep information for as long as the practice uses Aulia and as long as the practice's legal and record-keeping obligations require — health and billing records often have to be kept for years. When information is no longer needed, it is deleted or de-identified.

7. Security

We protect information with encryption in transit and at rest, multi-factor sign-in, role-based access and audit logging. No system is perfectly secure; if a breach affects information we hold, we will notify the practice as the law and our agreements require. More detail is on our security page.

8. Children

This website is not directed to children. Information about children in the Aulia application is entered by their practice, with their families, and is handled as described in section 2.

9. Your choices

If your information is in Aulia because of a practice — as a client, a family member or a staff member — contact that practice to see, correct or ask about it. For anything else, email us using the link below and we will respond.

10. Changes to this policy

If we change this policy, we will update the date at the top. If a change is significant, we will tell the practices that use Aulia before it takes effect.

11. Contact