Privacy Policy

Sunstone Health, Inc.

Effective date: October 6, 2026 Version 0.1

This Privacy Policy explains how Sunstone Health, Inc. (“Sunstone Health,” “we,” “us”) collects, uses, and shares information when you visit sunstonehealth.com, use the Sunstone application at app.sunstonehealth.com, or otherwise interact with us.

Two companies, two kinds of information

Sunstone Health, Inc. operates this website and the Sunstone application, and provides technology, care coordination, and administrative services. Medical care is provided by Sunstone Clinical, PC, a separate, physician-owned medical practice.

Health information you provide in the course of receiving care is protected health information governed by HIPAA and by the Sunstone Clinical, PC Notice of Privacy Practices. Sunstone Health, Inc. handles that information only as a business associate of Sunstone Clinical, PC, under a written agreement, and only as that agreement and the law allow. Where this Privacy Policy and the Notice of Privacy Practices both apply, the Notice controls for protected health information.

This Privacy Policy covers everything else: information you give us on the public website, account and usage information in the application, and information we receive from partners and providers.

Information we collect

Information you give us

Contact information when you request information, join a waitlist, or apply to the Sunstone Certified ABA Provider Network: name, email address, phone number, organization, role, and the states you serve or live in.
Account information when you register for the Sunstone application: name, email address, password, and your relationship to the patient.
Communications you send us, including emails, messages in the application, and support requests.
Payment information for cash-pay services. Payments are processed by a third-party payment processor; we do not store full card numbers.

Information we collect automatically

When you use the website or application, we and our service providers collect device and usage information such as IP address, browser type, pages viewed, links clicked, approximate location derived from IP address, and the date and time of access. We use cookies and similar technologies for the site to function, to remember your preferences, and to understand how the site is used. You can control cookies through your browser settings; disabling some cookies may affect site functionality.

We do not use advertising pixels or third-party advertising cookies on pages where health-related information is entered.

Information from other sources

We may receive information from the ABA providers, laboratories, diagnostic partners, and employers or health plans that work with Sunstone, as permitted by our agreements with them and by law.

How we use information

To provide, operate, and improve the website and the application.
To coordinate care on behalf of Sunstone Clinical, PC and the providers in the Sunstone network.
To respond to your requests and communicate with you about services, appointments, and account matters.
To process applications to the provider network and manage provider relationships.
To process payments.
To secure our systems, prevent fraud, and enforce our terms.
To comply with legal obligations.
To create de-identified or aggregated information, which we may use for any lawful purpose, including measuring outcomes and improving care.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We share information:

With Sunstone Clinical, PC and the clinicians, ABA providers, laboratories, and diagnostic partners involved in a patient’s care.
With service providers that host our systems, process payments, send communications, provide analytics, and support operations, under contracts that limit their use of the information to providing services to us.
With an employer, health plan, or plan administrator that sponsors a Sunstone program, limited to de-identified or aggregate results. Member-level information does not leave the clinical practice except as the Notice of Privacy Practices allows.
When required by law, legal process, or to protect the rights, safety, or property of Sunstone, our users, or others.
In connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.
With your consent or at your direction.

Your choices and rights

Access, correction, deletion. You may ask to access, correct, or delete the personal information we hold about you by emailing privacy@sunstonehealth.com. Requests involving medical records are handled under the Notice of Privacy Practices.
Marketing emails. You may unsubscribe using the link in any marketing email. We will still send transactional and service messages.
Cookies. See the cookie section above.
Account. You may update account information in the application or by contacting us.

We will verify your identity before acting on a request, and will respond within the time required by applicable law.

California residents

If you are a California resident, you have the right to know what personal information we collect, use, and share; to request deletion or correction; to opt out of sale or sharing (we do not sell or share personal information as those terms are defined under California law); to limit the use of sensitive personal information; and to be free from discrimination for exercising these rights. Submit requests to privacy@sunstonehealth.com. You may designate an authorized agent to make a request on your behalf. We do not knowingly sell or share the personal information of consumers under 16.

Washington residents and consumer health data

The Washington My Health My Data Act applies to certain consumer health data that is not covered by HIPAA. To the extent we collect such data from Washington residents, our Consumer Health Data Privacy Policy is this document. We collect consumer health data only with your consent or as necessary to provide a service you requested, share it only as described above, and do not sell it. You may request access, deletion, or a list of third parties with whom we have shared it, and you may withdraw consent, by emailing privacy@sunstonehealth.com. Appeals of denied requests may be sent to the same address with “Appeal” in the subject line.

Other states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have similar rights. We honor those rights to the extent they apply. Contact us at privacy@sunstonehealth.com.

Children

The website and application are intended for adults. Parents and legal guardians provide information about children in the course of seeking care, and that information is handled under the Notice of Privacy Practices. We do not knowingly collect personal information directly from children under 13 through the public website. If you believe a child has provided information to us directly, contact us and we will delete it.

Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and logging. No system is perfectly secure, and we cannot guarantee the security of information transmitted to us.

Data retention

We keep personal information for as long as needed for the purposes described in this Policy, to comply with legal obligations, resolve disputes, and enforce agreements. Medical records are retained under the retention requirements that apply to Sunstone Clinical, PC.

Links to other sites

The website may link to third-party sites and services, including ABA providers, laboratories, and diagnostic partners. Their privacy practices are their own.

Changes to this Policy

We may update this Policy. We will post the updated version with a new effective date and, for material changes, notify account holders by email or in the application.

Contact

Sunstone Health, Inc. 245 Main Street Cambridge, MA 02142 privacy@sunstonehealth.com