Irvin Technologies, LLC (“Irvin”, “we”, “us”) is a Missouri limited liability company. Irvin is an AI clinical-supervision tool: counseling programs and practices upload session recordings and transcripts, and Irvin returns structured supervision feedback.
1. The distinction that governs everything else
Irvin is a Business Associate under HIPAA. It is not a Covered Entity, and it is never in the care path.
That splits the information we hold into two categories, and they are governed by different instruments.
| Category | What it is | What governs it |
|---|---|---|
| A. Your account information | Information about you — the counselor, supervisor, or administrator using Irvin | This policy |
| B. Client content | Session recordings, transcripts, analyses, and client records you submit in the course of your work | The Business Associate Agreement between Irvin and your organization, plus that organization’s own Notice of Privacy Practices — not this policy |
We process Category B only on the documented instructions of the Covered Entity — the practice, agency, or university that holds the treatment relationship with those clients. We do not decide how it is used, we do not use it for our own purposes, and we do not disclose it except as the BAA permits.
If you are a client whose counseling session was analyzed
Please contact your counselor’s practice, agency, or university — not Irvin.
They are the Covered Entity. They hold your record, they answer requests about it under 45 CFR §164.524 and §164.526, and their Notice of Privacy Practices describes your rights. We hold that content on their instruction and are not permitted to act on it directly. If you write to us, the most we can do is route you to them.
2. Information we collect
2.1 Your account
When you or your organization creates your account:
- Email address and a hash of your password — we never store the password itself
- Display name, and your professional credentials if you provide them (for example LPC-S, LMFT-S, PhD)
- Role — supervisor, supervisee, or administrator — and the organization you belong to
- Professional context, where it applies to you: developmental level, theoretical orientation, program name, cohort year, semester start date, and licensure-hour targets and progress
These exist so the supervision feedback is calibrated to your stage of training. They are professional attributes, not health information about you.
2.2 Signing in
- If you sign in with Google or Microsoft, we store the identifier that provider returns so we can recognise you next time. We do not receive your password.
- Session and refresh tokens, so you stay signed in.
- Email-verification and password-reset tokens, stored hashed, so a database copy alone cannot be used to take over an account.
2.3 Content you submit on behalf of a Covered Entity
Depending on how your organization uses Irvin, this may include session audio recordings, transcripts, the analyses Irvin generates, skill ratings, supervisor annotations and notes, safety flags, and limited client records: first name, last initial, date of birth, gender, and counseling type.
This content is Protected Health Information. Irvin analyzes transcripts as received: nothing is removed or altered before analysis. Transcripts, analyses and everything derived from them are PHI, and we treat them as PHI at every point.
2.4 The waitlist on this site
When you join the waitlist, we receive what you enter: your name, email, phone number, ZIP code, job title and, if you give it, your clinic or school. The form sends it to this site’s server, which records it so our team can follow up with you.
We keep sign-ups in our marketing database and use them only to contact you about Irvin. You can opt out of our email list at any time, and every email we send you about the waitlist includes a way to do so. We do not sell it or share it for advertising. This form is not for client information.
2.5 Operational records
- Application logs, written so they contain no PHI
- An audit log of access to client content — who accessed what, and when. This is a HIPAA safeguard, and it records your activity
- Infrastructure logs from our hosting provider: API calls, and network connection metadata (source, destination, port, bytes). Network metadata contains no content
3. What we do not do
- No advertising. We run no ad networks and no advertising cookies.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
- No analytics or tracking scripts. Neither this site nor the application loads any analytics, tag manager, or product-telemetry service. Web fonts are self-hosted at build time, so viewing our site does not call a font provider from your browser.
- We do not use your content to train AI models, and our AI provider is contractually barred from doing so under our agreement with them.
4. Cookies and local storage
Irvin sets exactly one cookie.
| Cookie | Purpose | Properties |
|---|---|---|
refreshToken | Keeps you signed in without re-entering your password | HttpOnly; Secure in production; SameSite=None in production (required because the app and its server are on different domains) and SameSite=Lax in development; expires after 7 days |
HttpOnly means page scripts cannot read it, which is deliberate: it is why we do not keep sign-in tokens where a cross-site scripting flaw could reach them.
We also use your browser’s local storage for two conveniences that never leave your device: whether you have dismissed an onboarding step, and settings for an internal design tool. Neither is transmitted to us.
There are no advertising, analytics, or third-party cookies to consent to or refuse.
5. How we use information
- To provide the service — analysing sessions and returning supervision feedback
- To authenticate you and keep your account secure
- To send the three service emails described in section 6
- To maintain the audit and security records HIPAA requires of us
- To respond to your support requests
- To comply with law, and to enforce our Terms of Service
6. Who else is involved
Email we send you
Irvin sends three kinds of email, all operational — we send no marketing email from the application:
- Verify your email address — when your account is created
- Reset your password — when you ask for a reset
- A high-priority session notice to a supervisor, when Irvin flags a session for review. The subject line deliberately carries no clinical detail, because subject lines appear on lock screens
Subprocessors
Every vendor below that can touch client content has a signed Business Associate Agreement with us. All processing takes place in the United States.
| Subprocessor | What it receives | Why |
|---|---|---|
| Amazon Web Services | Account data and client content — hosting, database, file storage, AI inference, email delivery, logging | The platform Irvin runs on |
| Deepgram | Raw session audio, returned as a verbatim transcript | Speech-to-text for uploaded recordings |
| Vercel | Application front-end delivery | Hosting for the web interface |
Deepgram receives the recording itself, which is the most identifying artifact in the system — a recorded voice is an identifier in its own right. It is covered by a subcontractor BAA. Only audio uploads reach it; documents and pasted text never do.
We do not otherwise disclose your information, except where the law requires it, or in connection with a merger or acquisition — in which case the obligations in this policy and in our BAAs travel with the data.
7. How long we keep things
| Record | Retention |
|---|---|
| Session audio recordings | 8 days after upload by default, then deleted automatically. A supervisor or the counselor may keep a recording for review for up to 60 days at a time, and no recording is kept more than 180 days after upload. At colleges and universities, every recording is also deleted three days after the grading period or semester in which the session took place ends, if that comes first. A supervisor can delete a recording immediately at any time |
| Session transcripts | 90 days after the transcript is stored, then deleted automatically. Kept longer than the recording so a supervisor can revisit a session over a supervision cycle or a term |
| Analyses, ratings, notes, client records | For as long as your organization’s account is active, then per the BAA’s termination terms |
| Your account record | For as long as your account is active |
| Waitlist sign-ups | Kept in our marketing database. You can opt out of our email list at any time |
| Application and infrastructure logs | 7 days |
| Network connection metadata | 90 days |
| HIPAA compliance documentation | 6 years, as 45 CFR §164.316(b)(2)(i) requires |
Our access audit log is currently retained indefinitely — no automatic purge is implemented. Six years is the intended period. We state this plainly rather than describe a deletion schedule we do not yet run. The first records reach six years in July 2032, and the purge will be in place before then.
8. How we protect it
- Encryption in transit — TLS 1.2 or better; plain HTTP is redirected
- Encryption at rest for the database and for stored recordings and transcripts
- Network isolation — the database has no route to the internet and accepts connections only from the application
- Role-based access control, and an audit record of every access to client content
- Multi-factor authentication is available on Irvin accounts — a time-based one-time password from an authenticator app, with single-use backup codes. Turning it on is your choice; if you have, a code is required before you are signed in
No system is perfectly secure, and we do not claim otherwise. Our full set of safeguards, and the gaps we are still closing, are documented internally under 45 CFR §164.316 and shared with customers on request.
9. Your choices
If you hold an Irvin account: you can view and correct your account information in your settings. For deletion, contact us or your organization’s administrator — because your account may be attached to supervision records your organization is required to retain, deletion is coordinated with them.
If you are a client: see section 1. Your rights run through your counselor’s organization, and we are not permitted to act on them directly.
10. US state privacy laws
A number of US states now grant residents rights over personal information. How those statutes apply to Irvin is unusual on both sides: Protected Health Information handled by a Business Associate is generally carved out of them, and information about a professional acting in a business capacity is treated differently again.
We are finalising the scope of this section with counsel rather than stating a conclusion we have not yet reached. In the meantime, send any request about your own account information to the contact in section 13. We will acknowledge it, tell you what we can do, and tell you plainly if we decline and why.
11. Children
Irvin is for licensed and supervised counseling professionals, and you must be 18 or older to hold an account. We do not knowingly collect information from children online, and the service is not directed to them.
Separately: some counseling clients are minors, and a session record may concern one. That content is PHI held for a Covered Entity under section 1 — it comes to us from the counselor, never from the child, and it is governed by the BAA and the organization’s own consent practices.
12. Where we operate
Irvin is offered in the United States, to US counseling programs and practices, and all processing takes place in the United States. The service is not directed to users elsewhere, and we make no representation that it meets the requirements of any other jurisdiction’s data protection law.
13. Changes
If we change this policy materially, we will update the effective date and tell account holders before the change takes effect.
14. Contact
| Security Officer | Travis Smith — travis@meetirvin.com |
| Privacy Officer | Travis Smith — travis@meetirvin.com |
| Deputy, both roles | Matt Simpson — matt@meetirvin.com |
| Mailing address | 3037 Lexington Avenue Cape Girardeau, MO 63701 |
If you are a client asking about your counseling record, please see section 1 — we will route you to your provider, which is the fastest path to an answer.