Privacy Policy

Introduction

MentraCore LLC ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

Information We Collect

Personal Information

We may collect and process the following categories of information when you use MentraTrack:

• Account Information: Name, email address, contact information, account credentials, professional credentials, and account preferences.
• Fieldwork and Supervision Records: Fieldwork hours, supervision activities, experience types, supervisor-trainee relationships, progress tracking, competency assessments, and related records.
• Documents and Uploaded Files: Monthly and final verification forms, supervision agreements, supporting documentation, and other files voluntarily uploaded to the platform.
• Organizational Information: Organization affiliations, assigned roles, trainee and supervisor relationships, organizational settings, and administrative information.
• Usage and Technical Information: Device information, IP addresses, browser information, application activity, error logs, and other technical information used to maintain, secure, and improve the Service.
• Communications: Information you provide when contacting support, submitting feedback, or communicating with our team.

MentraTrack is designed for professional supervision and fieldwork management. Users should not submit identifiable client protected health information (PHI) or other sensitive client information to the platform.

Usage Data

We automatically collect certain information when you use our Service, including:

• Browser type and version
• Device type and operating system
• IP address
• Access times and dates
• Pages viewed and features used
• Error logs and performance data
• Name and contact information
• Account credentials
• Fieldwork tracking information
• Usage data and preferences
• Device information and identifiers

How We Use Your Information

We use information collected through MentraTrack for the following purposes:

• Service Delivery: Providing, operating, maintaining, and improving the MentraTrack platform and its features.
• Fieldwork and Supervision Management: Recording and managing fieldwork hours, supervision activities, competency assessments, and related documentation.
• Review and Approval Workflows: Enabling authorized supervisors to review, verify, approve, or request changes to submitted fieldwork records and supervision documentation.
• Organizational Administration: Providing authorized organization administrators with reporting, compliance monitoring, supervision oversight, and management tools.
• Access Control and Authentication: Managing user accounts, authentication, permissions, and authorized access to records and documents.
• Document Management: Storing, processing, and generating supervision-related documents, verification forms, and reports requested by users.
• AI-Powered Features: Providing educational, professional development, and administrative assistance through AI-powered functionality where applicable. Customer content is not used to train or fine-tune general-purpose AI models.
• Platform Security: Monitoring system performance, detecting and preventing unauthorized access, investigating security incidents, and protecting against fraud or misuse.
• Customer Support: Responding to inquiries, resolving technical issues, and providing assistance to users and organizations.
• Service Communications: Sending important account notifications, product updates, security alerts, and service-related communications.
• Legal and Contractual Compliance: Fulfilling applicable legal obligations, enforcing our agreements, and protecting the rights and security of MentraTrack and its users.

Data Storage and Security

We do not sell personal information to third parties.

We use customer information only for legitimate service, operational, security, and legal

At MentraTrack, we take the security and privacy of customer information seriously. We implement technical, administrative, and organizational safeguards designed to protect personal information, fieldwork records, supervision documentation, and uploaded files against unauthorized access, disclosure, alteration, and loss.

Our security practices include the following measures:

1. Encryption and Infrastructure Security

MentraTrack uses cloud-based infrastructure with security safeguards designed to protect customer information during transmission and storage.

These measures include:

• Encryption in Transit: Data transmitted between users and MentraTrack is protected using encrypted connections, including HTTPS/TLS.
• Encryption at Rest: Stored application data is protected using encryption at rest.
• Infrastructure Access Restrictions: Access to production infrastructure, databases, and sensitive systems is restricted to authorized personnel and services.
• Environment Security: Production infrastructure is managed with security configurations intended to reduce unauthorized access and exposure.
• Security Maintenance: We evaluate and update infrastructure configurations, application dependencies, and security protections as appropriate.

2. Role-Based Access Controls

MentraTrack uses role-based access controls (RBAC) to manage access to platform information according to each user's authorized responsibilities.

The platform supports different permission levels for:

• Trainees: Access to their own fieldwork records, supervision history, documents, and related account information.
• Supervisors: Access to records and documents associated with trainees they are authorized to supervise, including information necessary to review, verify, and approve supervision activities.
• Organization Administrators: Access to organizational management, reporting, trainee and supervisor oversight, and other administrative functions according to their assigned permissions.

Access permissions are designed to prevent users from viewing or modifying information outside their authorized scope.

3. Least-Privilege Access

MentraTrack follows the principle of least privilege, under which users and internal personnel should receive only the access necessary to perform their authorized responsibilities.

Our approach includes:

• Limiting application access according to user roles and authorized relationships.
• Restricting access to administrative functions and sensitive information.
• Limiting access to production infrastructure and customer data to personnel with legitimate operational responsibilities.
• Managing access according to changes in user roles and organizational relationships.
• Restricting access to sensitive system credentials and configuration information.

These measures are intended to reduce unnecessary access to customer information.

4. Document and File Access Protection

MentraTrack supports the storage and management of supervision-related documentation, including verification forms, supervision agreements, and supporting files.

We apply security measures designed to protect these documents from unauthorized access.

These include:

• Authorized File Access: Document access is governed by applicable user permissions and authorized trainee, supervisor, or organizational relationships.
• Organizational Data Separation: Access controls are designed to prevent users from accessing records and documents belonging to unrelated organizations.
• Protected File Storage: Uploaded documents are maintained using cloud storage infrastructure with applicable access and security safeguards.
• Restricted File Operations: Access to view, download, or manage files is governed by the user's applicable permissions.
• Sensitive Information Protection: Users are instructed not to upload identifiable client protected health information (PHI).

Document access is intended to follow the same authorization principles as other protected records within MentraTrack.

5. Supervision Review and Approval Workflows

MentraTrack incorporates supervision review and approval workflows to support record accuracy, accountability, and appropriate oversight.

These workflows include:

• Trainees submitting fieldwork hours and related supervision documentation.
• Authorized supervisors reviewing and verifying submitted information.
• Supervisor approval of fieldwork records and applicable verification forms.
• Tracking submission and approval status.
• Providing administrators with visibility into pending approvals, missing documentation, and supervision progress.

These workflows help organizations monitor fieldwork documentation and identify records requiring review.

Approval workflows operate separately from access controls. Authorization determines whether a user may access a record, while approval workflows track whether submitted information has been reviewed or verified by an authorized supervisor.

6. Authentication and Account Security

MentraTrack uses authentication and account security controls to help protect user accounts from unauthorized access.

Our measures include:

• Requiring user authentication to access protected platform functionality.
• Restricting access to account information and application features based on applicable permissions.
• Managing user sessions and authentication credentials through application security controls.
• Applying protective measures intended to reduce unauthorized account access.

Users are responsible for maintaining the confidentiality of their authentication credentials and notifying MentraTrack of suspected unauthorized account activity.

7. Data Backups and Recovery

MentraTrack maintains backup and recovery procedures intended to protect customer information and support service restoration following infrastructure failures, accidental data loss, or other operational disruptions.

Our approach includes:

• Maintaining backup procedures for applicable production data.
• Restricting access to backup resources and recovery systems.
• Protecting backup information through applicable infrastructure security controls.
• Maintaining procedures intended to restore affected services and data.
• Managing backup retention according to applicable operational and security requirements.

Backup procedures are designed to support operational continuity and reduce the risk of permanent data loss.

8. Security Monitoring and Threat Prevention

MentraTrack uses application and infrastructure monitoring to help identify operational problems, security risks, and potentially unauthorized activity.

Our approach includes:

• Monitoring application and infrastructure health.
• Reviewing operational errors and service disruptions.
• Evaluating identified security risks and vulnerabilities.
• Applying security updates and remediation measures as appropriate.
• Maintaining controls intended to reduce exposure to unauthorized access or misuse.

Security safeguards are reviewed and improved as the platform and associated risks evolve.

9. Incident Response and Security Notifications

MentraTrack maintains processes for responding to identified security incidents affecting the confidentiality, integrity, or availability of customer information.

When an incident is identified, our response may include:

• Investigating the nature and scope of the incident.
• Taking appropriate containment and remediation measures.
• Evaluating whether customer information was affected.
• Restoring affected systems or services where necessary.
• Implementing corrective measures intended to reduce the likelihood of recurrence.
• Notifying affected customers or other parties when required by applicable law or contractual obligations.

10. Service Availability and Transparency

MentraTrack monitors its application and supporting infrastructure to maintain service reliability and identify disruptions.

We provide a public service status page where customers can review reported service availability and operational incidents:

https://status.mentratrack.com

The status page provides additional transparency into platform operations but does not constitute a guarantee of uninterrupted service.

11. Third-Party Service Providers

MentraTrack uses third-party service providers for functions such as cloud hosting, data storage, payment processing, communications, monitoring, and AI-powered functionality.

Where applicable, we take steps to evaluate service providers and limit their access to information according to the services they provide.

Third-party providers may process information on our behalf as necessary to operate and deliver MentraTrack services, subject to applicable contractual, privacy, and security requirements.

12. Continuous Security Improvement

We periodically evaluate our security practices, infrastructure configurations, application safeguards, and operational procedures.

As MentraTrack evolves, we may introduce additional protections, update existing controls, or modify security procedures to address identified risks and changing operational requirements.

Although we implement safeguards designed to protect customer information,

Organizational Access and Supervision Approval Workflows

MentraTrack enables organizations to manage fieldwork and supervision activities through designated user roles, organizational relationships, and structured approval workflows.

Organizational Access and Permissions

Access to fieldwork records, supervision documentation, uploaded files, and organizational information is governed by each user's assigned role, applicable permissions, and authorized relationships within the platform.

• Trainees: May access and manage their own fieldwork records, supervision documentation, and related information, subject to applicable permissions and approval requirements.
• Supervisors: May access records and documentation associated with trainees they are authorized to supervise, including information necessary to review, verify, and approve fieldwork activities.
• Organization Administrators: May access organization-wide information necessary for administrative oversight, supervision management, compliance monitoring, and reporting, according to their assigned permissions.

MentraTrack is designed to restrict access to records and documents outside a user's authorized scope, including information belonging to unrelated organizations.

Supervision Review and Approval

MentraTrack provides workflows for submitting, reviewing, verifying, and approving supervision-related records.

These workflows may include:

• Trainees submitting fieldwork hours and related documentation.
• Authorized supervisors reviewing submitted records for accuracy and completeness.
• Supervisors approving or requesting changes to submitted information.
• Tracking submission and approval status.
• Providing authorized organization administrators with visibility into pending approvals, missing documentation, and supervision progress.

Approval workflows are separate from access permissions. Authorization determines whether a user may view or interact with a record, while approval workflows establish whether submitted information has been reviewed or verified by an authorized supervisor.

Organizational Data Visibility

When a user is associated with an organization, relevant fieldwork records, supervision documentation, progress information, and account details may be accessible to authorized supervisors and organization administrators.

Access is determined by the user's role, organizational affiliation, and applicable permissions.

Organizations are responsible for assigning appropriate administrative and supervisory roles, maintaining accurate supervisor-trainee relationships, and updating access when responsibilities or organizational relationships change.

Changes to Organizational Relationships

When users join, leave, or change roles within an organization, their access to organizational information may change accordingly.

Certain historical supervision records may remain available to authorized users where necessary for legitimate recordkeeping, compliance, or contractual purposes, subject to applicable permissions and retention requirements.

MentraTrack maintains controls designed to prevent unauthorized access to organizational information following changes in

Artificial Intelligence and Customer Data

MentraTrack may provide AI-powered features designed to support professional development, supervision activities, educational workflows, and administrative tasks.

We recognize the importance of protecting customer information and maintaining transparency about how artificial intelligence is used within our platform.

AI-Powered Features

MentraTrack may use artificial intelligence technologies to provide functionality such as educational assistance, competency development, and supervision-related support.

When users interact with these features, information they voluntarily submit may be processed by authorized third-party AI service providers as necessary to deliver the requested functionality.

AI Model Training and Customer Data

MentraTrack does not use customer-submitted fieldwork records, supervision documentation, uploaded files, or other customer content to train or fine-tune general-purpose AI models.

We do not authorize third-party AI service providers to use customer content to train or fine-tune their general-purpose AI models.

Customer information may be processed as necessary to deliver AI-powered functionality, subject to applicable privacy, security, and contractual protections.

Data Access and Processing

Access to customer information used in AI-powered workflows is subject to applicable platform permissions and access controls.

We seek to limit the information processed by AI service providers to what is reasonably necessary to provide the requested functionality.

Third-party AI providers may process or temporarily retain information according to their applicable data-processing agreements, security practices, and retention policies.

AI-Generated Content

AI-generated content is intended to assist users with educational, professional development, and administrative activities.

AI-generated outputs may contain errors or inaccuracies and should be reviewed by users before being relied upon.

AI-powered functionality does not replace professional judgment, supervisory responsibilities, or applicable certification and regulatory requirements.

Sensitive Information Restrictions

Users must not submit identifiable client protected health information (PHI), confidential client records, or other prohibited sensitive information through MentraTrack's AI-powered features.

Organizations are responsible for ensuring that their users follow applicable confidentiality requirements when using AI-assisted functionality.

Client Protected Health Information (PHI)

Intended Use of the Platform

MentraTrack is designed for professional supervision management, fieldwork documentation, competency development, and organizational oversight.

The platform is not intended for the collection, storage, or processing of identifiable client protected health information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA).

MentraTrack is not offered as a HIPAA-compliant service for processing client PHI and does not enter into Business Associate Agreements (BAAs) for the Service.

Restrictions on Sensitive Client Information

Users must not enter, upload, or otherwise submit identifiable client PHI through MentraTrack.

This restriction applies to all areas of the platform, including:

• Fieldwork notes and supervision records.
• Uploaded documents and verification forms.
• Competency assessments and professional development activities.
• AI-powered features and interactions.
• Other user-generated content submitted through the Service.

Users should use de-identified or generalized descriptions of activities when documenting fieldwork and supervision.

Organizational and User Responsibilities

Organizations and users are responsible for ensuring that information submitted to MentraTrack complies with applicable confidentiality, privacy, and professional requirements.

Organizations should instruct their trainees, supervisors, and administrators not to include identifiable client PHI in any information submitted to the platform.

Inadvertent Submission of PHI

If a user becomes aware that identifiable client PHI has been inadvertently submitted to MentraTrack, they should promptly contact us at support@mentracore.com.

We will review the request and take appropriate steps to address the information in accordance with our applicable policies, contractual obligations, and legal requirements.

Protection of Customer Information

Although MentraTrack is not intended to process client PHI, we maintain technical and organizational security safeguards designed to protect the personal information, fieldwork records, supervision documentation, and other customer information processed through the Service.

These safeguards are described in the Data Storage and Security section of this Privacy Policy

Information Sharing and Disclosure

We may share your information with:

• Service providers and business partners who assist in operating our platform
• Law enforcement or regulatory bodies when required by law
• Professional advisors (e.g., lawyers, accountants) as needed
• Third parties in connection with a business transaction (e.g., merger or acquisition)

We do not sell your personal information to third parties.

We use the collected information for:

Your Rights and Choices

You have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data
• Opt-out of certain data collection and use
• Export your data
• Withdraw consent where applicable
• Providing and maintaining our Service
• Improving and personalizing user experience
• Analyzing usage patterns and trends
• Communicating with you about updates and changes
• Ensuring platform security and preventing fraud
• Complying with legal obligations

Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe we may have collected information about a child, please contact us.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending you an email notification for significant changes

We implement appropriate technical and organizational security measures to protect your personal information, including:

Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

MentraCore LLC
Operating as MentraTrack

Email: support@mentracore.com

Website: https://www.mentratrack.com

Terms and Conditions: https://www.mentratrack.com/terms-and-conditions

Service Status: https://status.mentratrack.com

Address: 1111 6TH AVE STE 550 #206628, San Diego CA 9210‍

Formal legal notices should be submitted in accordance with any applicable written agreement or through a legally valid notice method.

This Privacy Policy is governed by the laws of California, without regard to its conflict of law provisions.

California Privacy Rights

Data Retention

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). Please contact us for more information about your California privacy rights.

International Data Transfers

If you access our Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our servers are located. By using our Service, you consent to such transfers as described in this Privacy Policy.

We retain your personal information only for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes
• Enforce our agreements