TQH Brain Privacy Notice

TQH Research and Development LLC | Version 2026-09-28 | Effective date: September 28, 2026

This Notice explains information handling for TQH Brain, our website, Customer Portal and online features. It distinguishes records kept in your local practice workspace from account, payment and other information sent to the Company or service providers. It does not replace a practice’s own privacy notices or client obligations.

1 Local client and financial records

Your client lists, profiles, schedules, session notes, client documents, sensitive health information, practice financial reports, revenue and sales records, inventory records and related backups remain on equipment or storage you control. TQH Brain processes these Local Practice Records in your environment. The standard local installation does not automatically upload the primary practice database or document library, and the Company does not host or maintain a disaster-recovery copy of your primary local database or provide Company cloud storage for it. This is distinct from Connected-Feature Data that you deliberately submit, or configure the software to transmit on a schedule, through connected or online features, which may be transmitted to, processed by, stored in, decrypted by or accessible through Company-managed cloud services and designated providers as described in Section 4 and the feature-specific disclosures. Expressly authorized support may also permit access to information visible or supplied within the agreed session. Information submitted through a connected feature is not treated as remaining local merely because the source record also exists in your local database.

TQH Brain includes built-in security protections designed to help safeguard information against unauthorized access and misuse. Those features do not create routine Company access to the local practice database. Each practice controls its records, its staff permissions and the security of its equipment and must maintain secure backups on its own server, equipment or chosen cloud service. The practice must configure trusted HTTPS for each workstation and use full-drive encryption for volumes containing the database, keys, temporary staging files, exports and backups. No HIPAA certification is required to use the software; each practice must follow the privacy and security laws applicable to its activities.

We do not sell Local Practice Records, use them for advertising or use them to train AI models. We cannot retrieve, delete or restore records we do not possess. Information a person deliberately submits to a Company online service or support is handled as described below. Such submission is not automatic collection from the local database, and client-identifying information must not be submitted to unauthorized services.

2 Account licensing and purchase information

We process the information supplied to register and administer a subscription, such as the account holder’s name, practice name, business contact details, billing information, account and license identifiers, selected plan, permitted users, activation status and subscription dates. We keep records of orders, payments, refunds, cancellations and agreement acceptance. We use these for access, licensing, support, communications, fraud prevention and legal or accounting obligations, not to inspect a practice’s private financial reports.

Stripe handles payment-card collection and processing. We do not store full card numbers or security codes. Account administration may use Stripe customer, subscription and payment identifiers; tokenized payment references; payment and refund status; invoice details; billing contacts and addresses; and limited card details such as brand, expiration and last four digits. Stripe processes information under its own privacy notice, available within Stripe’s published privacy disclosures. Never send full card details through our ordinary email, support forms or network.

3 Network submissions and support

We receive content you deliberately submit to Company online features, including questions, replies, protocol resources, advertisements, practice profiles and directory listings. That content and the profile details associated with it are displayed to the audience identified by the feature. Other users may retain copies. Do not submit identifiable client health information or confidential client documents to these features.

If you contact support, we receive your contact details, support messages, technical logs and material you provide. Authorized remote assistance is provided through PC Planet’s HIPAA-configured Syncro arrangement under BAAs with Syncro and the Company, within the agreed authorization and scope. A technician may see information that you deliberately provide or display during the session, but this arrangement does not create routine Company access to the local practice database. Use fictional examples or remove unnecessary identifying information from ordinary email, tickets, screenshots, attachments and logs. Apply the agreed restrictions to any recording or transfer. If client information is accidentally submitted, contact us so it can be addressed securely and in accordance with law; do not repeat it in additional messages.

Connected features sharing and retention

4 Feature specific disclosures

Appointment emails, campaigns, secure forms, document exchange, referrals, messaging and optional integrations may send selected recipient details, appointment information, submitted content or attachments to recipients and providers, including through scheduled transmissions after a feature is enabled. Before activating any such feature, review the applicable notice identifying what leaves the device, who receives it, why, whether the Company receives or can access it, and the applicable retention and deletion limits. A feature without a completed disclosure, approved provider coverage and appropriate safeguards must not be enabled for sensitive client information.

The following connected features transmit selected information outside your local environment as described below. None of these features is approved for protected health information unless the Company has confirmed that the feature is approved for that use and the parties have executed any required Business Associate Agreement.

Appointment reminders: when you enable and send a managed reminder, including a scheduled reminder, your server transmits the recipient’s email address, appointment start time, time zone, practice name, contact telephone number and a delivery identifier to a Company cloud function, which sends the reminder using Microsoft Graph. Treatment-detail fields are not permitted request fields, but the practice identity and appointment context may still reveal health-related information. Delivery tracking stores identifiers, timestamps and status, not the recipient address or message body. A copy may remain in the sending mailbox’s Sent Items and in recipient systems, subject to Microsoft mailbox and recipient retention; no immediate-deletion or single universal retention period is promised.

Email campaigns: selected recipient information and campaign subject, body, links, sender information and scheduling data are submitted to Company-managed cloud processing, which stores an application-encrypted campaign payload together with scheduling and delivery progress and decrypts the payload in authorized service code to send messages through Microsoft Graph from the configured sender, currently marketing@tqhbrain.com. Encryption protects stored content but does not prevent the authorized sending service from reading it, and free-text and recipient fields are not technical guarantees against entry of health information. Completion or cancellation records a status and timestamp but does not automatically remove the encrypted payload. Unsubscribe tokens, suppression entries and delivery or audit records remain separate retained data. You are responsible for lawful recipient selection, permitted non-PHI content, accurate sender information, required disclosures and honoring opt-outs.

Secure forms and document exchange: the request email contains a secure link and instructions rather than completed answers, a clinical attachment or the submitted PDF, and a separate email supplies the verification code. The workflow submits the recipient email address, selected form or document information, attachments, request metadata and submitted content to Company-managed Firebase services; protected form data is application-encrypted in Firestore, attachments are encrypted in private Cloud Storage, and authorized service code decrypts them for the verified workflow and retrieval. Imported, Rejected, Revoked and Expired requests are terminal: the service removes the request and submission content and disables prior access, and attempts to delete attachments; an attachment may remain until a later deletion succeeds, and limited status and metadata are retained. Submitted forms awaiting review are retained, and later cloud cleanup does not erase a separately imported local record, mailbox copies, recipient copies or provider recovery copies. This is cloud processing of deliberately submitted information, not an automatic backup of your document library.

Network Center and protocol resources: posts, replies, practice listings, advertisements, moderation reports, access metadata and uploaded protocol PDFs are submitted to the Company’s network service. Text and metadata are stored in Firestore with provider-managed protection and access controls; protocol PDFs receive separate application-level encryption in private Cloud Storage and are decrypted by authorized retrieval code. These are different encryption arrangements, and Network text must not be treated as local-only or inaccessible to the service. Display and download depend on audience, membership and moderation rules, and visibility changes or moderation do not immediately erase recipient copies, files or audit records.

Support: you control what you submit or display during support and must remove unnecessary client identifiers before submitting ordinary email, tickets, screenshots, attachments or logs. Authorized remote support uses PC Planet’s HIPAA-configured Syncro arrangement under BAAs with Syncro and the Company, within the agreed authorization and scope. A technician may see content you deliberately share on screen; do not transmit protected health information through ordinary support channels.

Installed Microsoft 365 mailbox integration: the optional Messages/Inbox integration connects the Center server directly to the Microsoft tenant and mailbox configured in the practice’s communication settings through Microsoft Entra ID and Microsoft Graph. It can list folders and messages, read message content, send messages with recipients, subjects, bodies and attachments, and reply, forward, move, delete and change read state. Sent requests save a copy to Sent Items. Microsoft and recipients process that content; it is not routed through the Company-managed reminder or campaign store. The application secret is encrypted in local settings and decrypted for use. The configured tenant and mailbox control the account context, and background synchronization is not a complete local mailbox archive.

Consumer health data: some connected features—such as secure forms, appointment workflows, email campaigns and protocol resources—may collect information that reveals, or permits inferences about, a person’s health, treatment interests or the services a practice provides, and that may be regulated as consumer health data under certain state laws. Where such data is collected through an approved feature, we use it only to provide the selected feature and related operations, do not sell it or share it for cross-context behavioral advertising, and obtain any consent required before collection or sharing. You may withdraw applicable consent and exercise applicable rights as described in Section 8. If a required consent or disclosure framework is not in place for a jurisdiction, the affected feature should not be used for consumer health data in that jurisdiction. These provisions coordinate with, but do not replace, HIPAA obligations where HIPAA applies.

5 Technical information and cookies

Website, portal, licensing and security systems may process technical information such as IP addresses, request times, browser or operating-system details, device or installation identifiers, authentication events and error information. Processing is limited to the information identified in the completed technical notice below and its stated purposes. Diagnostics must not include client records, message bodies or practice financial reports without a separately disclosed and lawful arrangement.

The Customer Portal uses Firebase Authentication/Identity Platform for sign-in and account verification, Firebase Hosting for portal pages, and Company-managed Cloud Functions/Cloud Run, Firestore, Cloud Storage, Secret Manager, IAM, logging and scheduling services for account, licensing and security operations. These systems may process account, practice and installation identifiers, email-verification status, authentication method, sign-in and session information, action or event type, timestamps and outcomes. The portal uses browser session persistence for authentication and session storage for email-verification session proof and resend timing. Email-code verification stores a hashed challenge with attempt and expiry information. Download and acceptance controls record the accepting account identifier and email, practice identifier, agreement version and document hashes, the acceptance statement, the server-recorded acceptance date and time in UTC, the effective date and the installer release hash or identifier. The marketing website at tqhbrain.com is separately hosted and customer-controlled.

For Company-managed portal and connected-feature processing, we do not sell personal information or share it for cross-context behavioral advertising, and we do not use it for targeted advertising. Essential functions may require cookies or similar storage for login, security and session preferences. The separate marketing website uses the observed services described above; its hosting analytics settings, provider purposes and contractual classifications require confirmation before an unconditional site-wide no-sale, no-cross-context-sharing or no-targeted-advertising representation is made. We will provide visitor-facing cookie and privacy information and any legally required choices matched to the actual configuration. A change to these practices will require an accurate notice and any legally required choice or consent before the change begins.

Cookies and similar technologies on the public website. This disclosure covers the public marketing website at tqhbrain.com, which is hosted by GoDaddy. The Customer Portal’s authentication and session storage are described above, and connected-feature data flows are described in Section 4.

The website currently uses the following cookies: _scc_session (provider: GoDaddy; purpose: maintaining session continuity as you navigate the site; category: strictly necessary; approximate duration: 20 minutes); _tccl_visit (provider: GoDaddy; purpose: measuring an individual visit for traffic analytics; category: analytics; approximate duration: 30 minutes); and _tccl_visitor (provider: GoDaddy; purpose: distinguishing returning visitors for traffic analytics; category: analytics; approximate duration: approximately one year). The site also loads Google Fonts, which may cause your browser to send its IP address and request details to Google to retrieve fonts, and serves first-party scripts and media from the site’s own hosting.

Through these technologies, we or our hosting provider may process technical information such as your IP address, approximate location derived from it, browser and device characteristics, referring pages, request times and the cookie identifiers listed above. We do not currently use Google Analytics, Google Tag Manager, Meta Pixel or similar advertising or cross-site tracking tags on the public website.

Managing your preferences. Most browsers allow you to block or delete cookies and to send preference signals such as Global Privacy Control. Strictly necessary cookies are required for the site to function, and disabling other cookies may affect certain features. Where applicable law requires a consent or opt-out mechanism for non-essential cookies, we provide it on the website and honor valid universal opt-out signals.

Sale, sharing and targeted advertising. Based on the public website’s current configuration, we do not use its cookies to sell personal information, to share it for cross-context behavioral advertising or to deliver targeted advertising. We are confirming the hosting provider’s purposes, settings and contractual terms and will update this disclosure if that assessment changes. If we later add analytics, advertising or other non-essential technologies, we will update this disclosure and obtain any consent, or provide any opt-out, that applicable law requires before that processing begins.

6 Recipients and disclosures

We disclose information we hold to providers needed for the relevant service, including Google Cloud/Firebase for portal, hosting, authentication, cloud processing, storage, logging and scheduling; Microsoft Entra ID, Microsoft Graph and Exchange Online for configured communications and optional mailbox integration; Stripe for payment and subscription processing; PC Planet and Syncro for authorized support; and GoDaddy for hosting of the public marketing website, which also loads Google Fonts served by Google. Provider contractual coverage applies only to the services and tenant arrangements actually covered by the applicable accepted or executed agreement; a provider’s general availability of a BAA does not extend coverage to every product. We also disclose information to recipients you direct, in response to lawful obligations or valid legal process, and when reasonably necessary and lawful to protect rights, investigate fraud or address security risks. This does not give us routine access to local records we do not hold.

A merger, acquisition or business transfer may involve Company-held information, subject to applicable law and the privacy commitments attached to it. We do not authorize providers to use information we entrust to them for unrelated purposes except where a provider acts independently under its own disclosed legal obligations and notice, such as certain Stripe payment functions.

7 Retention and security

Account, licensing, subscription, billing-event, transaction, agreement and recurring-authorization records persist for administration, security, accounting, tax, contractual, legal and dispute purposes. The current implementation does not establish a universal post-closure purge or one fixed retention period for those records, and expiration of a sign-in challenge or download session does not itself delete related database entries, audit events or provider logs. Submitted online content, support information and logs follow the feature-specific lifecycle, applicable legal requirements, provider settings and operational procedures described below. Deletion requests are scoped to information we actually hold and may not reach recipient or mailbox copies, suppression records, legal holds, provider recovery copies or local records imported or exported by the practice.

Retention is feature-specific and does not use one universal period. Completed or canceled campaign processing records the applicable status and timestamp but does not currently scrub the encrypted campaign payload automatically; recipient and content payloads, progress, suppression records and unsubscribe tokens remain subject to applicable retention rules. Reminder tracking retains identifiers, status and timestamps rather than the recipient address or body, while Microsoft Sent Items, recipient mailboxes and mail-system logs are separate copies. Secure-form cleanup processes eligible requests and retries outstanding attachment removal, and may not complete immediately. For Imported, Rejected, Revoked and Expired requests, it removes protected request and submission fields and challenge or session hashes, denies the old access path and attempts attachment deletion; failed attachment deletion leaves paths and cleanup status for retry, and limited identity, status, review and cleanup metadata remain. Submitted forms awaiting review are retained. Network content, files, moderation and audit records, support mail, tickets, logs and remote-session artifacts have distinct lifecycles without a verified universal age-based deletion schedule. Mailbox copies, recipient copies, suppression records, legal holds and provider-maintained recoverable copies may persist after the active record is deleted.

We use reasonable safeguards appropriate to information we handle. No system is completely secure. We investigate incidents and provide notices required by applicable law. You remain responsible for security and backups of local records and for your authorized users and independently selected providers.

Privacy choices rights and contact

8 Requests concerning Company held information

Send privacy requests and account contact information to support@tqhbrain.com, without PHI, passwords or card numbers. Applicable rights may include access, a portable copy, correction, deletion, withdrawal of consent and opt-outs of sale, targeted advertising, certain sharing or covered profiling. We verify the requester and coordinate a request scoped to Company-held information and the relevant feature; there is no unified self-service export or delete-everything function for all Company-held data. Audit and financial records, legal holds, mailbox and recipient copies, suppression records and provider recovery copies may be retained as permitted or required by law. We do not use personal information for profiling with legal or similarly significant effects.

We verify requests using information appropriate to the request and accept authorized-agent requests where required, with proof of authority. We respond within applicable statutory deadlines and explain permitted exceptions, such as retaining records needed for legal obligations, security or a dispute. If your law provides an appeal, reply to our response or email support@tqhbrain.com with “Privacy appeal”; we provide the required appeal response and regulatory complaint information. We do not unlawfully discriminate or retaliate for exercising privacy rights.

We honor legally required universal opt-out signals for processing to which they apply. For Company-managed portal and connected-feature processing, we do not sell or use personal information for targeted advertising as described above. The separate marketing website remains subject to confirmation of its hosting settings, provider purposes and contractual classifications; any required visitor disclosures and choices will be matched to its actual configuration. If a jurisdiction requires additional disclosures or choices for an actual practice, we provide them before that processing occurs. Acceptance of the Terms is not consent to sell health information or a waiver of privacy rights.

9 Client requests and local records

Clients seeking their practice records should contact the practitioner or practice that holds them. We do not maintain those records under the standard local configuration and cannot fulfill a request by searching a database we do not have. If a request concerns information actually submitted to a Company service, we address it according to our role, applicable law and any governing agreement. Practices must not refer their own recordkeeping duties to the Company solely because they use TQH Brain.

10 Communications and account closure

You may unsubscribe from Company promotional emails using the unsubscribe mechanism. Necessary account, security, billing and service communications may continue while relevant. Your practice must separately manage consent and unsubscribe requests for communications it sends to its own clients.

Canceling a subscription and requesting deletion of Company-held personal information are different actions; tell us if you want both. Neither action directs us to erase locally stored client records, and the local client-deletion function uses a soft-delete flag and deletion metadata rather than demonstrated erasure of every related record, document, export and backup. Previously delivered messages, lawful recipient and mailbox copies, suppression records, tax records, audit or acceptance evidence, legal holds and provider recovery copies may remain subject to their own retention rules.

11 Children and third party services

Our website accounts and subscriptions are intended for adult business users, not children under 18 registering directly. We do not knowingly solicit personal information from children under 13 through these services. If you believe a child has submitted such information, contact us so we can investigate and take appropriate action. A practice’s lawful local records about minors remain that practice’s responsibility; they do not authorize disclosure to Company online features.

Independently selected email, IT, backup, shopping and meeting services operate under their own notices and settings. A Zoom or shop link opens an external service. Review the recipient, information disclosed and relevant terms before proceeding. Company-selected providers remain subject to the obligations applicable to our relationship with them.

12 Changes and contact

We identify an updated effective date when this Notice changes and give appropriate advance notice of material changes. Where consent is legally required for a new collection, use or disclosure, we obtain it before proceeding. We do not retroactively authorize incompatible uses merely by changing this Notice.

TQH Research and Development LLC | support@tqhbrain.com | https://tqhbrain.com

Mailing address: 1576 Bella Cruz Dr #319, The Villages, FL 32159