Website Privacy Policy
psyfipractice.com and psyfitechnologies.com
Last updated: October 23, 2026
This policy covers the public marketing websites only.
The PsyFi application (app.psyfipractice.com, the Chrome extension, and the iOS app) handles clinical content under a separate application privacy policy and a Business Associate Agreement. Nothing on these marketing pages is designed to receive protected health information, so please do not enter client or patient details anywhere on this website.
Who we are
These websites are operated by Oaken Cloud Technologies, LLC, doing business as PsyFi Technologies ("PsyFi", "we"). PsyFi builds HIPAA-aligned software for behavioral health practices; a BAA is available on every paid plan of the PsyFi application. Questions about this policy go to hello@psyfitechnologies.com.
What this website collects
The marketing sites are static pages. We do not require an account to read them and we do not ask for health information. Data reaches us in three ways:
- Forms you submit. The support form and the email waitlist / template-request forms collect what you type (name, email address, product, message). See "Form processors" below.
- Analytics and advertising measurement. Page views, referring site, approximate location derived from IP address, device and browser type, and which links or buttons you click. See "Third-party services" below.
- Server and edge logs. Our hosting providers keep standard request logs (IP address, URL, user agent, timestamp) for security and troubleshooting.
Third-party services on this website
Each service below runs in your browser when you load a page (unless noted) and receives your IP address and standard browser information. None of them is given health information by us, and none of them should be given health information by you.
| Service | Purpose | What it receives |
|---|---|---|
| Google Analytics 4 (Google LLC) | Understand which pages are read and how visitors move through the site. Two GA4 properties are configured. | Page views, events (for example, clicking a "start trial" button), device/browser, approximate location. Sets first-party _ga cookies (up to 2 years).
Google privacy policy · GA opt-out add-on. |
| Google Ads conversion tracking (Google LLC) | Measure whether visitors who arrive from a Google ad later start a trial. Also carries ad-click identifiers (gclid, gbraid, wbraid) and UTM parameters through to the app signup page. |
Ad-click identifiers and conversion events. Sets the _gcl_aw cookie (about 90 days).
Google ad settings. |
| Microsoft Advertising UET (Microsoft Corporation) | The same conversion measurement for visitors who arrive from a Bing/Microsoft ad. | Ad-click identifier (msclkid) and conversion events. Sets the _uetmsclkid / _uetsid / _uetvid cookies (up to about 13 months).
Microsoft privacy statement. |
| PostHog (PostHog, Inc., US cloud) | Product analytics on most pages (not the home page): page views, autocaptured clicks, blog-article views, download and outbound-link clicks. | Page URL, click targets, device/browser, approximate location. Session recording is turned off. Sets a first-party ph_* cookie.
PostHog privacy policy. |
| Google Fonts & jsDelivr | Serve some web fonts and the icon font used on the home page. | IP address and browser information from the font request. No cookies. |
| YouTube (Google LLC) | Product walkthrough videos on the home, tutorials, and PsyFi Mobile pages. We host the video thumbnails ourselves and use the privacy-enhanced youtube-nocookie.com embed, so nothing loads from YouTube until you press play. |
Nothing until you press play; after that, YouTube's own privacy policy applies. |
| Cloudflare (psyfipractice.com) and Amazon Web Services (psyfitechnologies.com) | Hosting, content delivery, TLS, and DDoS protection. | Standard request logs (IP address, URL, user agent). Cloudflare may set a __cf_bm bot-management cookie (30 minutes).
Cloudflare · AWS. |
Form processors
We do not run our own form backend on the marketing sites. Form submissions are delivered to our inbox by two third-party processors:
- FormSubmit (formsubmit.co) handles our support forms: the general support form, the Winnow support form, and the Offline Knowledge support form. Your name, email, selected product or topic, and message pass through FormSubmit to support@psyfitechnologies.com. Each form carries a notice asking you not to include client, patient, or personal health information, because FormSubmit is not covered by a BAA. FormSubmit privacy policy.
- Formspree (formspree.io) handles the email-only waitlist and template-request forms. Formspree privacy policy.
Neither processor is covered by a Business Associate Agreement. That is why the support form asks you not to include client or patient information. If your question involves a specific client, say so in general terms and we will follow up through a secure channel. Support requests are kept for as long as needed to resolve them and for our records of the resolution.
Cookies and consent
The analytics and advertising tags above load when a page is opened. We do not currently show a cookie banner; you can control these tools with the opt-out links in the table, by blocking third-party scripts in your browser, or by clearing cookies. We do not use these tools inside the PsyFi application where clinical content lives, and we never use them to identify clients or patients.
Where a consent law applies to you (for example, GDPR or a US state privacy law), you may ask us to stop processing or to delete the data we hold about you; see "Your choices".
How we use what we collect
- To answer support and sales requests you send us.
- To understand which content is useful and to fix problems with the site.
- To measure whether advertising brings clinicians to PsyFi. We do not sell personal information and we do not share it with third parties for their own marketing.
- To keep the site secure (abuse detection, rate limiting, incident investigation).
Retention
Analytics data is kept according to each provider's retention setting (Google Analytics user-level data: at most 14 months; PostHog: the retention of our PostHog plan, and we delete on request). Hosting logs rotate on a short schedule. Form submissions live in our support mailbox for as long as needed to handle the request and keep a record of it.
Your choices
- Email hello@psyfitechnologies.com to ask what we hold about you, to correct it, or to delete it. We respond within 30 days.
- Use the provider opt-outs linked above, or a browser setting or extension that blocks third-party scripts.
- Ad-click identifiers and UTM parameters are only carried to the app signup page if they are present in the URL you arrived on; removing them from the address bar stops that.
Children
These websites are for licensed professionals and practice staff. We do not knowingly collect information from anyone under 16.
Security
Both sites are served over HTTPS only, and plain-HTTP requests are redirected to HTTPS. How we protect data inside the PsyFi application is described on the Security & HIPAA page, and our vulnerability-disclosure contact is published at /.well-known/security.txt.
Product-specific policies
- PsyFi application (web, Chrome extension, iOS)
- Winnow (client CBT journal app)
- Offline Knowledge Assistant
- PsyFi Scribe Chrome extension
Changes
We will update this page when the services on the site change and revise the date at the top.
Contact
Oaken Cloud Technologies, LLC d/b/a PsyFi Technologies · hello@psyfitechnologies.com