2.1 Information you provide directly

When you create an account, we may collect:

• Email address

• Password (stored as a hash, never in plaintext)

• Display name

• Profession (counselor or social worker)

• Exam target (NCE, NCMHCE, ASWB Masters, ASWB Clinical, or combinations)

• Practice state

• Target exam date

• Licensure type, license number, licensure state, license expiration

• Hours-ledger entries you create (date, category, supervisor name, treatment setting, notes)

Note: Hours-ledger entries may include the name of a supervisor you work with. By entering this information, you confirm you have the right to share it with us for the purpose of maintaining your own professional records, and you agree not to include any other identifying details about that individual beyond their name.

• Feedback you submit through the in-app feedback form

• Phone number (optional, if you choose to provide it for SMS communications or account verification)

Your license number and licensure information are treated with heightened confidentiality and are not required to use the service. 

Clear to Practice, LLC is not a HIPAA covered entity or business associate with respect to your professional practice, and the Service is not intended to be used in a manner that would make it subject to HIPAA.

Do not enter any client- or patient-identifying information in your Hours-ledger notes or any other free-text field within the application, via our website, in communication with Clear to Practice via email, or any other channel. See Section 10 for more detail.

2.2 Information collected automatically

When you use the Service, we collect:

• Study activity (questions answered, accuracy, time spent, sessions completed)

• Flashcard progress (SM-2 state per card)

• Device information (device type, OS version, app version, language, timezone)

• Crash and performance data

• IP address and approximate (city/region-level) location

• Usage analytics: Information about how you interact with the app, such as the features and screens you use, may be collected by our analytics provider to help us troubleshoot problems and operate and improve the Service. We collect only what is reasonably necessary for these purposes, and we never use it for advertising. You can opt-out of collection of optional usage and crash data using the in-app opt-out described in Section 8.5. 

• Session replay data: Our analytics provider may record how you interact with the app during a session, such as taps, scrolls, screen transitions, and the order in which you move through screens, for the purpose of diagnosing bugs and improving usability. Session recordings are configured to mask text you type, and we use only the minimum amount necessary for troubleshooting and product improvement, never for advertising. You can turn off session replay, along with other non-essential analytics, using the in-app opt-out described in Section 8.5.

• Information required to enable certain optional notifications. 

2.3 Information from third parties

• Apple App Store / Google Play: transaction confirmations (subscription state, purchase date, renewal date). We do NOT receive payment card information.

• RevenueCat: synchronized subscription state — confirms whether your account has an active Pro entitlement.

• Default analytics and functionality information collected by our service partners involved in data processing, as listed in Section 4.1.

2.4 Information we do not collect

• Payment card numbers (handled entirely by Apple / Google)

• Precise location (we do not use GPS)

• Contacts, photos, microphone, or camera (we do not request these permissions)

• Health data beyond what you voluntarily enter in the Hours ledger

• Protected Health Information or other sensitive personal information about your clients — see Section 10 for more on this restriction

• Biometric information. We do not collect, capture, purchase, or otherwise obtain biometric identifiers or biometric information, as those terms are defined under the Illinois Biometric Information Privacy Act (BIPA) or similar laws — including fingerprints, voiceprints, or facial or retinal scans. The Service does not request access to your device's camera or microphone, and we do not use facial recognition or any other biometric-based authentication or analytics.

We use the information we collect to:

• Operate, maintain, and improve the Service

• Authenticate your account

• Personalize your study experience (e.g., domain mastery recommendations)

• Process subscriptions through Apple / Google and RevenueCat

• Send service-related communications (account verification, password reset, subscription confirmations)

• Send optional emails (welcome, pre-exam reminders, win-back) — see Section 8 for opt-out

• Analyze how the Service is used so we can improve it

• Detect and prevent fraud or abuse

• Comply with legal obligations

‍ 4.1 Service providers (data processors acting on our behalf)

• Supabase — database and authentication backend. Hosts your account data, study activity, and hours entries.

• RevenueCat — subscription state synchronization

• PostHog — product analytics (usage events, session data)

• Apple / Google — app distribution and payment processing

• Anthropic — feature building and coding support

• EAS (Expo) — build and over-the-air updates

• Google — email and business administration services

• Resend — email and business administration services

• Squarespace — hosting for the marketing site

• Northwest Registered Agent — registered agent services, mail forwarding and phone services

• Sentry — error tracking and application performance monitoring

• Vercel — application development and deployment, agentic infrastructure

• Cloudflare — application development and deployment, agentic infrastructure, content delivery

Each service provider is contractually obligated to use your information only as needed to provide their service to us.

Some of our service providers, or the subcontractors they rely on, may store or process your information outside the United States. When that happens, we require that your information remain subject to the protections described in this Privacy Policy and to safeguards at least as protective as those required by applicable law.

4.2 Legal compliance

We may disclose information when required by law, subpoena, or government request, or to protect the rights, property, or safety of Clear to Practice, our users, or others.

4.3 Business transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred to the acquiring party. The acquiring party will be bound by this Privacy Policy or will provide notice of any material changes.

4.4 Aggregated or de-identified data

We may share aggregated or de-identified information that cannot reasonably identify you (e.g., “X% of NCMHCE users answer Question Y correctly”) for research, marketing, or product improvement purposes.

4.5 What we do NOT do

• We do NOT sell your personal information

• We do NOT share your personal information with third-party advertisers

• We do NOT share your information with anyone for their independent marketing purposes

We do not sell your personal information as “sale” is defined under Nevada and California law, and we do not “share” your personal information as that term is defined under California law.

This section applies to cleartopractice.com and any other web properties we operate; the mobile app's use of analytics is described in Section 2.2 and Section 4.1.

The Website uses cookies and similar technologies set by our Website hosting platform (Squarespace) and other service providers as described in Section 4.1, which may include both basic functionality (such as maintaining your session as you navigate the Website) and built-in site analytics, which provides us with aggregate visitor and traffic information.

Our service providers may set a first-party cookie or use similar browser storage to recognize returning visitors and measure usage, and may record how you interact with Website pages (such as clicks and scrolls) to help us diagnose problems and improve usability. We do not use these tools for advertising, and we have not added any third-party advertising, marketing, or remarketing trackers. For details on platform-level cookies, you may refer to our service provider’s individual privacy and cookie policies. 

You can set your browser to refuse cookies, and most browsers provide instructions for doing so in their help settings. Because the cookies on this Website are limited to those needed for basic Website functionality and platform analytics, disabling cookies may affect your ability to use certain features of the Website.

We use industry-standard technical and organizational measures, including data encryption, to protect your information and conduct regular reviews to ensure our practices align with relevant security protocols and applicable data privacy requirements.

Account data: Retained while your account is active. When you delete your account, your account data is permanently deleted and cannot be recovered, except for information we must keep to meet legal obligations (such as the subscription records described below). Residual copies may remain in encrypted backups before they are automatically overwritten on a routine basis; we do not restore or use these copies. 

Study activity: Retained while your account is active. Anonymized aggregate analytics may be retained longer.

Hours-ledger entries: Retained while your account is active.

Feedback submissions: Retained while we may need them to improve the Service.

Subscription records: Retained as required by tax and accounting law (typically 7 years).

Crash and diagnostic logs: Typically retained for up to 90 days.

Usage analytics: May be retained for up to 12 months, linked to an account identifier rather than your name. Some analytics information is not automatically deleted when you delete your account and will instead expire on a 12-month schedule. If you would like us to delete your personal analytics data sooner than the automatic 12-month deletion schedule, you may contact legal@cleartopractice.com from the email address associated with your account. We will verify and respond to your request as reasonably practicable, consistent with applicable law (see Section 11). 

8. Your Choices

8.1 Account access and updates

You can review and update most account information directly in the Service (Account Settings).

8.2 Account deletion

You can delete your account at any time via Account Settings. Account deletion permanently removes your personal data, subject to legal retention requirements. Subscription cancellation must be done separately through Apple / Google.

8.3 Email and/or text communications

Service-related emails (account verification, password reset, subscription confirmations) cannot be opted out of while you have an active account.

Optional emails (welcome, pre-exam reminders, win-back) can be opted out of via the unsubscribe link in each message. 

8.4 Push notifications

You control push notification permissions through your device settings.

8.5 Analytics opt-out

You may opt out of non-essential product analytics (including certain usage and crash data) at any time via the in-app opt out mechanism. The setting applies to the device you change it on; if you use the app on more than one device, confirm this setting is turned off on each. 

Opting out does not affect our ability to provide core features of the Service.

8.6 Do Not Track

Some browsers and browser extensions send an opt-out preference signal called Global Privacy Control (“GPC”). Where required by California or other state law, we treat a validated GPC signal received from your browser as a request to opt out of the sale or sharing of your personal information for that browser and device. Because we do not sell or share personal information as those terms are defined under California law, recognizing a GPC signal does not change how we process your information, but we honor it as a valid opt-out preference signal for California residents where applicable.

Some browsers transmit a “Do Not Track” signal. Apart from our treatment of GPC signals described above, we do not currently alter our data collection practices in response to a browser “Do Not Track” signal.

The Service is intended for adults 18 years of age or older preparing for professional licensure examinations, consistent with the age requirement in our Terms of Use. We do not knowingly allow anyone under 18 to create an account or use the Service.

Separately, and in addition to this age requirement, this website is not directed to children, and we do not knowingly collect personal information from minor children. If we learn we have collected information from a child, we will delete it. If you believe we have collected information from a child, contact us at legal@cleartopractice.com.

Clear to Practice, LLC is not a HIPAA covered entity or business associate with respect to your professional practice, and the Service is not intended to be used in a manner that would make it subject to HIPAA. The Service is not designed or intended to store Protected Health Information (“PHI”) or other information that could identify a client or patient you serve professionally.

As described in our Terms of Use, you agree not to enter, upload, or otherwise submit any client- or patient-identifying information to the Service. We disclaim any obligation to comply with HIPAA or analogous state health-privacy laws in connection with your use of the Service.

11.1 Verifying your identity

Regardless of where you live, you generally have the right to know what personal information we hold about you, access it, correct it, transfer it, and delete it. Where we rely on your consent to process personal information, you may withdraw that consent at any time. If you exercise these rights, we will not treat you in a discriminatory way or provide you a lesser level of service.

To protect your account and personal information, we will verify your identity before fulfilling a privacy request — typically by confirming the request comes from the email address associated with your account. We may ask for additional information if we cannot verify your identity from the account email alone.

11.2 When we may decline a request

There are situations where we may not be able to fully honor a privacy request, including where:

• We are legally required to retain the information (for example, subscription and tax records, as described in Section 7)

• The request relates to an account under investigation for fraud, abuse, or security concerns

• Fulfilling the request would infringe on another person's privacy or legal rights

• The request is frivolous, vexatious, or extremely impractical to fulfill

If we decline a request, in whole or in part, we will explain why.

11.3 Filing a complaint

If you are not satisfied with our response to a privacy request, you may file a complaint with us at legal@cleartopractice.com, or with the applicable regulator — for example, your state Attorney General's office or, in some cases, the Federal Trade Commission.

12.1 California residents (CCPA / CPRA)

California residents have the right to:

• Know what personal information we collect, use, disclose, and sell

• Delete personal information we hold

• Correct inaccurate personal information

• Opt out of the sale or sharing of personal information (we do not sell or share for cross-context advertising, as those terms are defined under California law)

• Limit use of sensitive personal information**

• Non-discrimination for exercising privacy rights

To exercise these rights, email legal@cleartopractice.com. We will verify your identity as described in Section 11.1 and respond within the timeframe required by law.

** The only category of “sensitive personal information” (as defined under applicable California law) that we collect is your account log-in credentials (email address and password) in combination with each other. We use this information solely to authenticate your account and secure the Service. We do not use or disclose this information for any other purpose.

12.2 Nevada Residents

Nevada law (NRS 603A) permits Nevada residents to submit a verified request directing us not to sell certain personal information. We do not sell personal information as defined under Nevada law. If you would like to submit a request regardless, email legal@cleartopractice.com with “Nevada Opt-Out Request” in the subject line, and we will respond within the timeframe required by law.

12.3 Colorado, Connecticut, Virginia, and other comprehensive privacy law states

If you are a resident of Colorado, Connecticut, Virginia, Utah, Texas, or another state with a comprehensive consumer privacy law, you generally have the right to:

• Confirm whether we process your personal information

• Access the personal information we hold about you

• Correct inaccuracies in your personal information

• Delete your personal information

• Obtain a portable copy of your personal information

• Opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in any of these practices)

• Appeal a decision we make regarding your privacy request

To exercise these rights, email legal@cleartopractice.com. We will verify your identity as described in Section 11.1 and respond within the timeframe required by the law of your state of residence. If we deny a request, you may appeal by replying to our denial email; if the appeal is denied, some states permit you to contact your state Attorney General.

12.4 Not Intended for Users Outside the United States

The Service is intended for use by individuals located in the United States and is not directed to individuals located outside the United States. If you access the Service from outside the U.S., you do so on your own initiative and are responsible for compliance with local laws; we make no representation that the Service complies with laws of jurisdictions outside the U.S. In the event that our service partners process data outside of the United States, that information will be subject to the protections described in Section 4.1. 

The Service may link to third-party websites or services (such as Apple, Google, NBCC, ASWB, state licensing boards, or our charitable partner). We are not responsible for the privacy practices of those services. Review their privacy policies before providing information.

We may update this Privacy Policy from time to time. Material changes will be communicated at least 7 days before they take effect. Your continued use after the effective date constitutes acceptance.

For questions about this Privacy Policy or to exercise your privacy rights:

Clear to Practice, LLC
2501 Chatham Rd
#6611
Springfield, IL 62704, USA

Email: legal@cleartopractice.com