Privacy Policy

Effective Date: February 12, 2026

1. Introduction

BookWise ("we," "our," or "the Service") is a financial management platform for mental health providers. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

BookWise is operated by BookWise, LLC. We are committed to protecting your privacy and complying with the Health Insurance Portability and Accountability Act (HIPAA) where applicable.

2. Information We Collect

2.1 Information You Provide

Account Information: Your name and email address, provided at registration
Subscription Information: Payment details processed by Stripe for BookWise subscription billing
Category Preferences: Custom financial categories you create for transaction organization

2.2 Information Collected Automatically

Usage Data: Application interactions logged via AWS CloudWatch for performance and security monitoring
Session Data: Temporary session identifiers for application functionality

2.3 Information from Third Parties

Bank Transactions: Financial transaction data synchronized through Plaid from your linked bank accounts

3. How We Store Your Data

Data Type	Storage Location	Your Control
Financial Data	BookWise (encrypted database on AWS)	Full export access at any time
Receipts	BookWise (encrypted storage on AWS)	Viewable and removable in the app
Cached Data	AWS (encrypted)	Deleted on account closure
Bank Connection Tokens	BookWise (encrypted with AWS KMS)	Removed when you disconnect a bank
Subscription Info	Stripe	Managed via billing portal

4. Third-Party Services

4.1 Amazon Web Services (AWS)

Our application infrastructure is hosted on AWS. We have signed a Business Associate Agreement (BAA) with AWS. All data at rest is encrypted using AES-256 encryption. AWS maintains SOC 2 Type II, ISO 27001, and HIPAA compliance certifications.

4.2 Data Storage

Your financial data and receipts are stored in BookWise's own encrypted database and file storage on AWS. Sensitive fields (transaction descriptions and merchant names, which can contain client-identifying details) are individually encrypted with keys managed by AWS Key Management Service. You can export your complete books - transactions, categories, and reports, in Excel and TurboTax-compatible formats - at any time from within the app.

4.3 Plaid

Bank transaction data is synchronized through Plaid, a financial data aggregator. Plaid is regulated as a financial institution under the Gramm-Leach-Bliley Act (GLBA) rather than as a HIPAA Business Associate. Plaid maintains SOC 2 Type II, ISO 27001, and ISO 27701 certifications.

Privacy Note: Bank transactions may occasionally contain patient-identifiable information (e.g., check deposits showing patient names). For enhanced privacy, we recommend accepting payments through methods that do not include patient names in bank transaction records, such as credit card payments or EHR payment processors.

4.4 Stripe

Stripe processes BookWise subscription payments only. No patient or healthcare information flows through Stripe. Your payment information is handled directly by Stripe and is subject to their Privacy Policy.

4.5 Artificial Intelligence (Ask BookWise)

BookWise includes an optional assistant, Ask BookWise, that answers questions about the application and about your own books. When you ask a question, relevant data from your books is processed by a large language model running on Amazon Bedrock, within the same AWS infrastructure that hosts BookWise and under our Business Associate Agreement with AWS. Your data is not used to train any model, is not shared with any other AI provider, and your conversation content is not stored by BookWise; we retain only an event count for rate limiting. Using the assistant is always your choice, and its responses are informational only - they are not tax, legal, or accounting advice.

5. HIPAA Compliance

BookWise is designed to support HIPAA compliance for healthcare providers managing their practice finances:

We have signed a Business Associate Agreement with AWS
All data at rest is encrypted using AES-256 encryption
All data in transit is protected by TLS 1.2 or higher
Access controls ensure only authenticated users access their data
Audit logs are maintained for authentication, data access, and modification events

Your Responsibility: You must determine what constitutes PHI in your financial records, and you remain responsible for your own compliance with HIPAA and applicable state privacy regulations.

6. Your Rights and Choices

Access: Your complete books are visible in the app at all times
Portability: Export your full data from the app in Excel and TurboTax-compatible formats at any time
Deletion: Delete your account from Settings at any time; your data is permanently removed
Revoke Bank Access: Disconnect Plaid at any time through the app or via Plaid Portal

7. Data Retention

Financial Data: Retained while your account exists; permanently deleted when you delete your account
Audit Logs: Retained for a minimum of 6 years per HIPAA requirements (§164.530(j)). Active logs maintained in encrypted application storage; older entries archived to encrypted S3 storage with lifecycle management.

8. Security Measures

We implement industry-standard security measures to protect your information:

Encryption at rest (AES-256 via sodium library)
Encryption in transit (TLS 1.2+)
AWS Secrets Manager for credential storage
Email and password authentication (passwords stored as salted hashes, never plaintext), with optional two-factor authentication
Serverless architecture (ephemeral containers)
Annual security risk assessments

9. Contact Information

For questions about this Privacy Policy or to exercise your rights, contact:

BookWise, LLC
Email: [email protected]
Website: https://bookwise.software

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Effective Date" above. Your continued use of BookWise after changes constitutes acceptance of the updated policy.