User Agreement

Who may use the Care Console, what belongs in it, what it is not — and the separate rules for organizations that hold people's health information.

Drafted 9 September 2026 · version ua-2026-09

1. Who this agreement is between every organization

Three parties, and it is worth being exact about which is which.

• Love Is A Habit — a 501(c)(3) nonprofit. It builds and gives away the Care Console. Referred to below as "we" and "us".
• Your organization — the therapy group, ministry, agency, studio, school or business that joined the network. Referred to as "your organization".
• You — the individual person signing in.

There are two moments of agreement, and they are different. An administrator accepts on behalf of the organization when the organization joins; that is the one we record, with the name and role of the person who accepted, the date, and the version. Each individual then agrees to this by signing in and using the console.

Whoever accepts on an organization's behalf is confirming they are authorized to do so. If you are not, please pass it to someone who is rather than accepting on the strength of being the person who happened to open the page.

2. What the Care Console is, and what it is not every organization

What it is. A coordination tool. It holds a directory of participating organizations, a matching engine that finds an appropriate clinician or service, a way to pass a referral, a way for organizations to message each other, and a set of self-service tools for running your own listing, roster and content.

What it is not, said plainly, because each of these has been assumed by someone at least once:

• Not clinical care, and not clinical advice. A match is a suggestion for a human to evaluate. Nothing here diagnoses, treats, or decides that a particular person should see a particular clinician.
• Not a records system. It is not an EHR, not a chart, not a billing system, and not somewhere to keep a client's file. Your records belong in your own system.
• Not a HIPAA-covered channel. §5.
• Not an emergency service. Nobody is monitoring it for crises, and a message sent through it may not be read for hours.
• Not certified. We will never tell you the software is "HIPAA certified", because there is no such certification for software. What we will tell you is which parts hold a name and which parts cannot.

3. Accounts and sign-in every organization

• Accounts are for staff and volunteers of a participating organization, acting in their professional role. They are not for the people your organization serves.
• You must be 18 or older.
• An account belongs to one person. Signing in uses a code tied to a work phone or work email on your organization's own roster — so sharing it means sharing your identity, and everything done in the console is recorded as having been done by you.
• A colleague's phone number is a credential here. Because the sign-in code is derived from it, do not publish, export or forward another person's number, and do not put one into a shared field.
• When someone leaves, or changes role, an administrator removes or updates them. That is the organization's job, not ours — we cannot know that a clinician left.
• If you think someone else has your access, tell your administrator and tell us.

4. What belongs in the console, and what does not every organization

The rule, in one sentence: the console carries facts about organizations and openings, not facts about people being served.

So a referral or a message here is meant to read like "adult client, mid-thirties, PTSD, looking for EMDR, Aetna, evenings — any capacity this month?" and never like a name, a date of birth, a phone number, an address, an insurance ID, a photograph, a document, or a clinical record.

Please do not enter, anywhere in the console: a client's name or initials, contact details, date of birth, address, insurance or member number, chart or record, uploaded documents or images of them, or any combination of details specific enough that a person could be picked out from it.

How long we keep it. Referral notes and messages between organizations are deleted after 90 days. Your own content — call scripts, links, organization notes, your directory listing — is kept until you change or remove it, because it is yours rather than a message.

Peer feedback is published inside the network. A comment your team writes about another organization is visible to the network's shared record, not just to you and them. Write it as something you would be content to have read aloud.

5. Organizations that hold health information clinical & PHI-handling orgs

This section applies if your organization is a covered entity or otherwise holds protected health information — a therapy practice, a psychiatric group, a clinic. It does not apply to a coaching ministry, a referral office, a classroom or a small business, and we are not going to hand any of them a compliance regime they do not need.

5.1 Three places, three different rules

Almost every misunderstanding in this area comes from treating "the platform" as one thing. It is three, and knowing which one you are looking at tells you what may go in it.

Where	What it is	Client identity?	Whose agreement covers it
The coordination layer	This console, our servers, the directory, the matcher, the browser extension	No. Keep it out — see §4	Nobody's, and it does not need one, because it is not meant to hold identity
Your records system	Your own GoHighLevel account: contacts, your referral pipeline, your notes	Yes — deliberately. This is where a person's name belongs	Your own agreement with your provider, under their HIPAA add-on
Your messaging surfaces	Your chat widget, your forms, your texts and calls — including the widget shown inside this console	Yes. This is the surface identity is supposed to enter through	Your own agreement, same as above. The conversation goes from the browser to your provider, not through us

One sentence to carry: we do the matching without the name, and we hand off into a system that is allowed to know it.

5.2 The console itself cannot be your covered channel, and here is the honest reason

Not because we have not got round to it, and not as a policy we could waive. Two structural reasons:

• The coordination records are ours, not yours. A message you send another organization rests on our own infrastructure. An agreement between you and them says nothing about the pipe in between.
• We do not hold a health-data agreement with the infrastructure underneath it. Our hosting provider will only enter one on its enterprise tier, which this nonprofit is not on. So the coordination layer is not merely uncovered today — on the current arrangement it is not coverable.

5.3 What we give you instead: a place for your own widget

Any website can hold a chat widget. That is all the console does here, and it is the whole design.

At the top of your Messages screen there is a placeholder for a secure chat. Your administrator fills it from your own account, under Organization → Resources & links → Team chat. Then:

• The widget is yours. It is created in your own account, by you or by your agency, and it runs under your own agreement with your provider — not under anything of ours.
• You give us an identifier, not a script. You paste your widget's ID and pick the loader address; there is deliberately no field anywhere that accepts a pasted script tag, because a script pasted into the console would run with the console's own privileges and could read your team's sign-in tokens. This is a refusal on purpose, and it is the one step of the setup that surprises people.
• The conversation does not pass through us. The widget loads in your team member's browser and talks to your provider directly. We do not receive, store, or have any means of reading what is said in it.
• Only your own organization. An administrator can only ever configure their own organization's widget — the console takes the organization from the signed-in session, never from the page. A clinician cannot repoint where the team's messages go.
• If it is not set up, the console says so. It shows your main phone line instead, or an honest "not connected yet". It does not imply coverage you do not have.
• The placeholder only appears for organizations that say they are clinical. An administrator sets what kind of organization you are in Console setup. A coaching ministry does not get prompted to connect a secure clinical chat.

Where TheraSaaS fits. TheraSaaS is the GoHighLevel agency that signs the business associate agreement with each clinical organization, and in many cases donates the widget and the account setup. That agreement is between your organization and them. We are glad it exists and we are not a party to it: we cannot promise anything on their behalf, we cannot extend their coverage to our own software, and their signature is not ours.

5.4 Where we do hold access to your account, and what we do with it

If we set up or support your records account, we hold credentials that can reach it — and since that account is where identity lives, we would rather write this down than let §5.1 imply we are nowhere near it.

• We use that access to set things up, keep them working, and answer your questions, on your instruction — not for any purpose of our own.
• We do not read, extract or copy your client records, and we do not use them to train anything.
• Your organization can ask us to give up that access at any time, and can revoke it from your own account.
• If your counsel requires a written agreement covering that access before you are comfortable with it, ask us — that is a reasonable request and the right way to raise it.

5.5 Your own obligations stay yours

Nothing here transfers any part of your compliance to us. Your organization remains responsible for its licensure, its own privacy notices and consents, the minimum-necessary judgment about what to share, its own breach obligations, and the clinical decisions it makes with what the console shows it. Using this network does not move any of that.

6. Your organization's data every organization

• It is yours. An administrator can export the organization's data at any time from the console's export tool.
• We do not sell it, rent it, trade it, or hand it to advertisers, and there is no advertising anywhere in the product. There are no analytics or tracking products in the console.
• If your organization leaves and asks us to delete what we hold, we will, apart from anything we are required to keep.
• An individual can ask their administrator, or us, to remove their profile.
• What we hold about your staff, and every other detail of this, is in the privacy policy.

7. When our staff can open your console every organization

We operate this platform, so a small number of named Love Is A Habit staff can open your console to answer a support question or diagnose a problem. Rather than let §6 imply otherwise:

• It is read-only on a live organization — nothing can be sent, changed or deleted.
• It is attributable to an individual staff account, and each session records who, which organization, and when.
• It is visible: a banner across the top of the console says it is being viewed by platform staff and that nothing is being saved.
• It excludes your staff's phone numbers, because a number is a sign-in credential.
• It expires by itself, and you can end it at any time by the same means you would sign out your own staff.

8. Where an assistant takes part every organization

Some parts of the console can include an AI assistant — for example as a participant in a shared room. Where that happens:

• It is labelled on the screen, as a participant rather than a person, and the screen says what it can and cannot do in that room.
• It is by consent. A person is asked before an assistant joins a room they are in, and either the person who brought it or an administrator can remove it.
• It is not a clinician. Nothing it says is clinical advice, and nobody should treat it as a second opinion about a person's care.
• §4 still applies. An assistant in a room is inside the coordination layer, so client identity does not belong in what you type to it either.
• Content is used to provide the feature and for nothing else. It is not sold, and it is not used for advertising.

9. Fair use, and when we would suspend an account every organization

We would rather explain this than have a clause nobody reads. We may suspend or remove an account for:

• Putting client information where §4 says it does not belong, especially after being asked not to.
• Misrepresenting your services, licensure, insurance or availability — other organizations make real referral decisions from your listing, and a wrong listing lands on a person trying to get help.
• Sending unsolicited marketing through the network, or scraping the directory.
• Trying to reach another organization's data, or to get round the isolation between organizations.
• Sharing sign-in access, or exposing colleagues' phone numbers.
• Using the network to harass, disparage or mislead.

Where we can, we will ask first. Where something is putting a person's information at risk, we may act first and explain immediately after.

10. What we promise, and what we do not every organization

This is free software given away by a nonprofit, and we will not dress that up.

• What we do promise: to tell you the truth about what the software holds; to say plainly when something is not covered or not built rather than implying it is; to keep your organization's data isolated from every other organization's, enforced on our server for every request; to give you your data back whenever you ask; and to tell administrators when something material changes.
• What we cannot promise: that it is always available, that a referral will be read, that a match is the right clinical decision, or that any organization in the directory is accepting referrals this week. No system is perfectly secure, and we would rather write that than imply otherwise.
• The console is provided as is. To the extent the law allows, our liability for anything arising out of it is limited — this is donated infrastructure, not a paid service with a service level behind it, and pretending otherwise would be its own kind of dishonesty.
• Free means free. There is no contract, no minimum term, and no per-seat price. If we ever add something paid, what you already have stays free.

11. Changes, leaving, and ending every organization

If this agreement changes materially, we will ask administrators to review and accept it again rather than quietly updating the date. Small clarifications we will simply date.

Your organization can leave at any time, take its data, and ask us to delete what we hold. We can end an organization's participation too — for the reasons in §9, or if we stop running the platform, in which case we will give notice and time to export.

12. Emergencies, and how to reach us every organization

Questions about this agreement, requests, or concerns: drew.s@loveisahabit.org. If your organization has an attorney reviewing this, we would genuinely rather hear the question than have it go unasked.

← Back to Care Console