Sensory Toolbox Privacy Policy

Last updated: June 3, 2026 Effective date: June 3, 2026

Sensory Toolbox Corporation ("Sensory Toolbox," "we," "us," or "our") makes a mobile app and a clinician Provider Dashboard that deliver personalized, in-the-moment sensory and self-regulation strategies for neurodivergent children ages 3 and up, their families, and the clinicians and educators who support them. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have.

We built Sensory Toolbox for children, so protecting children's information is the core of how we operate. We do not show advertising, we do not sell personal information, and we do not use your information or your child's information to train artificial intelligence.

Please read this Policy together with our Terms of Service. If you are a clinic, school, or other organization using Sensory Toolbox, a separate Data Processing Agreement or Business Associate Agreement may also apply to your use, as described in Section 9.

Quick summary

This summary is here to make the Policy easy to follow. It does not replace the full text below.

Who uses the app. A parent or legal guardian, an adult user, or an authorized clinician or school creates and manages every account. Children never sign themselves up.
What we collect. Account details (such as a parent's name and email and a child's first name and age range), a sensory profile, how strategies are used in the app, and any optional notes or survey answers you choose to add.
Why we collect it. To deliver and personalize the strategies, to power the Provider Dashboard for clinicians you authorize, to keep the service secure, and to improve the product.
What we never do. No advertising to children or adults. No sale of personal information. No use of your data to train AI. No sharing of identifiable children's data with anyone except the people you authorize and the service providers that run our app for us.
Your controls. You can review, correct, export, and delete your information, and you can withdraw your consent at any time.
Children's privacy. We follow the Children's Online Privacy Protection Act (COPPA) and apply those protections to every child user.

1. Who this Policy covers

This Policy applies to the Sensory Toolbox mobile app on iOS and Android, the Sensory Toolbox Provider Dashboard, our website, and any related services that link to this Policy (together, the "Service").

It applies to four kinds of people:

Parents and legal guardians who set up and manage a child's use of the app.
Child users ages 3 and up, whose accounts are created and controlled by a parent, guardian, clinician, or school.
Adult users who use the app for their own self-regulation.
Clinicians, educators, and organization administrators who use the Provider Dashboard to support the people in their care, under a clinic, school, or other institutional arrangement.

2. The information we collect

We collect only what we need to run the Service. Some information is required to create an account, and some is optional.

Information a parent, guardian, or adult account holder provides

Name and email address of the account holder.
Account credentials (a password, or sign-in through a third-party login if offered).
Subscription and billing status. Payment card details are handled by the app stores or our payment processor, not stored by us (see Section 6).

Information about a child user

The child's first name or a nickname.
The child's age or age range.
A sensory profile, meaning preferences and supports that help us personalize which strategies to suggest.
Optional self-reflection notes, if a parent, supervising adult, or older child chooses to add them.
Optional pre and post survey responses, if surveys are offered and you choose to complete them.

A child does not create an account and is not asked to provide personal information directly. A parent, guardian, clinician, or authorized school enters or manages this information.

Information clinicians, educators, and administrators provide

Professional or work contact details and credentials used to access the Provider Dashboard.
The connections between a provider and the clients, students, or children they are authorized to support.

Information we collect automatically when the app is used

Strategy activity, meaning which strategies are selected, how often, and timestamps for those events.
Basic device and app information needed to operate and secure the app, such as app version, device type, operating system, and general technical logs.
Crash and diagnostic data that helps us find and fix problems.

What we do not collect

To be clear about our limits, Sensory Toolbox does not collect:

Clinical diagnoses, therapy session notes, treatment plans, or medical records.
Academic records such as grades, transcripts, or attendance.
Social Security numbers or government identifiers.
Financial account numbers or stored payment card numbers.
Continuous location or GPS tracking.
Audio, microphone, camera, or photo recordings.
Biometric identifiers. The current app does not connect to wearables or collect biometric signals such as heart rate. If we add an optional wearable feature in the future, we will update this Policy, ask for any consent the law requires, and describe how that information is handled before the feature is turned on.

3. How we use information

We use the information we collect to:

Create and manage accounts and authenticate users.
Deliver personalized, in-the-moment sensory and self-regulation strategies.
Power the Provider Dashboard so a clinician or educator you authorize can see how the people in their care are using strategies, and set shared goals.
Provide de-identified and aggregated reporting to clinics, schools, and other organizational customers.
Respond to support requests and communicate with you about the Service.
Keep the Service secure, prevent abuse, and troubleshoot problems.
Improve and develop features, measure whether strategies are helpful, and conduct internal research using de-identified or aggregated data wherever possible.
Comply with our legal obligations.

We do not use personal information for behavioral or targeted advertising, we do not sell it, and we do not use it to train artificial intelligence models.

4. How children's information is protected (COPPA)

Sensory Toolbox is designed for children, including children as young as 3, and we treat the protection of their information as a first principle. We comply with the Children's Online Privacy Protection Act (COPPA) and the Federal Trade Commission's COPPA Rule, and we apply COPPA-level protections to all child users.

A parent or authorized adult is always in control. Only a parent or legal guardian, or a clinician or school authorized to act for a parent, may create and manage a child's profile. Children are never asked to register or to provide personal information on their own.

Verifiable parental consent. Before a child uses the app, we obtain verifiable parental consent. Because we do not disclose children's personal information to third parties for advertising or any unrelated purpose, we use the "email plus" consent method permitted by the COPPA Rule: we collect the parent's consent by email and confirm it with a second step, such as a follow-up confirmation. If we ever change our practices in a way that requires a higher level of verification, we will use a stronger method before collecting more information.

What consent covers. Consent covers the collection and use of the limited child information described in Section 2 to provide and personalize the Service and to make a child's activity available to the clinician or educator you authorize.

Parental rights. As a parent or guardian, you can at any time:

Review the personal information we have collected from your child.
Correct or update that information.
Delete your child's information.
Refuse to allow further collection or use of your child's information, and withdraw your consent.

To exercise these rights, email us at hello@sensorytoolbox.com. We will verify your request and act on it promptly. If you withdraw consent, we will stop collecting your child's information and delete it, which may end your child's ability to use the app.

No advertising, no sale, no profiling. We do not serve advertising to children, we never sell or share a child's personal information for targeted advertising or any unrelated purpose, and we do not build advertising profiles. We do not use children's information to train AI.

Schools and clinics acting for parents. In some school or clinical settings, a school or clinic may provide consent on a parent's behalf for the limited educational or care purpose it has authorized, as permitted by the COPPA Rule and described in Section 9. Even then, we collect only what the Service needs and use it only for that purpose.

5. How long we keep information (data retention)

We keep personal information only as long as we need it for the purposes described in this Policy, and we do not keep children's information indefinitely. We maintain a written data-retention policy that sets out, for each type of information, why we collect it, the business need to keep it, and when we delete it.

Our standard retention practices are:

Account and profile information (including a child's profile): kept while the account is active and deleted within 30 days after the account is closed, unless you ask us to delete it sooner.
Strategy activity and usage events: kept for 24 months, then deleted or de-identified.
Optional reflection notes and survey responses: kept until you delete them or close the account.
Crash and diagnostic data: kept for 90 days.
De-identified and aggregated data: may be kept longer for research and product improvement, because it does not identify any individual.

We may keep limited information longer where the law requires it, to resolve disputes, or to enforce our agreements. When information reaches the end of its retention period, we delete it or de-identify it.

6. How we share information

We do not sell personal information, and we do not share it with anyone except as described here.

Service providers. We share information with vendors that run the Service for us under contract, and that may use the information only to provide services to us. Our primary service provider is Google Firebase and Google Cloud, which host our app and store our data. Our contracts require these providers to protect the information and prohibit them from using it for their own purposes.

Clinicians, educators, and organizations you are connected to. If you connect a child or yourself to a clinician, educator, or organization through the Provider Dashboard, that provider can see the activity and information needed to support the person in their care, consistent with the consent you have given. Organizations receive only de-identified and aggregated reporting at the organizational level, except for the individual information a specific treating provider is authorized to see.

Legal and safety. We may disclose information if we believe in good faith that it is necessary to comply with the law or legal process, to enforce our Terms, or to protect the rights, safety, or property of our users, the public, or Sensory Toolbox.

Business transfers. If Sensory Toolbox is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will require the recipient to honor this Policy, and we will notify you of any change in who controls your information or any material change to how it is handled.

We do not disclose children's personal information to third parties for any purpose that is not integral to providing the Service. If we ever needed to, we would first obtain separate verifiable parental consent.

7. Security

We protect personal information using administrative, technical, and physical safeguards, including:

Encryption of data in transit and at rest, provided through Google Cloud.
Authentication and role-based access controls, so users see only the information they are permitted to see, and a clinician sees only their own authorized clients.
A web application firewall and secure development practices, including code review and security testing.
Limiting access to personal information to personnel who need it to operate the Service.

No method of transmission or storage is perfectly secure. If we ever experience a breach of security affecting your information, we will notify you and the appropriate authorities as required by law, including the FTC Health Breach Notification Rule and applicable state laws (see Section 11).

8. Your privacy choices and rights

You have control over your information. Depending on where you live, some of these rights may be legal entitlements, but we offer them to all users:

Access: request a copy of the personal information we hold about you or your child.
Correct: ask us to fix information that is inaccurate.
Delete: ask us to delete your information or your child's information.
Export: request a portable copy of your information.
Withdraw consent: withdraw your consent to our collection or use of information, including a child's information.
Opt out: we do not sell or share personal information for targeted advertising, so there is nothing to opt out of, but you can confirm this with us at any time.

You can manage much of your information directly in the app, including deleting your account. You can also email hello@sensorytoolbox.com. We will verify your identity before acting on a request, respond within the time the law requires, and will not discriminate against you for exercising your rights. If we decline a request, we will tell you why, and where the law provides one, you may appeal.

9. Clinics, schools, and other organizations (B2B), HIPAA, and FERPA

When Sensory Toolbox is provided to or through an organization such as a mental health practice, community health facility, or school, additional rules and agreements apply.

HIPAA. When you use Sensory Toolbox directly as an individual or family, we are not a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act (HIPAA), and the information you provide is not "protected health information" governed by HIPAA. HIPAA does not apply to our direct-to-consumer service. Where Sensory Toolbox instead provides services to a clinician, practice, or health facility that is a HIPAA covered entity, and that organization uses the Service to handle protected health information on its behalf, those services are governed by a separate Business Associate Agreement (BAA) between Sensory Toolbox and that organization. If there is any conflict between this Policy and an executed BAA, the BAA controls for protected health information handled under it.

FERPA. When a school or district makes Sensory Toolbox available to students, we act as a "school official" with a "legitimate educational interest" under the Family Educational Rights and Privacy Act (FERPA), under the direct control of the school for any education records we access. We use student information only to provide the service the school has contracted for. We do not sell student data, use it for advertising, or build profiles for unrelated purposes, and we do not re-disclose education records except as the school directs or FERPA permits. We return or delete education records at the school's request. These commitments are set out in our data-protection agreement with each school, which controls over this Policy for student data.

Data Processing Agreement. Our institutional customers sign a Data Processing Agreement (or equivalent) that governs how we handle the information of the children, students, or clients they serve. That agreement, and any BAA, controls over this consumer Policy for data handled under it.

10. State privacy rights (United States)

If you live in a U.S. state with a comprehensive privacy law, such as California, Virginia, Colorado, Connecticut, Utah, and a growing number of others, you may have specific rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of the sale of personal information, targeted advertising, and certain profiling.

Sensory Toolbox does not sell personal information, does not share it for targeted or cross-context behavioral advertising, and does not use it for that kind of profiling. We do not sell or share the personal information of any user we know to be under 16. You can exercise your state rights as described in Section 8. Where your state allows an authorized agent to act for you, we will honor a valid authorization.

For California residents, the categories of personal information we collect, our purposes, and our disclosures are described in Sections 2, 3, and 6. We do not offer financial incentives in exchange for personal information.

11. Health-related data and breach notification

Some information in Sensory Toolbox, such as a child's sensory profile, reflection notes, and how a person uses regulation strategies, relates to health and well-being. Even though this is not HIPAA-protected information for our direct-to-consumer users, we treat it carefully and additional consumer health privacy laws may apply.

We collect and share this information only as needed to provide the Service you asked for, or with your consent.
We do not sell consumer health data, and we do not use it for targeted advertising.
We do not use geofencing around any health care location, and our app has no location-tracking feature.

Breach notification. If we discover a breach of security involving unsecured health-related information, including any unauthorized acquisition or unauthorized disclosure of that information, we will notify affected individuals without unreasonable delay and no later than 60 days after discovery, consistent with the FTC Health Breach Notification Rule and applicable state law. Where required, we will also notify the Federal Trade Commission and, for larger incidents, prominent media. Our notice will describe what happened, the types of information involved, what you can do, and what we are doing in response.

Washington Consumer Health Data Privacy Notice

This section is a specific notice for Washington residents under the My Health My Data Act, and it also helps users in Nevada and other states with consumer health privacy laws. It supplements the rest of this Policy.

Consumer health data we collect: a child's or user's sensory profile, optional self-reflection notes, optional survey responses, and information about how a person uses sensory and self-regulation strategies in the app.
How we use it: to provide and personalize the strategies, to power the Provider Dashboard for an authorized clinician or educator, and to improve the Service, as described in Section 3.
Who we share it with: the service providers that run the app for us (Google Firebase and Google Cloud), and the clinician, educator, or organization you authorize. We do not sell consumer health data and do not share it for advertising.
Consent: we collect and share consumer health data only as needed to provide the Service you requested, or with your consent. We will obtain separate authorization before any sale of consumer health data, which we do not do.
Your rights: you may withdraw consent, and you may request to access, delete, or learn which third parties have received your consumer health data, by emailing hello@sensorytoolbox.com.

12. International users

Sensory Toolbox is operated from the United States, and we store and process information in the United States. We are designed for U.S. users. If you access the Service from outside the United States, you understand that your information will be processed in the United States, where data protection laws may differ from those in your location.

13. Changes to this Policy

We may update this Policy from time to time. If we make a material change, we will notify you through the app, by email, or by other reasonable means, and where the change affects a child's information in a way that requires it, we will obtain renewed parental consent. The "Last updated" date at the top shows when the Policy last changed. Your continued use of the Service after an update means you accept the updated Policy, except where we are required to obtain your consent.

14. Contact us

If you have questions about this Policy or your information, or if you want to exercise any of your rights, contact us:

Sensory Toolbox Corporation
Attn: Privacy
Chicago, Illinois
Email: hello@sensorytoolbox.com

For children's privacy questions, please use the same email and tell us it concerns a child's account so we can prioritize it.