Legal

Data Governance and Use Policy

Version 1.0

This policy explains how Arcametric treats the information it holds: what we keep, who can access it, what it may be used for, and where our role ends and yours begins.

It sits alongside the Arcametric Privacy Policy and Terms of Use. The Privacy Policy describes, in operational detail, how information is collected, used, protected, retained, and shared. This policy sets out the governing principles behind those practices so that practitioners, organizations, and research collaborators can see how we steward data over time. Where this policy and the Privacy Policy describe the same practice, the Privacy Policy governs the operational detail.

1Scope and the people this policy addresses

Arcametric is software for documenting, following, measuring, reporting on, and learning from interventional mental health treatment over time. This policy applies to the Arcametric website and the Arcametric application.

Two roles run through everything below. Arcametric provides the platform. You, the practitioner, organization, program, or team using it, deliver care and hold the identities of the people you treat. Investigators, sponsors, and research institutions have their own distinct responsibilities, which the Research Ethics and Data Stewardship Policy addresses.

2The information we hold, and who keeps identity

Arcametric is built so that a person receiving care cannot be named inside it. No writable field can hold a patient name, because no free-text identity fields exist anywhere in the application. Entering a patient's name is structurally impossible. Each case is represented by a system-generated patient reference, and you keep the link between that reference and the person in your own systems.

The information Arcametric holds falls into a few plain categories:

• Website contact information. If you request a demonstration, ask for updates, or contact us through the website, we hold the email address and any other details you choose to provide.
• Account and professional information. When you create an account, we may hold your name, professional email, credentials, license type or state, and the name of your practice or organization.
• Billing information. Subscription payments are handled by our payment processor. Arcametric does not store your payment card number.
• Structured treatment information. The application records structured information about workflows, treatments, observations, and outcomes using fixed fields and coded references. It uses de-identified patient references rather than names and has no free-text clinical narrative.
• Usage and technical information. We hold standard technical and server information used to operate and improve the services, such as IP address, browser type, pages visited, and session duration. The marketing website uses cookieless analytics and no tracking or advertising cookies.

Arcametric does not use artificial intelligence (AI). Nothing in the record is generated, interpreted, or decided by AI.

Arcametric uses a PostgreSQL relational database to organize clinical information in structured, related data tables under coded patient references. Practitioners enter treatment details into defined fields, while database rules help maintain consistent records.

Authentication, role-based permissions, and row-level security (RLS) control which records authorized users can access. Reports and calculations follow defined rules rather than AI-generated interpretations.

This approach preserves the information practitioners record and makes it possible to trace how the system organizes and presents it.

3What the information is used for

We use website information to answer your inquiries, send updates you ask for, and keep the website working and measured. We use account and application information to provide and maintain the service, authenticate users, send service and safety notifications, process subscription billing, and meet our legal and professional obligations.

Structured treatment information carries a second kind of value. The first treatment record creates documentation value. A second treatment record provides a basis for comparison. Every record after that adds comparative context for you and strengthens that shared picture. The model is reciprocal: those who contribute share in what the field learns, and information used to build shared or comparative views is de-identified.

Arcametric documents and surfaces treatment activity. It does not direct care. It helps you document, track, measure, benchmark, protect, and share your work; it does not make clinical decisions and it does not claim to change clinical outcomes.

4Access and disclosure

Access follows role and setting. You control which people in your organization may access your account, and you control the identities behind each reference. Arcametric works from de-identified patient references, not names.

We rely on a small set of service providers to run the platform, including providers for database and authentication infrastructure, payment processing, hosting, and email. Each processes information only as needed to provide its service to Arcametric, and the Privacy Policy lists them.

We do not sell the personal contact or account information you provide to us to third-party advertisers. Any sharing of information for a new purpose beyond operating the service is governed by this policy and, for research, by the Research Ethics and Data Stewardship Policy.

5Safeguards and the life of the data

Arcametric uses technical and organizational safeguards to protect the information the service processes. These include encryption of data in transit and at rest, database row-level access controls, role-based user access, and access and activity logging.

Retention

We keep contact information for as long as needed to answer you and send what you asked for, unless you ask us to remove it or the law requires longer. We keep account information while your account is active and as needed for legitimate operational, legal, or security purposes. When paid access ends, the account returns to the free tier and existing records remain available under that tier. Records are not deleted by ending a subscription, and structured treatment information may be retained as part of Arcametric's longitudinal dataset.

Correction and export

You can correct account and contact information we hold. You can take your own captured treatment information with you: the application supports export of your data, so nothing about a person's identity ever needs to come back from us, because that link was always in your systems.

Questions and reports

Questions about data handling, and reports of a concern, can be sent to the contact below.

6Your rights and your responsibilities

Depending on your jurisdiction and the information involved, you may have rights to reach the personal information we hold about you, correct it, ask us to delete personal account or contact information, request a portable copy of what you submitted where applicable, and opt out of non-essential email. You can unsubscribe from updates using the link in those messages.

Rights that attach to your account information are separate from how Arcametric treats the structured treatment information contributed through the application. As the organization delivering care, you hold the identities behind each reference and the responsibilities that come with being the custodian of those identities, including consent, notice, and any obligations your setting places on you. Arcametric does not take on those custodian obligations on your behalf.

7Governance of this policy

Arcametric maintains this policy under version control. Its effective date is recorded when the policy is adopted. We may update it as the service, our practices, and our obligations develop; when we make a material change we will publish the new version and raise the version number. If a material change affects registered users, we may also notify them through the application or by email.