Last updated 21 August 2026
This explains what SageWorks ABA does with information, in plain terms. It is written to be read rather than to be survived.
The people who use the software. Practice staff have an account: a name, a work email address, a role, and a record of signing in. If a practice turns on activity recording, we also keep which screens someone opened and which named actions they took. That is a decision each practice makes for its own staff, it is off unless they turn it on, and everyone signed in can see when it is on.
The people who receive care. Clinical records about children belong to the practice treating them. We process them on that practice’s instructions and for no purpose of our own. We do not sell them, we do not use them to train models, and we do not use them to build anything for anyone else.
The software includes an assistant. It never receives a name, a date of birth, an address or the text of a clinical note. It receives shape: counts, percentages, dates relative to a session, amounts of money. Children appear to it as stable pseudonyms. This is enforced in code, and a request carrying identifying information is refused rather than quietly stripped.
On Microsoft Azure in West Europe. Each part of the system holds its own database with its own credentials, so a single compromised credential reaches one area rather than everything.
Access follows the role a person has in their practice. Reading a client record is itself recorded, with who read it and why — that record is append-only and hash-chained, which means it can be shown to be unaltered. A parent or guardian given access to a portal sees their own child and no other.
Clinical records are kept for as long as the practice requires, which is usually set by their payer and by law. When a practice leaves, we return or delete their data on their instruction. Sign-in and activity records are kept for twelve months.
If you are a member of practice staff, write to us and we will answer. If you are a parent or a client, your practice holds your record and is the right first contact; we will support them in answering you.
We will tell practices before adding another.
If information is exposed, we tell the affected practices without undue delay and with what we actually know at the time, rather than waiting until the story is tidy.