Privacy Policy

Effective November 7, 2026.

Who we are

Flourish Four is a records system for Clubhouses and peer-support programs. Programs use it to keep records of the people they serve: enrollments, attendance, outreach, goals, assessments, supports and surveys.

Flourish Four is run by Form Communities ("Form Communities," "we," "us"), 6851 Clubhouse Way, Suite 200, San Antonio, TX 78229.

Who this policy covers

• Staff users: people who sign in to Flourish Four for an organization, such as staff, administrators and volunteers.
• People whose records are kept: the members, participants or peers a program serves. Most of them never sign in. Some check in at a program's kiosk or answer a survey.
• Visitors to our public pages and survey links.

The organization is in charge of its records

Each Clubhouse, program or organization that uses Flourish Four (the "organization") decides what records to keep about the people it serves, who may see them, and how long to keep them. The organization is responsible for those records. Form Communities stores and processes them on the organization's behalf, to run the service.

So if your records are kept by a program, your program is the first place to ask about your information. See "Your choices and rights" below.

When Form Communities uses Flourish Four for its own programs, it is also the organization in charge of those records.

What we collect

About people whose records are kept

An organization's staff enter these records, import them from earlier systems, or collect them through kiosks and surveys. Depending on what the organization uses, they can include:

• Name, preferred name, date of birth, photo, contact details (phone, email, address) and emergency or care contacts.
• Demographic details, such as gender, sexual orientation, race and ethnicity, language, housing and other answers a funder asks for.
• Enrollments in programs and units, membership dates and statuses.
• Attendance, check-ins and visits, including kiosk check-ins.
• Outreach (reachouts), supports and services given, meetings and events.
• Goals, plans, progress notes and case notes. These are free text and can mention anything staff write.
• Assessments and survey answers, including scores.
• Employment and education records.
• Insurance or coverage details and uploaded documents.
• Health, diagnosis and substance-use information, where the organization collects it. Substance-use information is shown only to staff given that access, and it is never shared with another program by a sharing rule.

About staff users

• Name, email address, username and the organization, programs and roles you are given.
• Your password, stored by our sign-in provider in a form that can't be read back. If you sign in with Google, we receive your Google account's name, email address and profile basics (the openid, email and profile scopes). We do not receive your Google password.
• Sign-in records: when you signed in, and failed password tries counted per device to lock out guessing.
• Your settings, such as language, color scheme and the program you are working in.
• What you change in the system. Every change to a record, and every view of a sensitive record or export, is written to an audit log with who, when and what changed.
• Feedback and help requests you send, and the page, program, language, app version, browser, screen size and time zone attached to them.
• Questions you ask Ask Flo and its answers, when Ask Flo is turned on.
• Usage analytics, as described under "Analytics" below.

From visitors and survey respondents

• Survey answers, and the name or email address a survey asks for, if any. Anonymous surveys keep no link to a person.
• A random device id kept in your browser, used to limit how many times one device can answer a public survey link.

How we use information

We use information to:

• Run Flourish Four for the organization: store records, show them to the staff allowed to see them, and produce the reports and exports the organization asks for.
• Sign people in, keep accounts secure and block misuse.
• Keep the audit log, so an organization can see who viewed or changed a record.
• Answer feedback and help requests, and fix problems.
• Understand how staff use the app, so we can improve it.
• Meet legal duties.

We do not sell personal information. We do not use it for advertising. We do not use records about the people programs serve to train AI models.

Who can see records

• Staff of the organization, only as the organization's administrators allow. Access is set by role, program, unit and date range, and can be limited to certain hours of the day. These rules are enforced by the database itself, not only by the screens, and the same rules apply to reports and exports.
• Other programs, only where the organization sets up a sharing rule for a kind of record. A rule can be read-only and can be limited to people enrolled in both programs.
• Restricted records: an organization can restrict a person's record so that only that person and the staff named on a list can see it. This holds even for administrators.
• Your own records: staff never edit records about themselves through a staff role, and never read their own notes or clinical details that way.
• Form Communities' platform team, to run and support the service. The platform team reads feedback, help requests and Ask Flo questions. It looks at an organization's records only when needed to run or fix the service, or when the organization asks.
• De-identified, combined data, only where an organization has agreed to share it for coalition-level insights or reporting. It is combined with other organizations' data and has no names or details that identify a person.

Service providers

We use these companies to run Flourish Four. They process information for us under their own terms, and only to provide their service.

Emails and text messages from Flourish Four carry only a short neutral line and a link. They never include a person's name, a survey or program name that could hint at a condition, answers, scores or attachments. The link carries a one-time code that expires, never a person or record id.

We may also disclose information when the law requires it, to protect people's safety, or as part of a sale or transfer of the service, with notice to organizations.

Ask Flo (AI help assistant)

Ask Flo answers questions about how to use Flourish Four. It is optional, and an organization can turn it off. This section applies when it is turned on.

When you ask Flo a question, we send Anthropic's Claude model:

• Flourish Four's help documents and the list of recent changes.
• Your organization's and program's names, and the notes your administrators wrote for Flo.
• The words your organization uses for the people it serves, your language, and the screens you can open.
• The words you type, and the earlier questions and answers in the same conversation.

We do not send records from the database: no member records, no names from your lists, no notes or answers. But Flo sends whatever you type. Don't include member names or private details in a question. The box says so.

Questions and answers are stored in Flourish Four for 180 days, then deleted. You and the platform team can see them; your organization's administrators cannot. Usage counts (tokens, cost, timing) go to PostHog without the question or answer.

Feedback and help requests

The Help button lets staff send feedback or ask for help. Only Form Communities' platform team sees these. When feedback is saved, any capitalized word that matches the name of a person in your organization is replaced with "[member]," and the original is not kept. This can't catch nicknames or misspellings, so please don't type names. We may use AI tools to sort feedback; they see only the masked message, the page, the organization and the program.

Analytics

During onboarding we use PostHog to learn how staff use Flourish Four. It is set up so nothing that identifies a member, and no free text, leaves the app:

• Only page views and named actions (such as "attendance saved"), with ids removed from page addresses and no search terms.
• No automatic capture of what you click or type. Screen text and form fields are masked.
• No session recordings on the production site.
• Linked to your account id, your roles and your program, not your name.
• IP addresses are discarded, and location lookup is off.
• Kept for up to a year.

Cookies and browser storage

Flourish Four uses cookies and browser storage to work. We do not use advertising cookies.

Offline saves. If you save with no signal, the save waits on your device. It is encrypted with a key the browser makes for your login and that can't be read out of the browser, even by our code. It is deleted once sent, when you sign out, or when another login uses the device.

How we protect information

• Every table is protected by row-level security in the database. Access checks run in the database for screens, reports and exports alike.
• An audit log records every change, and views of sensitive records and exports. No user of the app can edit or delete an audit entry. An organization's administrators can see who viewed or changed a person's record.
• Passwords must be at least 10 characters, and known leaked passwords are refused. Repeated wrong passwords lock that login on that device for 15 minutes. Sign-in links expire after an hour. Nobody can sign up on their own; an administrator invites them.
• Staff are signed out after 30 minutes without activity, with a warning a minute before. Each organization can change the time. Kiosks and hand-off tablets are exempt.
• Organizations can limit a role or a login to certain hours. At the end of those hours, the person is warned and signed out.
• Connections are encrypted (HTTPS, and SSL to the database).
• Daily backups are kept for 7 days.
• Development and demo sites use only fake data.

No system is perfectly secure. If we learn of a breach affecting records, we will tell each affected organization without unreasonable delay, and no later than 60 days after we discover it, so it can tell the people concerned.

How long we keep information

The organization decides how long to keep its records while it uses Flourish Four. Today:

• Records an organization deletes are marked deleted and hidden, not erased at once. They are erased with the rest of the organization's records if it leaves.
• The audit log is kept while the organization uses Flourish Four.
• Ask Flo questions and answers are kept 180 days.
• Feedback is kept while the organization uses Flourish Four.
• Backups are kept 7 days.
• When an organization stops using Flourish Four, it can export its records for 60 days. We then delete them within 30 more days; backups age out within 7 days after that.

Your choices and rights

If a program keeps records about you, contact that program. Ask them to show you your records, correct them, or limit or delete them where the law allows. The program decides, because it is responsible for its records. If you contact us directly, we will pass your request to your program.

If you are a staff user, your organization's administrator can update your account, change your access or turn your login off. Contact them first, or contact us.

Depending on where you live, the law may give you more rights.

Children

Flourish Four is meant for organizations that serve adults. Staff users must be 18 or older. It is not meant for records about children under 13.

Changes to this policy

We may update this policy. We will post the new version here with its date, and tell organizations' administrators about important changes before they take effect.

Contact us

Form Communities
6851 Clubhouse Way, Suite 200, San Antonio, TX 78229
privacy@flourishfour.org

For questions about records a program keeps about you, contact that program first.