1. Who we are and what this policy covers
Cerulea Clinical Workflow is software provided by Cerulea Management Services, LLC (“Cerulea”) to authorized healthcare organizations. It supports psychological evaluation workflows through Google Workspace services, including Drive, Docs and Sheets. This policy describes the application's handling of Google user data and the limited information processed through this public website.
Cerulea provides software, not clinical services. The healthcare organization using the application controls its patient records and determines its own clinical, legal and records-retention obligations. Written service, licensing and business associate agreements govern the applicable customer relationship.
2. Information the application accesses
When an authorized user signs in and grants permission, the application may access:
- Google account identity: the signed-in user's email address, to identify the user and enforce application roles.
- Google Sheets: case status, assessment plans, activity records, billing-status fields, audit events and other information stored in the healthcare organization's designated workflow spreadsheet.
- Google Drive: folder locations, file identifiers, file metadata and files needed to locate existing patient folders, connect clinical documents, and create or move records.
- Google Docs: templates, draft and finalized intake notes, assessment documents and psychological evaluation-related documents.
- Technical operational information: action timestamps, account identifiers, error information and related execution details used for troubleshooting and security.
Clinical materials may contain protected health information. Google's authorization screens describe the breadth of requested API scopes; those scopes may technically permit access to more files than a particular workflow action needs. Cerulea Clinical Workflow's intended use of these permissions is limited to the configured clinical workflow and resources authorized by the healthcare organization.
3. How information is used
Google user data is used to provide the software's user-facing functions: identifying authorized staff, connecting patient cases to the correct folders and documents, organizing assessment activities, generating structured documents, supporting clinician verification and finalization, and maintaining workflow and audit records. Technical information may also be used to diagnose failures, protect access, and support the operation of the application.
Cerulea does not use Google Workspace clinical data for advertising, ad targeting, data brokerage, credit decisions or training general-purpose artificial intelligence models.
4. Where information is stored and who controls it
Patient folders, clinical documents, and the designated workflow spreadsheet are maintained within the healthcare organization's Google Workspace environment. The application itself is developed and operated through Google Apps Script in Cerulea's separate Workspace. Authorized activity may be processed through Google's infrastructure and client browsers while the application runs. Limited technical metadata or operational records may be retained in application logs or related Google services.
The healthcare organization remains responsible for managing staff accounts, document-sharing permissions, its clinical records, and applicable record retention. Cerulea's access to patient information for support is not routine and must be specifically authorized and limited to appropriate support, security or legal purposes.
5. Sharing and disclosure
The application uses Google Workspace services to carry out authorized actions for the healthcare organization. Information may be accessible to the organization's authorized users according to their Google Workspace permissions and application roles. Cerulea may disclose information only as permitted by applicable agreements and law, including where necessary to provide requested services with authorization, respond to security incidents, or comply with lawful requirements. We do not sell Google user data or disclose it to advertising networks or data brokers.
6. Google API Limited Use commitments
Google Workspace data obtained through the application is used for user-facing application functionality and permitted security and legal purposes. Human access to such data is limited to appropriately authorized circumstances consistent with Google's policies and applicable healthcare agreements. The data is not used for unrelated product advertising or general-purpose AI model training.
7. Retention, deletion and revoking access
Patient records are retained under the healthcare organization's own retention schedule and applicable law, rather than automatically deleted when an individual stops using Cerulea Clinical Workflow. The practice may use Google Workspace's native controls to manage and retain its records independently of the application.
Users may revoke the application's Google access in their Google Account connections, subject to their organization's policies. Authorized practice administrators may request removal of application access or appropriate technical records by contacting Cerulea. Revoking Google authorization does not delete the practice's existing clinical documents or alter legally required retention.
8. Security
Access is designed to require authenticated Google accounts and application role authorization, in addition to the permissions granted by each user's Google Workspace account. Cerulea and participating healthcare organizations use their respective administrative, technical and contractual safeguards. No electronic system can be guaranteed free from risk; incidents and suspected unauthorized access should be reported promptly to the organization's designated administrator and Cerulea.
9. This public website
This public informational website does not provide patient accounts, collect clinical forms or require Google login. Its pages do not intentionally include advertising trackers or analytics scripts. The web-hosting provider may process standard access and security information such as IP addresses and technical request logs. Please do not send patient information through ordinary website inquiries or unencrypted email.
10. Updates and contact
We may update this policy to reflect changes in the software, applicable requirements or data practices. The updated policy will be posted here with a revised effective date. For privacy, access, or security inquiries, contact [email protected].