Privacy Notice

Who is responsible for your information

Camus LLC, doing business as MeridianBx, is based in Wisconsin, United States, operates meridianbx.com, and is responsible for the personal information described here. The Service is offered to US adults and organizations purchasing access for those learners. Contact us at contact@meridianbx.com.

This notice covers Meridian. Other services have their own notices, even if they share an owner or technical infrastructure. A link to an official exam organization or another website does not give that organization access to your Meridian study records.

Information we collect and its sources

• Account information you provide: name, email address, password, profile updates, and support requests. We store a password hash rather than a readable password.
• Study information generated through your use: enrollment, question and test responses, attempts, flags, timing, scores, bookmarks, flashcard reviews and scheduling, progress, and study activity used to select practice.
• Training and certificate records: your legal name and BACB ID, identity attestations, enrollment and completion dates, course and lesson versions, responses and assessment results, credited activity and video progress, review and correction history, and certificate records. These records document training, including partial completion.
• Employer seats and shared profiles: organization name, purchasing account, assigned learner email addresses, invitations, seat acceptance and release records, and order status. If you create a learning profile, we retain the report, course evidence used to generate it, practice-plan notes and observations, organization and reviewer details you enter, recipient email addresses, sharing permissions, expiration or revocation, and change history.
• Earlier rewards records: Meridian does not offer rewards. If your account has records from an earlier study-points program, this notice covers them.
• Communications: contact-form name, email, topic, message, support correspondence, and email delivery records such as message identifiers and delivery status. Our email queue also stores the content needed to send account and support messages.
• Billing information: Stripe customer, checkout, payment, and subscription identifiers, purchased course or seat quantity, plan, payment and subscription status, billing periods, usage allowances, checkout disclosures, and associated timestamps. We receive subscription and payment updates from Stripe; payment-card details are entered directly in Stripe’s embedded or hosted payment forms.
• Technical and security information: session and password-reset records, request times, security events, and information sent by your browser, such as IP address and browser headers. We use hashed request identifiers for rate limiting and retain the document versions, time, and hashed request and browser evidence associated with legal acceptance. Our hosting providers may also process connection and diagnostic logs.

Information comes from you, your browser, your use of the Service, an employer that assigns your seat, recipients authorized to edit a shared learning profile, and providers supporting functions such as payments and email. If you used an earlier Camus exam-prep service on this platform, we may keep your account and study records from it, and this notice and your privacy rights apply to them. We do not request payment-card information for current free access.

How we use information

We use account and technical information to create and authenticate accounts, provide access, recover accounts, and prevent abuse. We use study activity to save your work, score practice, display progress, schedule flashcard reviews, and select practice questions.

We use training records to verify participation and completion, issue and correct certificates, support the Responsible Trainer’s recordkeeping and audit responsibilities, and generate learning profiles you request. We use employer records to process orders, assign and release seats, show enrollment status and the progress and readiness summaries disclosed in the team seat terms, send reminder emails the purchasing account requests, and provide included access. Sharing records control who may open or edit a learning profile and preserve its change history.

We use messages and contact details to answer requests and send account, security, service, and legal notices. We may review activity and diagnostic records to troubleshoot problems, assess content quality, improve the Service, investigate misuse, and meet legal obligations. Optional marketing communications are subject to the choices below. Acknowledging this notice is not consent to unrelated marketing.

When information is disclosed

• Service providers and authorized personnel: hosting, database, email, technical support, and other providers receive information needed for their work. The Service uses Microsoft Azure hosting. Brevo, our email provider, receives recipient details and message content, which may include a support message or account-recovery link. OpenAI receives the study content described under “Automated practice and sensitive information” when you use AI learning guides or AI answer review, without your account name or email. Authorized Camus personnel may access records to support users and administer the Service.
• Payments: Stripe receives your account name, email address, a customer reference, chosen plan, and the payment and billing details you provide to process purchases, renewals, invoices, and cancellation. Stripe’s handling is described in its Privacy Policy.
• Legal and security needs: we may disclose relevant information to comply with legal process, protect rights and safety, investigate fraud or exam-security misuse, or establish, exercise, or defend legal claims.
• Business changes: relevant records may be disclosed during a merger, acquisition, reorganization, or transfer of the Service, subject to applicable law and confidentiality protections. A successor must handle information consistently with applicable privacy obligations.
• At your direction: we may disclose information when you ask us to or give separate permission, such as for a testimonial.

Employer-sponsored seats: the purchasing account can see the assigned email, whether an invitation has been accepted, enrollment status, and whether a seat may be released or has already been released. Release eligibility can indicate whether the learner is still within the reassignment conditions described in the team seat terms. For learners who accept the current team seat terms, the purchasing account can also see credited training hours, lesson progress, completion date, and certificate status; an exam-readiness estimate calculated from course checkpoint scores, practice question results, and timed practice exams; scores by exam content area and by task within each area on the competency-assessment prep sheet; weekly training and practice activity and the last activity date; and certification steps recorded by the learner or the purchasing account (competency assessment, BACB application, exam date and result, and first billable session). The purchasing account can also send the learner reminder emails through Meridian, which uses the learner’s email address to deliver them. If a learner accepted an earlier version of the team seat terms, the purchasing account sees only what that version described. The employer dashboard does not expose individual answers, question text, BACB ID, certificate files, or detailed learning records. Merely using an employer email address does not give an employer access to your results.

Learner-directed profile sharing: when you share a learning profile, the specified recipient can see the report and its practice workspace, including your displayed name, course progress, recorded learning evidence, findings, and saved notes or observations. The recipient must sign in with the specified email while the link remains valid. Access can include editing when you grant that permission. You can revoke a link to end future access through it; revocation does not recover copies already downloaded or saved. Buying your seat does not automatically share your profile. Do not place client information in profiles or practice notes.

Provider information is available in the Microsoft Privacy Statement, Brevo Privacy Policy, and OpenAI Privacy Policy. Independent sites you choose to visit are governed by their own notices.

Cookies, browser storage, and tracking

We use the necessary meridianbx_session cookie to keep you signed in. If you choose “Keep me signed in,” it stays valid for 180 days after your most recent visit. If you don’t, it ends when you close your browser or after 12 hours without activity. It also ends when you sign out, sign out of other devices, reset your password, or it is otherwise revoked. Blocking it prevents account features from working. Session expiry does not mean all associated database records are deleted.

Display preferences, including reduced motion and stronger contrast, are stored in this browser under meridianbx_device_preferences_v1. They remain until changed or cleared and are not synchronized as account preferences. You can remove cookies and local storage through your browser settings.

Some lesson and training screens also store answer drafts, your place in a lesson, video position, audio preferences, or preview activity in local or session storage. The fictional learning-profile demo saves edits in this browser. Local storage remains until replaced or cleared; session storage usually lasts for the browser tab’s session. Clearing browser storage does not delete records already saved to your account. Stripe payment forms and hosting infrastructure may use cookies or similar technology needed for payment security and service delivery.

The current Service does not use advertising pixels or third-party advertising analytics to track you across websites. We do not sell personal information or share it for cross-context behavioral advertising, and do not use it for targeted advertising. This applies whether or not your browser sends a Global Privacy Control signal. The Service does not change its necessary account or security processing in response to the older Do Not Track signal. We will update this notice and provide any required choices before introducing materially different tracking.

Automated practice and sensitive information

Practice selection, scoring, review scheduling, and progress calculations use your activity to operate study features. They do not determine official eligibility, certification, employment, or clinical decisions. AI answer review is optional. When you send a message or choose a study shortcut, we send OpenAI the reviewed question, answer choices, your selected answer, the answer key and explanations, any highlighted passage, your message, and recent messages from that question’s conversation to generate a reply. We do not include your account name or email in that request. Information you type may still identify you, so keep messages limited to study content. Opening answer review or reading the existing explanations does not itself contact OpenAI. Choosing Learn requests a structured guide from OpenAI using the practice question, choices, answer key, and rationale, without your account name or email. We save this guide with your account so you can reopen it without generating it again; a changed question or guide version may require a new generation.

We keep generated replies and request records with your account to recover retries, enforce free-reply allowances, and prevent abuse. The visible conversation is kept in page memory while you review; it is not a saved chat history across page reloads. Requests use OpenAI’s API with response storage disabled. This does not eliminate the provider’s separate security or abuse-monitoring retention. See OpenAI’s API data controls.

Do not submit patient or client details, protected health information, confidential exam questions, government identifiers, financial-account information, or another person’s private records in flashcards, support messages, learning profiles, or other free-text areas. Describe study or accessibility needs without including unnecessary health details. This is an education and exam-preparation service, not a clinical record system.

How long information is kept

Account and study records are generally kept while your account remains open so you can return to your work. Retention also depends on the record’s purpose, an outstanding support request, security and fraud-prevention needs, legal obligations, and the time needed to resolve a dispute. There is no single retention period for all records.

As described in the course terms, Meridian retains training records, including partial completion, for at least seven years to support the Responsible Trainer’s BACB recordkeeping requirements. This includes the identity, participation, assessment, course-version, approval, and certificate records needed to document training. Closing an account or ending an employer sponsorship does not automatically delete those retained records.

You may request deletion using the contact methods below. Some records may need to be retained after account closure, such as those needed to resolve an order, investigate abuse, or comply with law. Backups may retain copies until their normal replacement cycle. We will explain applicable exceptions when responding to a request. Expiring a session, signing out, or archiving study content is not an account-deletion request.

How we protect information

We use measures such as password hashing, hashed session and password-reset tokens in authentication records, access checks, and request limits. Password resets revoke existing sessions. These measures reduce risk, but no internet service or storage system is completely secure. Contact us promptly if you suspect account misuse, and never send your password to support.

Your choices and privacy requests

You can update your name in account settings. For an email correction, a copy of your personal information, account closure, or deletion, email contact@meridianbx.com with the subject “Privacy Request,” or use our account support form. A self-service deletion button is not currently available.

Tell us which account and request are involved. We may ask you to verify control of the account or provide information reasonably needed to protect your data; do not send passwords or identity documents with your initial request. An authorized agent may contact us, subject to verification of their authority and any identity checks permitted by law.

Depending on your location and whether the relevant law applies, you may have rights to access, correct, delete, or obtain a portable copy of information; object to or restrict processing; withdraw consent for consent-based processing; or opt out of certain uses. California rights may include knowing the categories and specific information collected, sources, purposes, and recipients, and limiting certain uses of sensitive information. We do not use sensitive information to infer personal characteristics.

We will respond within the period required by applicable law and explain any permitted extension or reason we cannot fulfill a request. You may appeal a refusal by replying with the subject “Privacy Appeal.” You may also complain to the privacy regulator with authority where you live. We will not unlawfully discriminate against you for exercising privacy rights. Deleting information needed for your account may prevent us from providing related features.

If you receive optional marketing emails, follow their unsubscribe instructions or contact us. Account, security, support, and legal messages may still be needed. Browser display preferences do not control email subscriptions.

Age requirements

Meridian is intended for adults aged 18 and over, as stated in the Terms. It is not directed to children, and we do not knowingly collect personal information from children under 13. If you believe a child or an underage user has provided information, contact us so we can investigate, restrict access as appropriate, and delete information as required by law.

Processing locations

Camus LLC is based in the United States. Information may be processed in the United States and other countries where our providers operate, whose privacy laws may differ from those where you live. Where applicable law requires safeguards for an international transfer, those safeguards must be in place; using the Service does not waive your rights.

Where UK or European data-protection law applies, we process information as needed to provide the service you request, meet legal obligations, or pursue legitimate interests in security, support, and improvement, subject to your rights. When consent is required for a particular use, we will ask for it separately and you may withdraw it. Contact us for information about the safeguards applicable to your data.

Changes to this notice

We will post updates here with a new date and version. For material changes, we will provide additional notice, such as an account notice or email, and obtain consent where required before a new use applies. You can request an earlier version by contacting us. A policy update does not itself provide consent for a new use that requires your permission.

Contact us