Marketing Console Platform

Effective date: August 20, 2026 (previously August 4, 2026)
Contact: admin@districtbehavioralhealth.com

Who we are and who this applies to

District Behavioral Health (“we,” “us,” or “our”), including our operating brands, provides an internal Marketing Analytics Platform (the “Platform”) for authorized staff to review and manage marketing performance for our own advertising accounts and social media pages.

This Platform is for internal staff only. It is not a patient portal, is not intended for patients or the public, and is not used to deliver treatment or health care services.

Purpose of the Platform

We use the Platform for internal marketing reporting and optimization of advertising accounts, websites, and social media pages that we own or control. This includes performance analysis, conversion tracking, search visibility reporting, audience and creative analysis, and publishing organic social media content on our own pages.

Services we connect

Depending on configuration and staff permissions, the Platform may connect to:

• Google Ads — currently used for read-only reporting. In the future, we may also use the Google Ads API to create and manage campaigns, ad groups, keywords, and ads for our own accounts.
• Meta Ads — advertising performance data via the Meta Marketing API.
• Facebook Pages and Instagram — organic publishing to Pages and Instagram professional accounts we own or control, and retrieval of public comments on our ads and posts, via the Meta Graph API and Instagram API.
• Meta Ad Library — publicly available advertising creative, used for market and creative research.
• LinkedIn — organic publishing to LinkedIn company Pages we own or control, via the LinkedIn Community Management API. Authorized staff connect a LinkedIn account that holds an administrator role on our Page, and the Platform publishes posts and images to that Page on our behalf.
• Google Analytics 4 (GA4) — analytics and conversion-related reporting via the Google Analytics API.
• Google Search Console and PageSpeed Insights — organic search performance and page health reporting for websites we own.
• Clerk — authentication and login for authorized users of the Platform.
• Supabase — hosted database where Platform data is stored.

Information we access and store

When authorized staff connect accounts, we may access and store:

• Ad account, property, website, and social media page identifiers and names
• Campaign, ad set, ad, keyword, search-term, geographic, city, device, demographic, time-of-day, placement, and impression-share performance metrics
• Conversion action counts and related marketing conversion metrics (for example, Offline: VOB, Qualified Out of Network, Call Tracking Metrics / CTM call leads, and website form submission conversions)
• Organic search queries, page URLs, click and impression counts, average position, and page performance measurements for websites we own
• Advertising creative we or other advertisers have published publicly, including images, video thumbnails, and ad copy
• Social media content our staff create in the Platform, including post text, uploaded images, scheduling information, and the identifiers of posts we publish
• OAuth access and refresh tokens for connected services (stored encrypted)
• The LinkedIn member ID and display name of the staff member who authorizes a LinkedIn connection, used to attribute and troubleshoot publishing
• App user identity information from Clerk needed for login and access control (such as user ID and email)
• Public comments on our ads and posts

Public comments on our ads and posts

To understand audience response, the Platform retrieves publicly visible comments on our own ads, Page posts, and Instagram content. For each comment we may store the comment text, the commenter’s public display name, the comment identifier, the like count, and the time it was posted, along with a sentiment label and topic themes generated as described below.

We collect this information only from comments left publicly on our own advertising and social media content. We do not collect private messages, and we do not build profiles of individual commenters, contact them based on their comments, or use their comments for advertising targeting. We do not treat these comments as protected health information, and we ask that no one share personal health details in public comments. Comments may be deleted from the Platform on request to the contact address above.

AI-assisted features

Where enabled, the Platform uses third-party AI providers to draft marketing content and summarize marketing performance:

• OpenAI — used to classify the sentiment and themes of public comments described above, to draft captions from images and slide text, and to generate marketing performance summaries and recommendations from the metrics described above.
• Anthropic (Claude) — used to draft organic social media content and propose content ideas.

Information sent to these providers is limited to marketing content and performance data, plus the public comment text described above. We do not send patient records or protected health information to these providers.

What we do not do

• We do not use the Platform for patient treatment or to collect, store, or process protected health information (PHI) for care delivery.
• We do not sell Google user data, Meta user data, or LinkedIn data.
• We do not collect or store information about people who follow, view, or interact with our pages beyond the public comment information described above.
• We do not use Google Ads, Meta Ads, GA4, Search Console, or LinkedIn data to train unrelated AI models, and we do not sell that data to data brokers.
• We use connected advertising, analytics, and social media access only to operate and improve our own marketing operations for accounts and pages we own or control.

Current Google Ads permissions and planned changes

Today, Google Ads access is used for reporting and analysis. We plan to expand use of the Google Ads API so authorized staff can also create and edit campaigns, ad groups, keywords, and ads. Any such write access will remain limited to our own advertising accounts and authorized internal users.

Where information is stored and how it is protected

Platform data is stored in a hosted database provided by Supabase. OAuth tokens are encrypted at rest. Access to the Platform is limited to authorized internal users through Clerk authentication and our access controls.

Third-party service providers

The Platform relies on the following third parties to provide authentication, data storage, advertising, analytics, and social media APIs, and (where enabled) AI-assisted features. Their handling of information is also governed by their own policies:

• Google (Google Ads, Google Analytics, Search Console, PageSpeed Insights, and Google OAuth): https://policies.google.com/privacy
• Meta (Meta Ads, Facebook Pages, Instagram, and Ad Library): https://www.facebook.com/privacy/policy
• LinkedIn (Community Management API and LinkedIn OAuth): https://www.linkedin.com/legal/privacy-policy
• Clerk (authentication): https://clerk.com/legal/privacy
• Supabase (database hosting): https://supabase.com/privacy
• OpenAI: https://openai.com/policies/privacy-policy
• Anthropic: https://www.anthropic.com/legal/privacy

Your choices and controls

Authorized users may disconnect connected advertising, analytics, and social media accounts in the Platform Settings. Disconnecting LinkedIn deletes the stored LinkedIn tokens and Page selection.

You can revoke Google access for this application at any time at: https://myaccount.google.com/permissions

You can revoke Meta access at any time at: https://www.facebook.com/settings?tab=applications

You can revoke LinkedIn access at any time at: https://www.linkedin.com/psettings/permitted-services

To request deletion of Platform-related account connection data or stored comment data, or for privacy questions about the Platform, contact admin@districtbehavioralhealth.com.

Relationship to our other notices

This section applies specifically to the Marketing Analytics Platform used by internal staff. It does not replace our website privacy practices or our HIPAA Notice of Privacy Practices for patient health information.