Privacy policy
Effective 2026-09-14.
RBT Link by Oala Health is a workforce coordination app for Registered Behavior Technicians. This policy describes data the app and rbtlink.app collect when you use RBT Link. It does not apply to Oala’s separate provider products.
We collect account contact data (verified email or phone used to sign in; a contact mobile number that is not SMS-verified in this version), profile details you enter (name, date of birth, home ZIP and state, work preferences, availability, travel range), Oala Passport credential numbers you submit, opportunity responses (Accept or Decline), device session tokens, and optional first-party product analytics events. We do not collect patient, client, or clinical records in RBT Link v1.
We use this information to create and secure your account, send one-time sign-in codes, keep your work profile, show Oala-released opportunities, record Accept or Decline, operate Oala Passport verification, and provide support and account deletion.
The currently released app uses email sign-in. When SMS sign-in becomes available, Oala will generate and check one-time codes, and Twilio Programmable Messaging will process your mobile number, message content, and delivery information to deliver those codes. Oala hosts the application and database. RBT Link does not include advertising, crash, or analytics SDKs from third parties.
SMS sign-in privacy
For the planned RBT Link sign-in SMS program, we will use your mobile number and SMS consent record to send codes you request and honor your messaging choices. Mobile information and SMS opt-in data and consent will not be sold or shared with third parties or affiliates for marketing or promotional purposes. We may share the information needed to deliver and support messages with service providers acting on our behalf, such as Twilio and telecommunications carriers. Message frequency varies based on your requests. Message and data rates may apply. Once the SMS program is enabled, reply STOP to opt out or HELP for help, or contact [email protected]. SMS sign-in is not yet available in the currently released app.
Location is optional and just-in-time. If you tap “See nearby work areas,” the device may share a one-time foreground location with the app to suggest a ZIP. Exact coordinates are not sent to Oala servers and are not stored. You can always enter a ZIP instead.
Account and profile data are kept while your account is active. After you delete your account, we revoke sessions and irreversibly anonymize profile, identity contact data, availability, and credential numbers. Operational and audit records that must remain for the coverage loop (for example eligibility, opportunity, selection, assignment, and audit events) are retained without those personal identifiers. Short-lived sign-in challenges expire and are deleted with the account when they belong to it.
You can sign out, update profile information in the app, or delete your account in Settings or at https://rbtlink.app/account-deletion after verifying the mobile number on the account. Deletion does not require a support call.
Sign-in uses one-time codes. Sessions are stored in the device secure store and as hashed tokens on the server. Production API origins use HTTPS. We do not log one-time codes, Twilio secrets, or session tokens.
RBT Link is a professional workforce tool. It is not directed at children.
Privacy questions: [email protected].