Privacy Policy

1. A Note on Health Information (PHI)

When we process protected health information (“PHI”) on behalf of a customer agency, we do so as a HIPAA business associate under a Business Associate Agreement (“BAA”). The agency’s own privacy practices and the BAA govern that data; this Policy governs everything else. We apply minimum-necessary principles: our intake templates exclude client names, Medicaid identifiers, and clinical data wherever feasible.

2. Information We Collect

• Account and contact data — name, work email, phone, role, agency, and credentials for platform users; contact details submitted through demo bookings or the website.
• Caregiver contact and consent data — provided by the employer agency: name, mobile number, and per-recipient SMS/voice consent records, used to send visit-documentation reminders.
• Operational data — EVV visit records and exception data uploaded by agencies (handled under the BAA where it contains PHI).
• Usage and device data — log data, IP address, browser type, and interactions with the Services, used for security and product improvement.
• Billing data — payment method details are collected and processed directly by our payment processor (Stripe); we receive confirmation and subscription status, not full card numbers.

3. How We Use Information

We use personal information to provide and support the Services (including detecting EVV exceptions and sending consented reminders), manage accounts and billing, secure the Services, comply with law, and improve the product. Aggregated, de-identified statistics that identify no individual or agency may be used for benchmarking.

4. Text Messaging Disclosures

Caregiver reminders are account notifications, not marketing. Consent is collected by the employer agency using written consent language, is stored per recipient, and is enforced before every send. Recipients can reply STOP to opt out or HELP for help at any time; message frequency varies and message/data rates may apply. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. No PHI is included in any message.

5. How We Share Information

We share personal information only with: (a) service providers acting on our instructions — cloud hosting and infrastructure (Vercel; Railway), telecommunications (Twilio), payments (Stripe), e-signature (Dropbox Sign), and, where voice features are enabled, speech-processing (OpenAI) — each bound by contract to protect it; (b) the customer agency that employs or engages the individual; (c) authorities where required by law; and (d) a successor in a merger or acquisition, subject to this Policy. We do not sell personal information and we do not share it for cross-context behavioral advertising.

6. Retention

We retain personal information only as long as needed for the purposes above: customer platform data for the subscription term plus a 30-day export window; pre-sale Compliance Snapshot data is deleted within 24 hours of the readout; messaging consent and opt-out records for the duration of the relationship plus six (6) years (to honor and evidence consent); and other records as required by law.

7. Security

We maintain administrative, physical, and technical safeguards, including encryption in transit and at rest, role-based access controls, and audit logging. No system is perfectly secure; we will notify affected parties of breaches as required by law and contract.

8. Your Rights and Choices

Depending on your state, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. Submit requests to legal@oncu.us; we will verify and respond as required by applicable law (e.g., within 45 days under most state privacy laws). If we process your information on behalf of your agency, we may refer the request to the agency. We do not discriminate for exercising rights. Caregivers can opt out of messages at any time by replying STOP.

9. Children

The Services are workplace tools and are not directed to children under 13; we do not knowingly collect their information.

10. Changes; Contact

We will post updates with a new effective date and give notice of material changes. Contact: Vanguard Veil Limited · legal@oncu.us.