Privacy Policy

Information you provide directly

• Account & identity: your name (or display name), email address, phone number, password (stored only as a salted Argon2 hash), and multi-factor authentication settings. Caregivers receive a portable "Mobile ID" that identifies their account across the agencies they work with.
• Onboarding & work content: information you submit to complete your agency's onboarding — for example signed forms, competency results, direct-deposit details, and documents or photos you upload (such as identification or credentials). Sensitive identifiers (e.g., Social Security or driver's-license numbers) and bank details are encrypted. This content is processed on behalf of your agency.
• Support communications: information you include when you contact us.

Information collected automatically

• Device & push: a push-notification token issued by Apple/Google so we can deliver notifications, plus basic device/platform identifiers.
• Usage & security logs: app interactions, access timestamps, IP address, and audit records we keep for security and HIPAA-required activity review.

We do not use third-party advertising or analytics SDKs, and the Service does not track you across other companies' apps or websites.

We use information to:

• provide, operate, and secure the Service and your account;
• enable agency onboarding, scheduling, compliance, and the other features you and your agency use;
• send transactional and operational messages (including push notifications you can control — see §4);
• detect, investigate, and prevent fraud, abuse, and security incidents;
• maintain audit and activity records required for HIPAA and other legal obligations;
• respond to your support requests; and
• comply with law.

We do not sell your personal information, and we do not use it for third-party advertising.

• With your agency. Information you submit through the Service is available to the home-care agency you are working with, consistent with that agency's role and the Business Associate Agreement. Caregivers working with multiple agencies control which agencies they connect to; we do not disclose one agency's data to another.
• Service providers (subprocessors). We use vetted vendors to run the Service, under contracts that restrict their use of the data and, where PHI is involved, under HIPAA Business Associate Agreements. They currently include:
  • Amazon Web Services (AWS) — application hosting and encrypted document storage (S3 with KMS encryption, in a HIPAA BAA-covered configuration).
  • Google Firebase Cloud Messaging — delivery of push notifications.
  • SendGrid (Twilio Inc.) — transactional email (such as enrollment and password-reset links).
• Legal & safety. We may disclose information if required by law, to respond to lawful requests, or to protect the rights, safety, and security of users, the public, or the Service.
• Business transfers. If we are involved in a merger, acquisition, or asset sale, information may be transferred subject to this Policy and applicable law.

• Push notifications are delivered via Apple/Google. You can turn them off in your device settings at any time; some account and security messages may still be sent by email. Notification previews are intentionally generic and do not include health details on the lock screen.
• The app may ask permission to use your camera and photo library (to capture or upload documents) and biometrics (to confirm your identity for sensitive actions). Biometric matching is performed by your device's operating system; we never receive or store your fingerprint or face data.

For information that is PHI, Align Care Hub acts as a Business Associate to the home-care agencies that use the Service. We maintain administrative, physical, and technical safeguards designed to protect PHI as required by the HIPAA Security Rule, use and disclose PHI only as permitted by our Business Associate Agreements, and assist agencies in meeting their HIPAA obligations. Individuals seeking to exercise HIPAA rights (such as access to or amendment of their records) should contact the relevant agency, which is the Covered Entity (or its Business Associate) for those records.

We retain account and identity information for as long as your account is active and as needed to provide the Service. PHI and agency records are retained according to the agency's instructions and applicable law — home-care records are commonly retained for up to seven (7) years. When you delete your account (see §7), identity-bearing data is anonymized or deleted, while audit and other records we are legally required to keep are retained in a form stripped of your identity.

• Account deletion. You can request deletion in the app or at https://pa.aligncarehub.com/api/v1/account/delete. After you confirm, your account is permanently deleted following a 30-day grace period during which you can cancel.
• Access & correction. You can view and update profile information in the app. For agency records (PHI), submit access/correction requests to your agency.
• Communications. You can disable push notifications in device settings.
• U.S. state privacy rights. Depending on your state of residence (e.g., California, and other states with comprehensive privacy laws), you may have rights to access, correct, delete, or obtain a copy of certain personal information, and to not be discriminated against for exercising them. We do not sell personal information or use it for cross-context behavioral advertising. To exercise a right, contact us at aligncarehub@gmail.com. Note that PHI is generally exempt from these state laws and is governed by HIPAA instead.

The Service is operated in the United States, and information is processed and stored in the United States.

We use encryption in transit and at rest for sensitive data, hashed passwords, multi-factor authentication, role-based access controls, encrypted storage of identifiers and documents, and audit logging. No method of transmission or storage is 100% secure, but we work to protect your information and to respond promptly to incidents.

The Service is intended for use by adults in a professional or care context and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

We may update this Policy from time to time. We will revise the "Last updated" date and, for material changes, provide additional notice. Your continued use of the Service after an update means you accept the revised Policy.

Align Care Hub 4100 Brownsville Rd, Brentwood, PA 15227 Privacy: aligncarehub@gmail.com Support: aligncarehub@gmail.com