Privacy Policy

This policy covers data collected through our website and business services generally -- account information, order history, job applications, and similar. It does not cover Protected Health Information (PHI) we collect as a home care provider under HIPAA -- for example, a patient's medical history, care plan, or clinical notes. That data is governed by our HIPAA Notice of Privacy Practices instead, as required by federal law and the Colorado Privacy Act's own exemption for HIPAA-regulated data.

• Account & contact data: name, email, phone, and (for verified B2B buyers) organization details.
• Order & billing data: order history, shipping address, and payment confirmation (full card numbers are handled directly by our payment processor and never touch our servers).
• Employment & application data: for caregiver and staff applicants -- résumé, references, and background-check results where legally authorized.
• Sensitive data:where you voluntarily provide health- related information outside the patient/HIPAA context (for example, in a job application's accommodation request), we treat it as “sensitive data” under the CPA and process it only with your opt-in consent.
• Technical data: IP address, browser type, and pages visited, collected for security and basic analytics.

Under the Colorado Privacy Act, you have the right to:

• Confirm whether we're processing your personal data, and access it
• Correct inaccuracies in your personal data
• Request deletion of your personal data
• Obtain a portable copy of your data in a usable format
• Opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects

We honor Global Privacy Control opt-out signals from your browser automatically. To exercise any of these rights directly, contact us at [privacy contact email]. We'll respond within 45 days, as Colorado law requires.

These rights do not apply to Protected Health Information. As noted in Section 1, PHI we hold as a HIPAA-covered home care provider is governed by our HIPAA Notice of Privacy Practices instead of this policy. HIPAA's own retention requirements -- which generally require us to retain PHI, including designated record set information, for a minimum period set by federal and Colorado law -- take precedence over a deletion request for that category of data. A deletion request under this policy for non-PHI account or business data does not, and legally cannot, require us to delete PHI we're independently obligated to retain under HIPAA.

We share data with service providers who help us run the Services (payment processing, hosting, email delivery) under contracts that limit their use of it to that purpose. We do not sell personal data to third parties for their own marketing use.

We encrypt sensitive data at rest (AES-256) and in transit (TLS 1.3), restrict access by role, and log access to sensitive records for audit purposes. No method of transmission or storage is perfectly secure, but this reflects our current technical and organizational safeguards.

Our shop assistant chatbot (see Phase 8) helps answer product and order questions. It does not make final decisions about your account, orders, or employment -- a person reviews anything with a material effect on you. [Confirm and update this statement to match the chatbot's actual capabilities before launch, per the Colorado AI Act's disclosure requirements for consequential decisions.]

Questions about this policy or your data: [privacy contact email], [mailing address].