MyHomeCareAI

Privacy Policy

Effective [date]

MyHomeCareAI is a care documentation app used by adult foster home staff. It is operated by [business name] (“we”). This policy explains what information the app stores and how it is protected.

Who uses the app

Only staff accounts created by a facility administrator can sign in. Residents and families do not have accounts.

Information we store

• Staff accounts: name, email, role, password (stored as a one-way hash), passkey public keys, and sign-in/session records.
• Resident care records entered by staff: resident names and profile (date of birth, allergies, code status, contacts, providers), medications and administrations, care notes, daily documentation, pain assessments, tasks and appointments, incident reports, shift reports and resident status changes.
• Staff records: attendance punches and staff credentials (e.g., CPR, TB test dates).
• Device information: push-notification subscription and the device time zone, used to send medication reminders.
• Approximate location (only if you allow it in your browser): rounded to about 1 km and used solely to show local weather. It is not stored with care records.
• Audit logs: who created or changed a record and when.

How information is used

To document and coordinate resident care, send reminders, produce reports (MAR, incident reports, face sheets) and keep an audit trail. We do not sell personal information and do not use it for advertising.

Service providers

• Hosting and database: Cloudflare (application servers and database).
• Optional AI features (narrative drafting and the care assistant) run only when a staff member requests them. Requests go to OpenAI with resident names replaced by temporary codes and with only the minimum information needed. Core records are saved and work without AI.
• Medication reference information: when a staff member taps “What is this for?”, only the medication name is sent to MedlinePlus (U.S. National Library of Medicine) and openFDA. No resident information is sent.
• Weather: rounded coordinates are sent to Open-Meteo or the U.S. National Weather Service.
• Push notifications are delivered through your device’s browser push service (e.g., Apple).

Security

Data is sent over encrypted connections (HTTPS). Access requires a staff account; caregivers can be limited to assigned residents. Unsent changes saved on a device are encrypted. Sessions end after inactivity. Every clinical change is recorded in an audit log.

Retention

Care records, incident reports and audit logs are kept as required for the facility’s licensing and record-keeping obligations and are not deleted from inside the app. Staff accounts can be disabled by an administrator.

Your choices

Residents, representatives and staff may ask the facility to access or correct information. Contact the facility administrator or [support email].

Health information laws

The facility using MyHomeCareAI remains responsible for meeting the privacy rules that apply to it. [If you sign Business Associate Agreements or make specific HIPAA commitments, describe them here.]

Changes

We will update the effective date above when this policy changes.