HomeCare-Force Privacy Policy

Effective date: the effective date shown for this version on this page.

Jonathan Keys, an individual doing business as HomeCare Force, 2450 Stonehaven Drive, Avon, IN 46123 ("HomeCare-Force," "HCF," "we," "us") provides HomeCare-Force, software for home-care agencies (including personal services agencies and home health agencies) to hire and onboard caregivers, track training, and run related operations. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. HCF is not yet a company or other legal entity: Jonathan Keys is personally the provider. If the business is later transferred to a company he forms, we will give agencies written notice before the transfer takes effect (Section 13), and this policy will then name the new provider.

Contact: homecareforce2@gmail.com · Jonathan Keys, doing business as HomeCare Force, 2450 Stonehaven Drive, Avon, IN 46123

1. Who this policy covers and our role

• Agency customers (owners, administrators and staff who sign up for or use HCF on behalf of an agency).
• Caregivers and job applicants whom an agency invites to HCF (for example, to complete onboarding paperwork or training).
• Visitors to our website.

Agencies control their workforce and client data. When an agency uses HCF, the agency decides what information about its caregivers, applicants and clients goes into HCF and why. For that information we act as a service provider / processor to the agency. There is no Business Associate Agreement (BAA) in this first rollout, and we do not accept client PHI. If a BAA is signed later (a separate agreement and a separate gate, Section 9) for an agency that is a HIPAA covered entity, HCF would act as its business associate for the PHI that BAA covers, and the BAA and the agency's own Notice of Privacy Practices would govern that PHI and control over this policy if the two conflict. Questions about information an agency holds should go to that agency first; we will help the agency respond.

Early-stage software; no client information. HomeCare-Force is early-stage software. In this first rollout it is for caregiver and employee compliance records (CareReady hiring and onboarding, SurveyReady training). Agencies must not enter client or patient information (names, addresses, diagnoses, care notes, visit notes, incident details, or photos or scans of client documents) anywhere in HCF, including free-text fields, uploads and AI drafting. VisitReady and PhoneReady are not part of this rollout. Agencies must use synthetic or test data for anything that could identify a client. Real client data may enter HCF only after a separate BAA gate is passed (Section 9). HCF does not claim that it, or any agency using it, is HIPAA-compliant, and HCF holds no HIPAA, SOC 2 or similar certification.

2. Information we collect

Information you give us

• Account information: name, work email, phone number, agency name, role, password, and multi-factor authentication settings.
• Caregiver onboarding information an agency asks a caregiver to provide in CareReady, which can include: legal name, contact details, address, date of birth, Social Security number, tax withholding information on Form W-4, employment eligibility information and identity documents for Form I-9, emergency contacts, uploaded documents (licenses, certificates, IDs), electronic signatures and signature records, and employment terms.
• Caregiver health-related compliance records (for example TB tests, vaccinations and injury records). These may be stored, but our default is dates and pass/fail (cleared / not cleared) results only. Agencies upload only what they need and are asked not to enter clinical detail (diagnoses, test readings or values beyond the result, treatment, injury narratives or medical notes). Whether these records are PHI when HCF holds them as a vendor is unresolved (Section 9).
• Training information in SurveyReady: courses assigned, progress, test answers and scores, completion certificates, credit hours, and competency evaluations.
• Billing information for agencies on a paid plan: billing contact, billing address and payment method, collected and held by our payment processor, Stripe (Section 4).
• Communications you send us (support requests, feedback). Please do not send us client information, or screenshots or documents that show it.

Information collected automatically

• Device and log data: IP address, browser type, pages viewed, timestamps, and security events (such as sign-ins and MFA challenges).
• Cookies and similar browser storage used for sign-in sessions, security, and remembering in-progress work on your device. We do not use them for advertising or analytics.
• If a caregiver opts in, browser push-notification tokens.

Information from agencies about others. Agencies enter information about their caregivers and applicants. Agencies must not enter client information. If client information is entered by mistake, we ask the agency to tell us at once so it can be removed (Section 9).

3. How we use information

• To provide, secure and support the service (accounts, onboarding packets, e-signatures, training records, notifications).
• To protect sensitive identifiers: SSNs are checked for format and stored encrypted. Only an agency owner or administrator signed in with multi-factor authentication can reveal a full SSN, and each reveal is logged. Normal views show only the last four digits, which we keep in readable form. Encryption keys are held in our hosting and database secret stores, not in a dedicated hardware key service.
• To send service messages by email, text message (SMS) and push notification (Section 6).
• To generate AI-assisted training drafts, where that feature is available to the agency (agencies are told not to use AI document features with real data for now; Section 7).
• To maintain audit trails (for example, a record that a signature was voided and the form re-signed after a change).
• To comply with law, enforce our terms and prevent fraud or abuse.
• To improve the service using aggregated or de-identified information.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use caregiver onboarding data, SSNs or health information to train AI models.

4. How we share information

• With the agency that invited you or that you work for, according to its settings and roles.
• With service providers (subprocessors) that host or deliver the service under contract, only as needed:

Subprocessor	Purpose	Data involved
Supabase, Inc.	Database, authentication, file storage	All service data
Vercel Inc.	Application hosting and delivery	Data in transit; request logs
OpenAI, L.L.C. (current AI provider)	AI drafting of training content from typed text; reading of uploaded documents only if an AI document feature is enabled (agencies are told not to use them with real data for now)	Prompts and source text an agency enters; if a document feature is enabled, page images or PDFs are sent to OpenAI to read text. Our filters try to catch obvious personal data but cannot catch everything.
Telnyx Inc.	SMS notifications (sent through PhoneReady's texting service)	Phone number, message text (no client names or form/course details), delivery reports
Stripe, Inc.	Subscription billing and payment processing, for agencies on a paid plan	Agency name, billing contact name and email, billing address, payment card or bank details (held by Stripe; HCF does not store full card numbers), invoices and payment history
Resend (Plus Five Five, Inc.)	Transactional email	Email address, message content
Browser push services (e.g., Google, Apple, Mozilla)	Push notifications, if opted in	Push token, short notice

If we add a service provider that handles personal information, we will update this list.

• As required by law, or to protect rights, safety and security.
• In a business transfer (merger, acquisition, or sale of assets), subject to this policy and any BAA then in force.

5. Retention

We keep information for as long as the agency's account is active and as needed to provide the service, then as the agency directs or as required by law. Agencies are responsible for setting retention for employment records they are legally required to keep (for example, Form I-9 and payroll tax records). After an agency's account ends, we return or delete its data within 30 days of the agency's request or of termination, except where we must keep it by law. Deletion is done manually by HCF on request; there is no automated deletion tool yet. Backups are kept by our hosting provider and roll off on its normal cycle; we do not promise a specific backup-deletion date. Automatic deletion of uploaded files is not in place yet; until it is, we delete uploaded files when an agency asks.

6. Text messages, email and push notifications

• SMS. With consent, we send caregivers short service texts on behalf of their agency (for example, "HomeCare Force training is due soon or overdue" with a sign-in link). Texts do not include client names, health details, or form or course contents. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. Consent to receive texts is not a condition of employment or of using the service. We do not sell or share mobile numbers or SMS opt-in data with third parties for their marketing.
• Email. We send account and service emails. You cannot opt out of essential service or security emails while you have an account.
• Push. You can turn off push notifications in your browser or device settings at any time.

7. AI features

Agencies are told not to use AI document features with real data for now (HCF decision, Oct 23, 2026). These are the features that read an uploaded file or scan: SurveyReady course upload (reading text from scanned pages), assessment drafting and import (uploaded PDFs), CareReady form-template PDF analysis and, if it is ever enabled for an agency, CareReady packet import (which can send images of scanned pages). Our AI kill switch is live and AI features are turned off for every agency. We will tell an agency in writing before turning any on for it, and agencies are still told not to use AI document features with real data. Today's AI provider is OpenAI. Features that work from typed text (SurveyReady "Draft with AI" and CareReady rich-content drafting) send what a user types to OpenAI's API. If a document feature is enabled, scanned pages or PDFs go to OpenAI as well. Uploaded survey reports and other records stored in SurveyReady are not sent to AI, but they are stored with our hosting provider, so they should not contain client information either. Agencies must confirm the material they submit contains no personal data. For SurveyReady drafting, our system tries to detect obvious patterns (for example email addresses, phone numbers, Social Security number formats, labelled record or member numbers, labelled dates of birth, and "client name: First Last") and stops the request when it finds them. CareReady rich-content drafting has no such check: what a user types is sent to OpenAI as written, and form-template PDF analysis sends the whole file with no check. It does not reliably detect street addresses, names without a label, diagnoses, or care notes, and it does not inspect scanned images before they are read. Do not upload documents that contain client information or personal information about caregivers that is not needed. What OpenAI does with the data, as stated on OpenAI's own page "Data controls in the OpenAI platform" (developers.openai.com/api/docs/guides/your-data, checked Oct 23, 2026): data sent to the API is not used to train or improve OpenAI's models unless the customer opts in; OpenAI keeps abuse-monitoring logs for up to 30 days by default; image and file inputs are scanned for child-safety material and a flagged image can be kept for manual review. We set store: false on our requests so OpenAI does not keep the response as application state. OpenAI's terms can change; we will update this policy if our use changes. AI drafts are drafts: an agency administrator must review, edit and publish them, and HCF does not represent that any AI-drafted content is accurate or satisfies any state or federal requirement. Because there is no BAA with OpenAI, AI features must never be used with PHI or client information.

8. Security

We use administrative, technical and physical safeguards that we believe are appropriate for an early-stage product, including encryption in transit, role-based access controls and audit records of some actions. Agency owners, administrators and staff must sign in with multi-factor authentication to use the agency workspace. The database rejects most staff requests that were not made with MFA, and the application checks the rest. Caregivers and employees sign in with a verified email link and are not asked for multi-factor authentication. We design the service to store Social Security numbers encrypted and to show only the last four digits in normal views. These controls have not been independently tested. These safeguards are in place for the first rollout (status on the effective date of this version): a server-side module gate that keeps agencies out of modules not enabled for them, including VisitReady, PhoneReady and RevenueGuard (live); a single AI kill switch (live; AI features are turned off for every agency); notices in the product next to free-text fields telling users not to enter client information (live); an upload confirmation before files are accepted (live for most uploads; a few SurveyReady course and assessment uploads, which feed AI features that are turned off, do not show it yet); and a purge job for uploaded files (built but not running until a retention period is set; until then we delete uploaded files on request). HomeCare Force staff access. A small number of authorized HCF staff can use our internal support tools, by role (owner, administrator, support, view-only). Every staff account signs in with multi-factor authentication, and staff support actions on an agency's account are logged. These tools show an agency's account status and summary counts; staff do not use them to read caregiver onboarding answers, SSNs or documents, and they access agency data only when needed to support, secure or fix the service. Staff never see or set anyone's password; a password reset that staff start is emailed only to the account owner's own address. HCF has not been independently audited or certified. No system is perfectly secure. If we learn of a security incident affecting your information, we will notify the agency and, where required, you and regulators, as required by law and by any agreement we have signed. Our commitment: we will tell the affected agency without unreasonable delay and, where we can, within 7 calendar days after we confirm an incident affecting its information, and in any event within the periods required by law, and will give it the information it needs to meet its own legal notice duties. The law sets outer limits that may also apply: Indiana's breach statute (IC 24-4.9-3-3) requires notice to residents within 45 days after discovery, and HIPAA (45 CFR 164.410, where it applies) allows a business associate up to 60 days to notify a covered entity. Nothing here replaces a duty the law imposes.

9. First-rollout data rule (employee data only; no client PHI; no BAA)

• What HCF is for in this rollout: caregiver and applicant onboarding records (CareReady) and caregiver training records (SurveyReady).
• What must not be entered: any client or patient information, in any field, upload or AI draft. VisitReady and PhoneReady are out of scope for now.
• No BAA in this rollout. HCF does not accept client PHI and does not sign a BAA for this rollout. A BAA is a later, separate gate: real client data may enter HCF only after (a) a BAA covering the modules and data concerned is signed by both parties, (b) HCF's vendor agreements for that PHI are signed, and (c) HCF confirms both in writing. Until then agencies use synthetic or test data for anything client-like. This policy does not promise HCF will offer such a BAA.
• If client information is entered by mistake, the agency tells HCF promptly at homecareforce2@gmail.com; HCF will delete it and both sides will keep a short record of what happened. This is a clean-up process, not permission.
• Caregiver health-related records (TB, vaccination, injury): default is dates and pass/fail only; agencies upload only what they need and do not enter clinical detail (Section 2).
• Real caregiver onboarding data (SSN, W-4, I-9, identity documents) and caregiver health-related records are accepted only after the agency and HCF both sign a Real Onboarding Data Addendum naming the data types and number of caregivers (see the Design-Partner Agreement §4.2 and Terms §2). The addendum never permits client information. Unresolved legal question: whether HIPAA applies to employee records at an agency that is a covered entity, and whether caregiver health records are PHI when HCF holds them as a vendor. 45 CFR 160.103 excludes "employment records held by a covered entity in its role as employer" from PHI; that exclusion is written for the employer (the agency), and we do not conclude that HCF, as a vendor, is outside HIPAA. We treat these records with care either way.

10. Your choices and rights

• Caregivers, applicants and clients: contact the agency that holds your information to access, correct or delete it; we will support the agency's response. You may also contact us at homecareforce2@gmail.com and we will route your request.
• Agency users: you can update account information in settings and ask us to close your account.
• State privacy rights. Depending on where you live, you may have rights to know, access, correct, delete or obtain a copy of your personal information, and to opt out of sale, targeted advertising or certain profiling. We do not sell personal information or use it for targeted advertising. Indiana's Consumer Data Protection Act (IC 24-15, effective January 1, 2026) applies only to businesses that control or process data of at least 100,000 Indiana consumers (or 25,000 plus more than 50% of revenue from selling data), and exempts HIPAA covered entities and business associates and protected health information (iga.in.gov text via search index, read Oct 23). HCF does not meet those thresholds; we have not verified how the law defines "consumer" for employment data. Other state laws may apply. To make a request, email homecareforce2@gmail.com. We will verify your request and respond within the time the law requires. You may appeal a denial by replying to our response; if we deny the appeal you may contact your state attorney general. We will not discriminate against you for exercising your rights. Authorized agents may submit requests where the law allows.
• Health information held under a BAA (none in this rollout) would be handled under HIPAA through the agency.

11. Children

HCF is a business tool for agencies and their workforce and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Users must be at least 18 years old, and agencies must not enter information about workers under 18. We do not accept information about minor clients in this rollout. If you believe a child has given us information, contact homecareforce2@gmail.com and we will delete it.

12. International users

HCF is offered in the United States only, and we intend to keep data in the United States with our hosting providers.

13. Changes

We will post changes here and update the effective date shown on this page. For material changes we will notify agency administrators by email or in the app before they take effect. If HCF's business is transferred to a company formed by Jonathan Keys, we will give agencies at least 30 days' written notice before the transfer takes effect, and the new company will be bound by this policy (see Terms §20).

14. Contact

Jonathan Keys, doing business as HomeCare Force, 2450 Stonehaven Drive, Avon, IN 46123 · homecareforce2@gmail.com