Privacy Policy

This Privacy Policy explains how TildyCare, LLC ("TildyCare," "we," "us") collects, uses, shares, and retains personal information when you visit tildycare.com, request early access, or use the TildyCare application at app.tildycare.com.

1. Our role, and your agency's role

• Visitors and early-access requests. We decide how that information is used and are responsible for it.
• Customer content in the application. The home care agency decides what to collect and why. We process that information on the agency's behalf as a service provider and, for protected health information ("PHI"), as a business associate under a Business Associate Agreement ("BAA").
• Patients and family members. If your information is in a TildyCare workspace, the agency that provided your care controls it. Contact that agency first with questions or requests. We will help the agency respond.
• We do not sell personal information and do not share it for cross-context behavioral advertising.

2. Information we collect

Information you give us

• Early access. Your name, email address, and optionally your agency's name when you submit the form on our website.
• Account details. Your name, work email, role, agency, and password. Passwords are stored as salted hashes, never in plain text. If you enroll a passkey or authenticator app, we store the credential needed to verify you.
• Support requests. The messages you send us through the in-app support channel, including your name and the content of the conversation.
• Billing details. Your plan, billing frequency, subscription status, and invoice history. Payment card details go directly to Stripe; we do not receive or store full card numbers.

Customer content entered by your agency

Agency staff enter records about prospective and current patients and their contacts. That can include names, dates of birth, phone numbers, email addresses, relationship to the patient, care needs, payment method, hours per week, messages sent and received by SMS and email, call notes, internal notes, tasks, checklist items, and uploaded documents such as signed agreements and assessments. We call this "customer records" below.

Information collected automatically

• Server logs from our hosting providers, including IP address, browser type, device information, requested pages, and timestamps.
• Security signals from Cloudflare Turnstile when you submit the early-access form, used to tell people from bots.
• Fonts for the website are served by a third-party font service, which receives the visitor's IP address and browser information.
• Audit records in the application. When a user views or changes a record, we log who did it, what changed, when, and the IP address used.
• Usage information. Which pages and features are used, actions taken in the application, session times, browser and device type, and when an account was last active. This is usage data about the Service, not customer records.
• Delivery information from our email and SMS providers, such as whether a message was delivered or failed.

3. How we use information

• Provide, operate, and maintain the Service, including the lead timeline, messaging, tasks, and reports.
• Authenticate users, enforce roles, and keep agencies' data separated.
• Send the email and SMS messages that agency staff choose to send.
• Process subscriptions, invoices, and payments through Stripe.
• Respond to support requests and communicate about the Service.
• Maintain audit logs and meet HIPAA, tax, and other legal obligations.
• Understand how the Service is used and improve it, using usage information that does not include customer records.
• Detect abuse, fraud, and security incidents, and protect the Service and its users.

We do not use personal information to make automated decisions about a patient's care, and we do not sell it or use it for advertising.

4. Cookies, storage, and analytics

• Session cookie. The application uses cookies essential to keep you signed in. They are not used for tracking, analytics, or advertising.
• Bot protection. Cloudflare may set a security cookie or use similar storage when it runs the Turnstile check on our forms.
• Preferences. The application stores your theme and display mode in your browser's local storage. That stays on your device.
• Analytics. We use analytics to understand how the Service is used. It is limited to usage information, never customer records.
• No advertising or cross-site tracking. We do not use advertising cookies or track you across other websites, and we do not sell personal information. We do not respond differently to Do Not Track or Global Privacy Control signals because there is no cross-site tracking to opt out of.

5. Service providers

Providers that can access PHI are bound by written agreements that meet HIPAA requirements, including a BAA with Amazon Web Services. We use providers for cloud hosting and storage, early-access signup storage, email and SMS delivery, subscription billing and payments, website hosting, bot protection, website assets such as fonts, and analytics. Contracts limit how each of them can use the information, and analytics providers receive usage information only — never customer records. If we add a provider that handles PHI, we will notify agencies before it does.

A current list of our named subprocessors is available on request at privacy@tildycare.com.

6. When we share information

• With our providers. Under contracts that limit their use of the information.
• At your direction. When an agency user exports data or connects a service we support.
• When the law requires it. We may disclose information to comply with a valid subpoena, court order, or other legal requirement, or where necessary to protect someone's safety or the security of the Service. Where the law allows, we will tell the organization or person affected first and disclose only what is required.
• In a business transaction. If we merge with, acquire, or sell assets to another company, information may transfer as part of that transaction, subject to this policy and, for PHI, the BAA.
• With your consent. In other cases, when the agency or you ask us to.

7. Security

We protect information with administrative, physical, and technical safeguards, including encryption in transit and at rest, role-based access, tenant isolation, multi-factor authentication for our platform administrators, audit logging, and backups. Our providers are bound by HIPAA-compliant agreements where PHI is involved.

No system is perfectly secure. If an incident exposes personal information, we will notify the people affected as state law requires. Where PHI is involved, the BAA controls: we notify the agency, and the agency is responsible for notifying its patients. If you believe you have found a vulnerability, contact us at security@tildycare.com. If you believe personal information has been exposed, contact privacy@tildycare.com.

8. How long we keep information

• Early-access requests. Kept until the product launches or you ask us to remove them, whichever comes first. If you become a customer, the Terms of Service apply.
• Active accounts. Customer content is kept for as long as the account is active.
• Usage information. Kept for as long as needed for the purposes described in section 3, and deleted with the account where we hold it.
• After a deletion request. An agency administrator can request deletion in the app's settings. The request immediately locks the agency out, opens a tracked deletion case, and starts a 30-day cooling-off period. On request, while the account is active or during the cooling-off period, we produce a full export of the agency's records. After the cooling-off period, we permanently destroy the agency's records: database records (leads, contacts, patient details, messages, notes, tasks, checklist items, documents) and the corresponding stored files. Deletion is irreversible once it runs.
• What remains after disposal. The agency row is kept as a record without patient information, and we retain the audit trail, the disposal attestation, and the deletion case thread for seven years after disposal as the evidentiary record of the destruction. Those records can include limited content from notes or messages, are access-controlled, and are deleted when the period ends. The seven-year period applies to this evidence, not to the agency's records, which are destroyed at disposal.
• Legal holds. A legal or regulatory hold suspends disposal and the expiry of retained records until it is lifted. We may otherwise keep information longer when a legal claim, audit, or obligation requires it.
• Backups. We keep backups for up to 35 days. Deleted records may remain in backups until they expire, and are not used for any other purpose.

9. Your choices and rights

• Agency staff. Contact your agency administrator to access, correct, export, or delete your account information. We support administrators in handling those requests.
• Early-access and marketing email. Use the unsubscribe link in any email, or email us, and we will stop. We may still send essential service messages to account administrators.
• Access, correction, deletion, and portability. Send a request to privacy@tildycare.com. We may verify your identity first. If the request concerns records an agency controls, we will refer it to that agency and help them respond.
• Authorized agents. You may use an agent to make a request, with written permission and identity verification.
• No discrimination. We will not deny service or charge more because you exercised a privacy right.

10. State privacy rights

Depending on where you live, you may have the right to know what personal information we hold, to correct or delete it, to obtain a copy, and to opt out of sale or certain sharing. We do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of on those points.

For California residents: we act as a service provider for the patient and agency information in the application, and we process it only to provide the Service as our contracts require. We do not use sensitive personal information for purposes beyond providing the Service. Agency staff should direct requests to their agency first.

11. International visitors

TildyCare is operated in the United States and is intended for U.S. home care agencies. Information is processed and stored in the United States. Our website uses global content networks, which may serve requests from outside the United States. If you access the Service from another country, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

12. Children

The Service is for business use by people 18 and older. It is not directed to children, and patients do not have accounts. Agencies must have the authority to enter information about the people they serve. If you believe a child's information was added to a workspace improperly, contact the agency or us.

13. Changes to this policy

We may update this policy. We will post the new version with a new effective date. For material changes, we will notify agency administrators by email or in the application, and early-access subscribers whose information the change affects. If a change affects how we handle PHI, the BAA governs and we will follow its notice terms.

14. Contact us

TildyCare, LLC
privacy@tildycare.com — privacy requests
security@tildycare.com — security reports

We respond to privacy requests within 45 days, or sooner where law requires. If we need more time, we will tell you why.