Terms of Service

These Terms of Service ("Terms") are an agreement between TildyCare, LLC ("TildyCare," "we," "us") and the home care agency that creates an account ("Agency," "you"). They cover the TildyCare website at tildycare.com and the TildyCare application at app.tildycare.com (together, the "Service"). By starting a trial, creating an account, or using the Service, you agree to these Terms on behalf of the Agency.

1. Who these Terms are between

• The Service is sold to businesses, not consumers. You must be at least 18 years old and authorized to bind the Agency to these Terms.
• Individual staff members use the Service under the Agency's account. The Agency is responsible for their use, whether or not they are employees.
• If you do not agree to these Terms, do not use the Service. If you use the Service on behalf of a client or another organization, you confirm you have authority to accept these Terms for them.

2. Accounts and administrative responsibilities

• Agency administrators create, configure, and remove user accounts, assign roles, and decide who can see which leads. Remove access promptly when a staff member leaves or changes roles.
• Provide accurate account information and keep it current. Keep credentials confidential. Do not share a login between people.
• We strongly recommend that every user enroll a passkey or authenticator app. We require multi-factor authentication for our own platform administrators.
• Notify us promptly at security@tildycare.com if you believe an account has been compromised. You are responsible for activity under your accounts until you tell us.

3. HIPAA and the Business Associate Agreement

The Service is intended to hold protected health information ("PHI"). TildyCare acts as a business associate; the Agency acts as a covered entity or as a business associate of a covered entity.

• A Business Associate Agreement ("BAA") is required. Before you submit PHI, you must accept our BAA. The BAA is a separate agreement that is incorporated into these Terms by reference. If the BAA and these Terms conflict about PHI, the BAA controls.
• We use and disclose PHI only as the BAA and applicable law permit: to provide and secure the Service, to respond to your instructions, and as required by law. We do not sell PHI. We do not use your content for advertising or to train machine learning models.
• We maintain administrative, physical, and technical safeguards, including encryption in transit and at rest, role-based access, tenant isolation, and audit logging. Our subcontractors that can access PHI are bound by written agreements that meet HIPAA requirements.
• The Agency remains responsible for its own HIPAA compliance, including its security risk analysis, policies and procedures, workforce training, minimum-necessary decisions, Notice of Privacy Practices, patient authorizations and consents, and its own vendor relationships.
• If you need to store records subject to 42 CFR Part 2 (substance use disorder treatment), contact us before uploading. They are not covered by these Terms unless we agree in writing.
• If we discover a breach of unsecured PHI, we will notify the Agency within five business days of discovery, as the BAA requires.

4. Patient communications and consent

The Service lets the Agency send SMS and email to contacts and document calls and notes. The Agency decides who to contact, what to say, and when. Messages are sent through our messaging providers on the Agency's behalf.

• You are responsible for consent. Before sending any message, obtain all consents required by law, including prior express written consent where required for autodialed, prerecorded, or marketing messages. Keep records of those consents.
• Comply with the Telephone Consumer Protection Act, CAN-SPAM, state telemarketing and do-not-call rules, quiet-hours restrictions, and any other law that applies to your messages. Do not use the Service for unsolicited bulk messages.
• The Service records SMS opt-outs (STOP, UNSUBSCRIBE) and opt-ins (UNSTOP) and blocks further SMS to opted-out contacts. Do not attempt to work around an opt-out, for example by entering a different number for the same person.
• The Agency is the sender of record. Your agency name, number, message content, and the accuracy of contact details are your responsibility.
• Do not use the Service to contact emergency services. It is not an emergency dispatch tool.

5. Acceptable use

You agree not to:

• Use the Service in violation of law or of these Terms, or to store or transmit unlawful content.
• Send spam, harassing messages, or messages without the required consent.
• Upload malware, attempt to breach security, or test the Service's security without our written permission.
• Reverse engineer, copy, scrape, or resell the Service, or build a competing product from it.
• Access another agency's data, or attempt to bypass tenant isolation, roles, or audit logging.
• Put PHI in the early-access form, support tickets, or any channel outside the secured application.
• Use the Service to make automated clinical or eligibility decisions without qualified human review.

6. Fees, trials, and renewal

• Plans and prices are shown on our pricing page. Prices are in U.S. dollars and exclude taxes, which you are responsible for. We may correct pricing errors.
• 30-day trial. If you start a trial through our checkout, you provide a payment method. When the trial ends, the paid subscription begins and the payment method is charged automatically unless you cancel before the trial ends.
• Subscriptions renew automatically each month or year until canceled. Cancel through the billing portal in the application. Cancellation takes effect at the end of the current billing period; you keep access until then.
• Before an annual plan renews, we will email the agency administrator a reminder with the renewal price and how to cancel.
• Fees are non-refundable except where law requires. We do not refund partial periods after a cancellation or downgrade.
• We may change prices with at least 30 days' notice. A change applies at your next renewal. If you do not agree, cancel before that renewal.
• If a payment fails, we may retry it, then make the account read-only after a grace period, and then suspend access. We do not delete data immediately for non-payment; the retention terms below still apply.
• Payments are processed by Stripe. We do not receive or store full payment card numbers.

7. Your data, exports, and ownership

• The Agency owns the data it and its users put into the Service, including leads, contacts, patient information, messages, notes, and documents ("Customer Data").
• You grant us a limited license to host, process, transmit, back up, and display Customer Data as needed to provide and secure the Service, comply with law, and follow your instructions. This license ends when the data is deleted, except for copies retained under the retention terms or in backups.
• You can export leads and their records as CSV or JSON, and request a full data-return export. We may need to verify the request and may charge a reasonable fee for unusual or repeated exports.
• We may collect usage information about how the Service is used — pages and features used, actions taken, and session data — to operate, secure, and improve it. That usage information does not include the content of Customer Data, and we do not use Customer Data for analytics or advertising.
• We do not use Customer Data for our own marketing and do not sell it. If you send us feedback, we may use it without restriction and without obligation to you — but do not put PHI or confidential information in feedback.

8. Cancellation, deletion, and retention

• While the account is active, we keep Customer Data so the Service works as expected.
• Requesting deletion. An Agency administrator can request deletion in Settings. The request immediately locks the Agency out of the Service, cancels the subscription, opens a tracked deletion case, and starts a 30-day cooling-off period. Until disposal runs, the request can be stopped — contact support if it was made in error or you change your mind.
• Data return. On request — while the account is active or during the cooling-off period — we produce a full export of the Agency's records (JSON plus uploaded documents). While the account is active, the Agency can also export its data at any time through the application.
• Disposal. After the cooling-off period, we permanently delete the Agency's records: leads, contacts, patient details, messages, notes, tasks, checklist items, and uploaded documents from the database, and the corresponding files from storage. Deletion is irreversible once it runs. The Agency row remains only as a record without patient information, and we issue a disposal attestation describing what was destroyed, when, and by whom.
• What we keep. We keep the audit trail, the disposal attestation, and the deletion case thread for seven years after disposal as the evidentiary record of the destruction. These records can include limited content from notes or messages, are access-controlled, and are deleted when the period ends. We keep them longer only where the law requires.
• Legal holds. A legal or regulatory hold suspends disposal and the expiry of retained records until the hold is lifted.
• Backups. We keep backups for up to 35 days. Deleted records may persist in backups until they expire, and are not used for any other purpose.

9. Confidentiality

Each party will protect the other's confidential information with at least reasonable care and use it only to perform under these Terms. Confidential information does not include information that is public, already known to the recipient without a duty of confidentiality, independently developed, or received from a third party without restriction. A party may disclose confidential information when legally required, after giving the other party prompt notice where lawful. PHI is governed by the BAA, not this section.

10. Availability and support

• We work to keep the Service available and perform maintenance when needed, sometimes with short notice. We do not guarantee uninterrupted or error-free operation.
• Unless we sign a separate written service-level agreement, the Service is provided without an uptime guarantee or service credits.
• Support is available through the in-app support channel or the contact address in your account. Response times vary by plan and workload.

11. Warranties and disclaimers

We warrant that we will provide the Service materially as described and with reasonable skill and care. Otherwise, and to the maximum extent permitted by law, the Service is provided "as is" and "as available," without other warranties, express or implied, including merchantability, fitness for a particular purpose, and non-infringement.

TildyCare is not a medical, clinical, legal, billing, or compliance advisor. We do not decide whether a patient is eligible for care or coverage, and we do not guarantee placement, reimbursement, or any clinical outcome. The Agency is responsible for its eligibility determinations and for its own compliance decisions, including its HIPAA security risk analysis.

The Service depends on third parties such as AWS and Stripe (and Cloudflare for our website). We are not responsible for failures outside our reasonable control.

12. Limitation of liability

To the maximum extent permitted by law, neither party is liable for indirect, incidental, special, consequential, or punitive damages, or for lost profits, revenue, data, or goodwill, even if advised of the possibility.

Each party's total liability arising out of or related to these Terms is limited to the greater of the fees the Agency paid us in the 12 months before the event giving rise to the claim, or U.S. $5,000.

These limits do not apply to fraud, willful misconduct, gross negligence, death or personal injury, a party's indemnification obligations, or any liability that cannot be limited by law. The limits apply even if a remedy fails its essential purpose.

13. Indemnification

• The Agency will defend and indemnify TildyCare against third-party claims, damages, and costs (including reasonable attorneys' fees) arising from Customer Data, the Agency's patient communications, its failure to obtain required consents, its violation of HIPAA, TCPA, CAN-SPAM or other law, or its breach of these Terms.
• We will defend and indemnify the Agency against third-party claims that the Service infringes a U.S. patent, copyright, or trademark, provided the Agency promptly notifies us and lets us control the defense.
• The party seeking indemnity must give prompt notice, reasonable cooperation, and allow the indemnifying party to control the defense. A settlement that admits fault requires consent.

14. Intellectual property

We own the Service, including its software, design, documentation, and trademarks. These Terms grant the Agency a limited, non-exclusive, non-transferable right to use the Service during the subscription for its internal business. All rights not expressly granted are reserved. Do not remove proprietary notices.

15. Suspension and termination

• The Agency may stop using the Service at any time by canceling its subscription.
• For breach. If the Agency materially breaches these Terms or the BAA, we may suspend or terminate the account after written notice and 30 days to resolve the breach, except where it cannot be resolved or the law requires faster action.
• Immediately. We may suspend or terminate immediately if the Agency fails to pay after the grace period in section 6, uses the Service unlawfully or fraudulently, infringes our intellectual property, or creates a risk to the security of the Service or of PHI. We may also act immediately where the law requires it.
• Notice. Where we can, we will tell the Agency what the problem is and what would resolve it. A suspension lasts only as long as needed and ends when the issue is fixed.
• On termination, access ends. Canceling the subscription does not by itself request deletion — request deletion as described in section 8, and export before then. Retention and deletion follow section 8.
• Sections that by their nature should survive termination do survive, including data ownership, retention, confidentiality, disclaimers, liability limits, indemnity, and general terms.

16. Changes to these Terms

We may update these Terms. For material changes, we will give at least 30 days' notice by email or in the application and post the new version with its effective date. Continued use after the effective date means you accept the updated Terms. If you do not agree, stop using the Service and cancel before the change takes effect.

17. General

• Governing law and venue. These Terms are governed by the laws of the State of Florida, without regard to conflict-of-laws rules. The parties will resolve disputes exclusively in the state or federal courts located in Alachua County, Florida, and each consents to personal jurisdiction there. The parties do not agree to arbitration.
• Assignment. Neither party may assign these Terms without the other's consent, except to a successor in a merger, acquisition, or sale of substantially all assets, if the successor agrees to be bound and, for PHI, to the BAA.
• Entire agreement. These Terms, the BAA, and the plan and pricing you accept at checkout are the entire agreement and replace prior discussions on the same subject.
• Severability and waiver. If a provision is unenforceable, the rest remains in effect. A failure to enforce a provision is not a waiver.
• Force majeure. Neither party is liable for delays caused by events beyond its reasonable control.
• Notices. We may notify you by email or in the application. Legal notices to us must go to the email address in section 18.
• Electronic agreement. Electronic acceptance has the same effect as a signature. These Terms are in English.
• Export and government use. You may not use the Service in violation of U.S. export or sanctions laws. The Service is a commercial item; government use is governed by these Terms.
• No third-party beneficiaries. No one other than the parties may enforce these Terms, except that a successor or permitted assignee may.

18. Contact us

TildyCare, LLC
privacy@tildycare.com — privacy and legal notices
security@tildycare.com — security reports

Copyright complaints and other legal notices go to the privacy address above. Include enough detail for us to identify the material and your contact information.