Privacy Policy

Heart & Home AFH (“Heart & Home,” “we,” “us”) provides electronic health record and operations software to licensed Adult Family Homes (AFHs) in Washington State. This policy explains what information we collect through the platform at ehr.heartandhomeafh.com, how it is used, and the safeguards we apply — particularly to resident health information.

Each facility that signs up (a “Customer”) is the owner and controller of the resident and staff data it enters. Where that data includes Protected Health Information (PHI), Heart & Home acts as a Business Associate under HIPAA, processing PHI only as directed by the Customer and under a Business Associate Agreement (BAA).

• Account & staff data — name, email, phone, role, and credentials for facility owners, administrators, nurses, and caregivers.
• Resident health records — census, care plans, medication administration records (MAR), incident reports, assessments, and documents entered by facility staff.
• Billing & claims data — Medicaid ProviderOne claim data (837P/837I, CMS-1500) and related billing records submitted on the Customer’s behalf.
• Communications — messages, faxes, and SMS notifications sent or received through the platform.
• Usage & device data — log data, IP address, and device/browser information collected automatically to secure and operate the service.

We use information solely to provide, secure, and support the platform: authenticating users, rendering resident records to authorized staff, transmitting Medicaid claims, sending fax/SMS communications a Customer initiates, and maintaining the audit trail required for compliance. We do not sell resident or staff data, and we do not use PHI to train AI models.

Certain features (such as fax triage) use a third-party AI provider to summarize or classify content on request. These requests are scoped to the specific document or message being processed, are not used to train the provider’s models, and remain advisory — every AI-assisted suggestion is reviewed and actioned by facility staff, never automatically.

We share information only with service providers necessary to operate the platform, each bound by contract to protect it and restricted to processing data solely on our behalf:

• Infrastructure providers — for secure database, authentication, and file storage, with access controls enforcing per-facility data isolation.
• Communications providers — for SMS and fax transport a Customer initiates.
• State Medicaid clearinghouse — for facilities that submit claims through the platform.

We do not share resident or staff data with advertisers, data brokers, or any party outside of operating the service, except where required by law or with the Customer’s direction.

Data is encrypted in transit and at rest. Sensitive credentials and integration connections are encrypted with AES-256-GCM, keyed per facility. Access is role-based and least-privilege — caregivers, for example, cannot reach billing or facility settings. Sensitive actions write to an insert-only audit log recording who viewed, changed, sent, or deleted a record, and when.

We retain resident and facility data for as long as the Customer maintains an active account, and afterward only as needed to meet Washington State recordkeeping requirements for adult family homes or as instructed by the Customer. A Customer may request export or deletion of its data, subject to the retention periods required by applicable health-records law.

If you are a resident, family member, or staff member with questions about records held about you, please contact your facility directly — as the data controller, your facility administers access, correction, and deletion requests for information in its account. If you are a facility administrator, contact us using the details below.

We use strictly necessary cookies to keep you signed in and to secure your session. We do not use third-party advertising or tracking cookies.

The platform is intended for use by licensed adult family home staff and is not directed at children. Resident records may relate to any age where an AFH serves a resident under a facility’s license, and are handled with the same PHI safeguards described above.

Use of the Heart & Home AFH mobile app as distributed through the Apple App Store is additionally governed by Apple’s Standard End User License Agreement (EULA), available at apple.com/legal/internet-services/itunes/dev/stdeula. By installing the app from the App Store, you agree to its terms in addition to this Privacy Policy and our Terms of Service.

We may update this policy as the platform evolves. Material changes will be reflected by updating the effective date above; continued use of the platform after a change constitutes acceptance of the updated policy.

Questions about this policy or our data practices can be sent to privacy@heartandhomeafh.com.