Privacy Policy

Effective date: May 22, 2026 · Last updated: May 22, 2026

CareConnect (“CareConnect,” “we,” “us,” or “our”) provides a home-care, senior-living, and back-office management platform used by licensed home-care agencies, assisted-living operators, and their employees. This Privacy Policy describes how we collect, use, share, and protect information when you use the CareConnect platform, including tenant subdomains such as careconnect.idahosky.us, thegrandson.mycareconnect.us, and other instances we operate, and any integrations CareConnect provides with third-party services such as Intuit QuickBooks Online.

1. Who this policy applies to

This Privacy Policy applies to:

• Agency administrators and staff who use CareConnect to manage their agency operations, schedules, billing, payroll, and clinical records.
• Caregivers and clinical employees who use CareConnect for scheduling, clocking, documentation, and electronic visit verification (EVV).
• Clients of agencies (and their authorized representatives) whose information is recorded by agency staff in CareConnect for care delivery, billing, and compliance purposes.
• Visitors to public-facing CareConnect web pages, including this page.

For client records that constitute Protected Health Information (PHI), CareConnect acts as a Business Associate of the agency under HIPAA. The agency is the Covered Entity and owns the client relationship.

2. Information we collect

2.1 Information you provide directly

• Account information: name, email address, phone number, user role, mailing address, and password (stored in salted, hashed form).
• Agency profile: business name, address, NPI, taxonomy code, licensing identifiers, office locations, payers, contracts, and service offerings.
• Client (patient) records entered by agency staff: demographics, insurance and Medicaid eligibility, diagnoses, care plans, service authorizations, visit notes, eMAR records, vitals, ADL observations, and other clinical documentation.
• Caregiver records: licensure, certifications, immunizations, training records, employment paperwork, payroll data, and time records.
• Financial and accounting data: invoices, claims, payments, deposits, write-offs, payer EOBs, and 835/837 EDI records.
• Communications: messages, support requests, and feedback you submit through the platform.

2.2 Information collected automatically

• Device and connection information: IP address, browser type and version, operating system, device identifiers, and approximate location derived from IP.
• Usage telemetry: pages visited, features used, session timestamps, audit trail of changes made by each user, and error / performance logs.
• Cookies and similar technologies: session cookies for authentication, CSRF protection tokens, and a small number of preference cookies. We do not use third-party advertising cookies.
• Electronic Visit Verification (EVV): when caregivers clock in or out using the mobile interface, we may collect GPS coordinates of the visit start and end as required by state Medicaid programs.

2.3 Information from third parties

• Payer and clearinghouse responses (270/271 eligibility, 277CA acknowledgments, 835 remittance advice) returned from contracted EDI clearinghouses and payers.
• QuickBooks Online (Intuit): when an agency administrator connects CareConnect to QuickBooks Online, CareConnect receives an OAuth 2.0 access token, refresh token, the QuickBooks company (realm) ID, and the accounting records the agency authorizes us to read or write (customers, invoices, items, payments, journal entries, and related metadata).
• Identity and email deliverability providers when used.

3. How we use information

We use the information we collect to:

• Provide and operate the CareConnect platform, including scheduling, EVV, clinical documentation, billing, payroll, and reporting.
• Authenticate users, enforce role-based access, and maintain an immutable audit trail of changes.
• Generate, submit, and reconcile insurance claims; record remittance advice; and produce financial reports.
• Synchronize selected accounting records with the agency’s connected QuickBooks Online company at the agency’s instruction.
• Send transactional notifications such as visit confirmations, missed-clock alerts, password resets, invoice reminders, and platform notices.
• Provide customer support and respond to your requests.
• Detect, prevent, and investigate fraud, abuse, security incidents, and violations of our Terms of Service.
• Comply with legal obligations, including HIPAA, state home-care licensing requirements, Medicaid program rules, and lawful requests from government authorities.
• Improve the platform through aggregate, de-identified analytics. We do not use PHI for advertising or for training third-party AI models.

4. Legal basis for processing

We process personal information on the following bases: performance of the contract between an agency and CareConnect; compliance with legal obligations (including HIPAA where applicable); the legitimate interests of agencies and CareConnect in operating the platform securely; and with consent where required.

5. How we share information

CareConnect does not sell personal information. We share information only as follows:

• Within an agency tenant. Information belonging to a given agency stays within that agency’s tenant database. Information is not shared across agency tenants.
• With service providers who host our infrastructure, deliver email, send SMS notifications, process EDI claims, or provide error monitoring, all under written confidentiality agreements and, where PHI is involved, HIPAA Business Associate Agreements.
• With payers and clearinghouses as necessary to submit claims, check eligibility, and post remittance advice on behalf of the agency.
• With Intuit QuickBooks Online when the agency has connected QuickBooks. Only the accounting records selected by the agency are transmitted, using OAuth 2.0 tokens scoped to the agency’s authorized QuickBooks company.
• For legal reasons: to comply with subpoenas, court orders, government audits, or to protect the rights, property, or safety of CareConnect, its users, or the public.
• In a business transaction: in the event of a merger, acquisition, financing, or sale of assets, information may be transferred to the successor entity subject to this Privacy Policy.

6. QuickBooks Online data handling

When an agency administrator connects CareConnect to QuickBooks Online, we store the OAuth access token, refresh token, token expiration, QuickBooks company (realm) ID, sandbox/production mode flag, and the agency’s sync configuration. Tokens are stored in our database in encrypted form. Tokens are refreshed automatically before expiration. The agency may disconnect QuickBooks at any time from the CareConnect integration page; disconnection revokes our access and deletes the stored tokens.

CareConnect uses QuickBooks data solely to fulfill the agency’s accounting-sync workflow. We do not use QuickBooks data for marketing, advertising, training third-party AI models, or any purpose other than the one the agency authorized.

7. Data retention

We retain agency, client, caregiver, and financial records for the period required by the agency’s applicable state licensing, Medicaid program rules, HIPAA, payer contracts, and tax law. When an agency terminates its CareConnect subscription, the agency may request export or deletion of its tenant data subject to records-retention obligations. Backup copies are retained for a limited period to support disaster recovery and are then overwritten in the normal course.

8. Security

CareConnect uses industry-standard technical and organizational controls, including:

• TLS (HTTPS) encryption for all traffic between users and the platform.
• Database isolation per agency tenant.
• Role-based access control with the principle of least privilege.
• Encrypted storage of OAuth tokens, EDI credentials, and other secrets.
• Audit logging of administrative actions and clinical record changes.
• Regular backups, monitored cron jobs, and incident-response procedures.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at the address below.

9. Your rights and choices

If you are a CareConnect platform user, you may access, update, or correct your account information through the platform’s user-settings pages or by asking your agency administrator. Depending on your jurisdiction, you may also have the right to request a copy of your personal information, request deletion subject to applicable retention rules, object to certain processing, or lodge a complaint with a data-protection authority.

For client (patient) records, requests for access, amendment, accounting of disclosures, or restriction must be directed to the agency that maintains the record, as the agency is the HIPAA Covered Entity.

10. Children

CareConnect is a business platform for licensed agencies and is not directed to children. We do not knowingly collect personal information from children except where a child is a client of an agency and the agency’s legally authorized representative has authorized that collection in the context of care delivery.

11. International users

CareConnect is operated from and intended for use within the United States. Information is processed and stored in the United States. If you access the platform from outside the United States, you consent to the transfer and processing of your information in the United States.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised “Last updated” date and, where appropriate, communicated to agency administrators through the platform.

13. Contact

Questions, requests, or complaints regarding this Privacy Policy or our information practices may be directed to:

CareConnect — Privacy
c/o Idaho Sky In-Home Care
739 Curless Rd
Bonners Ferry, ID 83805
United States
Email: netmail@idahosky.com