Effective: July 18, 2026. Controller: GMETI LLC, 2838 Sage Creek Rd, Fort Collins, CO 80528, USA.
HiveCare is a communication and care-coordination platform for home-health agencies and their teams. This policy explains what data we process through the HiveCare mobile and web application and through our website hivecareapp.com, why, who we share it with, and your rights.
1. Our role
HiveCare is offered to organizations (health agencies). When you use the app as a staff member or client of an agency, that agency is the controller of your data and HiveCare acts as its service provider — its HIPAA Business Associate — processing protected health information (PHI) only on the agency’s instructions.
2. Data we process
- Account data: Name, email address, phone number and your role within the agency. Phone and notes are stored encrypted.
- Communication content: Messages and attachments you send inside the app. These may contain protected health information (PHI). They are stored encrypted with AES-256-GCM.
- Voice calls: 1:1 calls use the microphone in real time. Audio is not recorded or stored; only the fact that a call happened (participants, time, duration) is logged.
- Technical and security data: To protect PHI we keep an audit log of logins, accesses and IP addresses, plus session and device data, including an identifier used to send push notifications.
- Billing data: Agency payments are processed through Stripe. We do not store card numbers.
- Website (hivecareapp.com): If you use the contact form, we process the name, email and message you send, solely to reply to you. Our hosting logs basic technical visit data (such as IP address) for security purposes. We do not use the website for targeted advertising.
3. How we use data
- Provide the service: messaging, calls, client and team management.
- Security and compliance: access control, auditing, tamper detection and HIPAA obligations.
- Notifications: message and call push alerts. The alert contains no health information.
- Support and agency billing.
We do not use your data for advertising or automated decision-making about you.
4. Who we share with
We do not sell your data. We share information only with:
- Other authorized members of your agency, based on your role.
- Service providers under contract and confidentiality: hosting on Google Cloud, push notifications via Firebase Cloud Messaging (Google), and payments via Stripe.
- Authorities, where required by law.
5. How we protect data
All health information is encrypted at rest (AES-256-GCM) and in transit (TLS). Every PHI access is written to a hash-chained append-only audit log whose integrity is verified daily. Access is role-limited and isolated per organization. Device backups exclude the app’s data. A technical summary of the HIPAA safeguards HiveCare implements is available on request from your agency.
6. Retention
We keep data while your account is active and for as long as the agency and applicable law require. Attachments are automatically purged when their retention period ends, absent a legal hold. Audit logs are retained per HIPAA requirements.
7. Your rights
You can request access, correction, export or deletion of your data. Because your agency is the controller, direct requests to the agency or email us and we will route them. An administrator can generate a downloadable package of your record set. Instructions for deleting your HiveCare account are available in our Help Center under “How to Delete Your HiveCare Account.”
8. Children
HiveCare is not directed to children under 13 and does not knowingly collect their data to create their own accounts.
9. Changes
We may update this policy. The current version and its new effective date will be posted here.
10. Contact
For any privacy question or to exercise your rights, email support@hivecareapp.com.
