Privacy Policy

Unity CareLink LLC ("Unity CareLink," "UCL," "we," "us," or "our") provides a care coordination platform for families, Direct Support Professionals (DSPs), and agencies supporting people with intellectual and developmental disabilities (IDD). This Privacy Policy explains how we collect, use, share, and protect information when you use the Unity CareLink web platform and mobile applications (collectively, the "Service").

We wrote this in plain English on purpose. If anything is unclear, email us at [email protected].

1. Who We Are

Unity CareLink LLC is a California limited liability company headquartered in Ventura County, California. We can be reached at:

• Email: [email protected]
• Phone: (805) 638-5959
• Mail: Unity CareLink LLC, Simi Valley, CA [full address at launch]

2. Who This Policy Covers

This policy applies to:

• Families and natural supports using UCL to coordinate care for a loved one
• Direct Support Professionals (DSPs) using UCL to log shifts and communicate with care teams
• Agencies, programs, and FMS providers using UCL as part of their service delivery
• Supported Individuals — the person at the center of the care circle, who may be a minor or adult with IDD

3. Information We Collect

Information You Provide Directly:

• Account information: name, email, phone number, role (family/DSP/agency), and password
• Profile information: relationship to the Supported Individual, organization affiliation, professional credentials where applicable
• Care content: shift logs, mood entries, behavior notes, goal progress, photos, voice recordings, and written updates you create within UCL
• Supported Individual information: name (or chosen display name), date of birth, preferences, goals, support needs, IPP details, and other information you choose to include
• Communications: messages you send to other team members, peer support posts, and support requests to UCL

Information Collected Automatically:

• Usage data: pages visited, features used, time spent, and interaction patterns
• Device information: device type, operating system, browser, IP address, and general location (city/region)
• Log data: timestamps, error reports, and security events

Information From Third Parties:

• Agency integrations: if your agency connects UCL to scheduling, payroll, or EHR systems, we may receive relevant coordination data
• Authentication providers: if you sign in through Google, Apple, or a similar service, we receive basic profile information

4. How We Use Information

We use information to:

• Provide the Service and coordinate care among team members
• Authenticate users and maintain account security
• Deliver notifications, reminders, and Shared Focus updates
• Improve features based on usage patterns (always in aggregate, never to identify you)
• Comply with legal obligations
• Communicate with you about your account, the Service, and relevant updates

5. How We Share Information

We share information only as described below:

With Your Care Team: UCL is designed for coordinated care. Information is shared with team members based on roles you and your organization configure. For example, a DSP shift log is visible to the family and agency administrators by default; a family-only note is not visible to DSPs.

With Your Agency or Program: If a Supported Individual is served by an agency using UCL, that agency has access to records generated within the scope of their service. This is how care coordination works.

With Service Providers: We use trusted vendors for hosting, analytics, error monitoring, email delivery, and similar functions. These vendors are contractually required to protect information and use it only to provide services to UCL. Our current primary vendors include: [cloud hosting provider], [email provider], [analytics provider]. A current list is available on request.

For Legal Reasons: We may disclose information when required by law, subpoena, or court order; to protect the safety of users; to investigate fraud or abuse; or to enforce our Terms of Service.

In Business Transfers: If UCL is acquired, merges with another company, or undergoes a similar transaction, information may transfer as part of that deal. We will notify users in advance.

6. HIPAA Considerations

Unity CareLink is designed to be HIPAA-aligned. We follow HIPAA administrative, physical, and technical safeguards, but we do not hold a formal HIPAA certification (which does not exist as a government-issued credential).

For agencies that qualify as Covered Entities or Business Associates under HIPAA, UCL offers a Business Associate Agreement (BAA) as part of agency-tier subscriptions. Families and individual DSPs using UCL directly are not typically covered by HIPAA in their personal use of the Service.

7. Children's Privacy

UCL supports care for individuals of all ages, including minors with IDD. Because we collect information about Supported Individuals who may be under 13, we comply with the Children's Online Privacy Protection Act (COPPA) as follows:

• We collect information about minor Supported Individuals only with verified consent from a parent, legal guardian, or authorized agency.
• We do not knowingly allow minors to create accounts as primary users.
• We do not use minor Supported Individual information for advertising, marketing, or any purpose outside of coordinated care.
• Parents and legal guardians may review, update, or delete their minor's information at any time by contacting [email protected].

8. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: request a copy of the personal information we have about you
• Right to Delete: request that we delete your personal information
• Right to Correct: request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: not applicable, because we do not sell or share personal information
• Right to Limit Use of Sensitive Personal Information: request limits on how sensitive information is used
• Right to Non-Discrimination: we will not discriminate against you for exercising your rights

To exercise these rights, email [email protected]. We will respond within 45 days.

9. Your Rights (All Users)

Regardless of location, you may:

• Access the information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated information
• Export your data in a portable format
• Opt out of non-essential communications

Requests can be made in-app under Settings → Privacy, or by emailing [email protected].

10. Data Retention

We retain account information for as long as your account is active. Care content may be retained longer when required by law, by your agency's record-keeping obligations, or by the service model.

When you delete your account, we remove personal information within 30 days, except:

• Information your agency is required to retain for regulatory or audit purposes
• De-identified aggregate data that cannot reasonably identify you
• Information we must keep to comply with legal obligations

11. Security

We use industry-standard security practices including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls
• Regular security audits and penetration testing
• Employee access logging and background checks
• Incident response procedures

No system is perfectly secure. If we discover a breach that affects you, we will notify you and relevant regulators as required by law.

12. International Users

UCL is designed for California-based IDD/HCBS coordination. Our servers are located in the United States. If you access UCL from outside the U.S., your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

13. Changes to This Policy

When we update this policy, we will post the new version with a revised "Last Updated" date. Material changes will also be communicated by email to account holders at least 30 days before taking effect.

14. Contact Us

Questions, concerns, or rights requests:

• Email: [email protected]

15. SMS Communications

Unity CareLink LLC may send SMS (text) messages to phone numbers you provide, including:

• One-time verification codes and two-factor authentication messages
• Account security alerts and login notifications
• Care coordination notifications relevant to your account

Consent: By providing your phone number and requesting a verification code, you consent to receive SMS messages from Unity CareLink LLC for account authentication and security purposes.

Opt-Out: Reply STOP to any SMS message to opt out at any time. After opting out, you will no longer receive SMS messages from us, though this may affect your ability to use certain security features.

Help: Reply HELP to any SMS message for assistance, or contact us at [email protected]

Message & Data Rates: Message and data rates may apply depending on your mobile carrier and plan.

No Third-Party Sharing: We do not sell, share, or rent your phone number to third parties for their marketing purposes.