Privacy Policy

Effective date: June 15, 2026 Last updated: October 10, 2026

1. About this Policy

This Policy explains how Social Fabric Apps, doing business as Nodal Care Management ("Nodal Care," "we," "us," "our"), collects, uses, shares, and protects information when you visit nodalcare.com, use the Nodal Care Management application at app.nodalcare.com, or otherwise interact with us.

A note on HIPAA. Most clinical and care information we process in the Service is Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act ("HIPAA"). For PHI, we act as a Business Associate of the home care agency or other organization that gave you access to the Service (a "Customer"). The Customer is the Covered Entity (or upstream Business Associate) and is responsible for HIPAA Privacy Rule notices, authorizations, and patient-facing rights. Our handling of PHI is governed by our Business Associate Agreement with that Customer. This Policy describes what we do with information that is not PHI (website-visitor data, account login information, billing-contact information, marketing-list data) and gives a plain-language summary of how PHI is processed.

2. Who we are

Social Fabric Apps, doing business as Nodal Care Management 1736 Malvern St, Lauderdale, MN 55113-5236 Privacy contact: info@nodalcare.com Legal contact: info@nodalcare.com

We are a U.S. company. We do not currently serve customers in the EU, UK, or Canada and this Policy is not designed to satisfy the GDPR, the UK Data Protection Act, or Quebec Law 25.

3. Information we collect

3.1. Information our Customers' Authorized Users put into the Service. Information about a Customer's clients, employees, and operations — for example, client demographics, conditions, medications, mobility status, care-plan content; shift notes and incident reports; electronic visit verification (EVV) records (clock-in/out timestamps, GPS, signatures); uploaded documents (care plans, intake forms, clinical records). This information is PHI and/or other Customer Data; we process it on the Customer's behalf under our agreements with them.

3.2. Account and usage information. When an individual uses the Service we collect: name, email, phone, role within their tenant, hashed credentials, login timestamps, IP address, device and browser metadata (including, if you turn on push notifications, a push token that identifies your browser or device to Google's push service), and audit-log entries. Family/Client portal users are linked to a specific client record they are authorized to view. Product-usage records. The Service also records a small usage record in our own database when certain actions happen: a sign-in, a clock-in or clock-out, a shift being created, a shift report being submitted, and a payroll or billing export being run. Each record holds the agency, the acting user's account identifier and role, the time, the type of action, and only identifiers, counts and yes/no flags (for example, how many activities a report listed, or how many rows an export had) — never names, notes, locations, or other record contents. These records stay in our own database; they are not sent to any analytics or advertising company. We use them to operate the Service and, as aggregate counts across agencies, to see how much each feature is used. They contain no PHI, and we do not use them for advertising or to profile individuals.

3.3. Information from website visitors and prospects. When you visit nodalcare.com or contact us, we may collect: name, email, phone, organization, and message content; IP address; browser/device metadata (our servers keep these in standard request logs for a limited time, as described in §7); the anonymous page-view and button-click counts described in §7, which do not include your IP address or any visitor identifier. If you opt in to marketing communications, we collect your name and email for that list.

3.4. Children's data. The Service is used to coordinate care for adults — primarily seniors — and is not directed to children; care recipients are not direct end-users. We do not knowingly collect personal information directly from children under 13, and we rely on Customers (as Covered Entities) to obtain any consents required by HIPAA or applicable law.

4. How we use information

We use information to:

(a) Provide and operate the Service — host Customer Data, run scheduling and billing logic, send transactional email, send push notifications you have turned on, support EVV, run the Family/Client portal.

(b) Secure the Service — log events, detect and respond to intrusions or fraud, monitor errors and operational health through Google Cloud Error Reporting, Cloud Logging, and Cloud Monitoring (operating within our Google Cloud project under the Google Cloud BAA), maintain backups, and perform forensic investigations.

(c) Support Customers and their Authorized Users — respond to support requests, provide onboarding, troubleshoot, and communicate about the Service.

(d) Improve the Service — but only after information has been de-identified in accordance with HIPAA's de-identification standard (45 C.F.R. §164.514) and aggregated. We do not use PHI to improve the Service. We do not train, fine-tune, or otherwise develop foundation models or generally-applicable machine-learning models on Customer Data. We operate AI features only on configurations where the AI provider is contractually bound to a no-training restriction with respect to Customer Data, or limit AI processing to de-identified inputs.

(e) Comply with law — including HIPAA and any applicable state privacy laws, tax law, and lawful requests from public authorities.

(f) Bill Customers — invoice and collect through Stripe.

(g) Send transactional and, with consent, marketing communications — you can unsubscribe from marketing at any time by clicking the link in an email or emailing info@nodalcare.com.

(h) Provide AI-assisted features — for example, summarized leads, suggested schedules, extracted to-dos from shift notes, and document OCR. AI suggestions are reviewed by Authorized Users; we do not make automated decisions producing legal or similarly significant effects on individuals.

5. How we share information

We share information with the categories of recipients below. We do not sell or share Personal Information for cross-context behavioral advertising under CCPA/CPRA, and we do not engage in targeted advertising.

5.1. Our service providers (subprocessors). We use the providers listed in §8 to host, secure, and operate the Service. Each is bound by contract to handle information consistently with this Policy and, where applicable, our Business Associate Agreement obligations.

5.2. Our Customers and their Authorized Users. Information you provide is visible to authorized people within your Customer organization based on role-based access control (Owner, Admin, Manager, Caregiver, Family).

5.3. As required by law. We may disclose information when compelled by subpoena, court order, or other legal process, or where we reasonably believe disclosure is necessary to investigate, prevent, or respond to suspected illegal activity, fraud, threats to safety, or violations of our Terms.

5.4. Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify Customers and material categories of users where required.

5.5. With your direction. If you ask us to share information with a third party (for example, a partner integration), we will follow your direction.

We do not share PHI other than as permitted by HIPAA and our Business Associate Agreement with the relevant Customer.

6. Google API Services User Data Policy (Limited Use)

Nodal Care's use and transfer of information received from Google APIs (including Google Calendar) to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The Google Calendar integration is optional. When you choose to connect Google Calendar, we request only the access needed to synchronize your work shifts: permission to view your list of calendars and to view and manage events on the calendar you select. We use this access solely to create, update, and remove your scheduled-shift events — we do not read, store, or use the rest of your calendar's contents for any other purpose. You can disconnect the integration at any time from your profile in the Nodal Care application, or by removing Nodal Care's access in your Google Account security settings; disconnecting immediately revokes our access and deletes the authorization tokens we hold for you.

Specifically, consistent with the Limited Use requirements:

• We use information received from Google APIs only to provide or improve user-facing features that are prominent in the application's user interface.
• We do not transfer that information to third parties except as necessary to provide or improve those user-facing features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use that information to serve advertising.
• We do not allow humans to read that information unless we have your affirmative agreement, it is necessary for security purposes (e.g., investigating abuse), to comply with applicable law, or for internal operations and only on de-identified or aggregated data.

7. Cookies and similar technologies

We keep what is stored in your browser to the minimum needed to sign you in and keep the Service working. We do not use advertising cookies, we do not use analytics cookies, and we do not use any third-party analytics or tracking service. (The app's own usage records, kept in our database and not in your browser, are described in §3.2.)

(a) Strictly necessary — sign-in and security. When you sign in to app.nodalcare.com, we set one first-party cookie, careflow-session, that holds your current sign-in token so our servers can recognize you. It lasts up to 7 days and is removed when you sign out. Our sign-in provider (Firebase Authentication) also keeps your sign-in in your browser's own storage (IndexedDB or local storage) so that you stay signed in between visits. Google reCAPTCHA Enterprise, used through Firebase App Check to confirm that requests come from a genuine copy of our app, may store its own data in your browser under Google's terms.

(b) Functional — your settings. The app keeps your display preferences and similar settings in your browser's local storage (some are also saved to your account), and uses a service worker to keep copies of the app's program files so it loads quickly and can start on a poor connection.

(c) nodalcare.com. As far as we can tell from the pages and headers the site serves, nodalcare.com does not set cookies and does not load third-party scripts.

Website visit counts. To learn which pages and buttons on nodalcare.com people use, the website sends a small message to our servers when a page opens or a button is clicked. This uses no cookies and no third-party service. For each message we store only: the time; whether it was a page view or a button click; the page address without anything after a "?"; the name of the site the visitor came from (the site name only, not the full address); which button was clicked; and whether the visitor was on a phone or a computer. These records do not contain an IP address, a browser identifier, or any visitor identifier, so they count page views and clicks, not people. We delete them after 13 months.

Where your IP address does appear. Two places, neither of which is the visit-count records. First, to limit abuse, our systems keep a short code (a one-way hash) made from your IP address and the name of the feature being used, for a short counting window; it is deleted automatically, typically within about a day after the window ends. Second, Google Cloud's standard request logs for our servers record the IP address and browser type (user agent) of every request to app.nodalcare.com, including the visit-count messages sent by nodalcare.com, and keep them for 30 days.

Cookie banner. Because we do not use non-essential cookies or similar technologies, we do not show a cookie banner. If that changes, we will update this Policy and, where the law requires it, ask for your choice before using them.

We honor any Global Privacy Control (GPC) signal as a request to opt out of any "sale" or "sharing" of Personal Information (we do not sell or share, but we treat GPC as confirmatory).

8. Subprocessors

We engage the following subprocessors. We update this list when we engage a new subprocessor that processes Personal Information or PHI.

Push notifications (Firebase Cloud Messaging). Push notifications are optional and are sent only to a browser or device on which you have chosen to turn them on. When you do, your browser or device obtains a push token from Google's Firebase Cloud Messaging ("FCM") service; we store that token with your account, together with the type of device or browser, and use it to send you notifications through Google's push service (and, depending on your device or browser, the push service of Apple or of the browser's maker). Each notification consists of a short title and message and an in-app link, sometimes with an internal record number, that opens the relevant screen in the app, where you must sign in to see anything further. Because a notification can appear on a lock screen and passes through these push services, we write notifications from fixed templates that do not include the name of any client, family member, or caregiver, any diagnosis or care detail, or any text that a user has typed. A notification can say that something needs attention (for example, that a shift report is overdue, that a client health alert needs review without saying which client, or that a family member sent a message), can state a count, and can state the date or time of your own shift; notices about a service outage are written by us and contain no customer data. FCM is provided by Google under Google's own terms; it is not covered by a business associate agreement with us, and we do not use it to send PHI. You can turn push notifications off at any time in your browser or device notification settings; staff users can also switch some types of notification on or off in the app's notification settings.

Google Maps Platform. Two features use Google Maps Platform. First, when staff type a street address into an address field (for a client, an employee, or a shift), the Service offers address suggestions: as you type, your browser sends the text you have typed directly to Google (not through our servers) and, when you choose a suggestion, Google returns that place's full address, its components, its coordinates, and, for a named place, its name. A client's home address can be entered this way, and, as with any request from a browser, Google also receives technical information such as your IP address. Second, to calculate travel distance and drive time (for example, for mileage entries and travel-time estimates), our servers send pairs of latitude/longitude coordinates — and no names or address text — to Google and receive the distance and time back. Google processes this information under Google's own terms; Google Maps Platform is not covered by a business associate agreement with us.

9. Your privacy rights

Depending on where you live, you may have rights under U.S. state privacy laws to access, correct, delete, or receive a portable copy of Personal Information we hold about you; to opt out of any "sale" or "sharing" of Personal Information for cross-context behavioral advertising (we do not sell or share); to opt out of profiling that produces legal or similarly significant effects (we do not engage in such profiling); to limit the use of Sensitive Personal Information; and to non-discrimination for exercising these rights. In some states, you may also appeal a decision we make about your request.

To exercise a right, email info@nodalcare.com with the subject line "Privacy rights request" and tell us which right you are exercising and the email or account associated with the request. We will verify your identity and respond within the time the applicable law requires (typically 45 days, with one extension permitted in some states). You may use an authorized agent where the law permits.

If your information is PHI processed in the Service on behalf of a Customer, your HIPAA rights to access, amend, and obtain an accounting of disclosures are exercised through that Customer (the Covered Entity). Direct your request to that Customer's Privacy Officer; we will support the Customer in responding.

10. Security

We protect information using:

(a) Encryption at rest — dual-layer pattern.

• Application-layer envelope encryption (AES-256-GCM with per-tenant Data Encryption Keys wrapped by a Google Cloud KMS Key Encryption Key on automatic 90-day rotation) for high-sensitivity identifier fields: Power of Attorney, banking, insurance, conservator, and Social Security Number fields; OAuth and integration tokens; and audit-log values.
• Provider-managed at-rest encryption (Google Cloud's AES-256 default, covered by the Google Cloud BAA) for other Customer Data stored in Cloud SQL and Firebase Storage, including clinical observations, care-plan content, shift notes, EVV records, and Customer-uploaded documents.

(b) Encryption in transit — TLS 1.2 or higher for all client-server communication.

(c) Access controls — role-based access control across six roles (Owner, Admin, Manager, Caregiver, Family, and Platform-Admin); tenant isolation enforced at the API-route layer.

(d) Authentication — Firebase Auth with optional WebAuthn / passkey enrollment.

(e) Audit logging — all access to application-layer-encrypted fields is logged with action, actor, tenant, and timestamp.

(f) Backups — automated daily backups on Cloud SQL with point-in-time recovery per Cloud SQL configuration.

(g) Incident response — documented runbooks for cryptographic-key rotation and service-account compromise; HIPAA breach notification without unreasonable delay and no later than 60 days after Discovery, subject to the law-enforcement delay carve-out at 45 C.F.R. §164.412; other material non-HIPAA security incidents notified within 24 hours after our confirmation.

No service can guarantee perfect security, but we work hard to keep information safe.

11. How long we keep information

We keep information only as long as necessary for the purposes described in this Policy and as required by law:

• Customer Data (including PHI): for the duration of the Customer's subscription, plus a 30-day Customer export window; deletion from active production systems within 90 days of termination; backup expungement within an additional 30 days; certificate of destruction available on written request.
• Authorized User account information: until the Customer disables the user, plus a reasonable archival period.
• Google Calendar authorization tokens: retained only while the integration is connected; deleted when you disconnect the integration or revoke access in your Google Account.
• Website visitor and marketing list information: until you opt out or for the period set out in our retention schedule, whichever is shorter.
• Product-usage records (§3.2): we do not currently delete them on a schedule. They are not removed when an Authorized User's login is deleted or when an agency's data is purged after it leaves, because they contain only identifiers and counts and no PHI; after a purge the account identifier in them no longer points to any account.
• Records we are required to keep by law: for the period required by law.

12. Children's privacy

The Service is intended for home care agencies and their authorized adult staff to coordinate care for adult care recipients (primarily seniors). It is not directed to children, and we do not knowingly accept account registrations from, or collect personal information directly from, children under 13. If we learn that we have inadvertently collected such information, we will delete it.

13. International users

The Service is hosted in the United States. If you access it from outside the United States, you understand that information is processed in the United States.

14. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top will reflect when. If a change is material, we will give you notice on the website or by email. Continued use of the Service after the effective date of a change means you accept the change.

15. Contact us

For privacy questions, requests, or complaints:

Privacy contact: info@nodalcare.com Postal address: 1736 Malvern St, Lauderdale, MN 55113-5236

If you believe we have not addressed your concern, you have the right to contact your state attorney general's office or, where you have rights under HIPAA, the U.S. Department of Health and Human Services, Office for Civil Rights (https://www.hhs.gov/ocr/).