Privacy Policy

1. The short version

• FacilityDash is sold to treatment facilities. Staff of a facility use it. Clients, the people in care, do not have accounts.
• Client records are under the control of the facility. If you are a client and want to see, correct or get a copy of your record, ask your facility. If you write to us instead, we will pass your request on to the facility.
• We do not sell personal information, and we do not use client records for advertising.
• Every read and every change of client information in the product is recorded in an access log that is kept for at least six years.
• This website has no advertising trackers.
• Please never send client information to us by email or through the form on this website.

2. Who we are and what this covers

FacilityDash is made and run by App Me Developers LLC ("we", "us", "our"). It is a record and operations system for behavioral health and substance use treatment facilities: the client record, the census and bed board, admissions, consents and the back office.

This policy covers three things:

• this website;
• the FacilityDash product, in a web browser and in the staff apps for iPhone and Android;
• messages you send to our support address.

This policy is not a facility's Notice of Privacy Practices. Each facility gives its clients its own notice, and that notice describes how the facility uses and shares health information.

3. Client records: your facility decides

A facility that uses FacilityDash keeps its client records in it. Under the federal health privacy law known as HIPAA, the facility is the "covered entity": it decides what is recorded, who may see it, and when it may be shared. We act as the facility's "business associate" under a written business associate agreement. That means we handle client information only to provide the service to the facility, as that agreement and the law allow.

We do not sell client information. We do not use it for advertising or to build profiles of people.

4. Substance use treatment records

Records of substance use treatment are protected by a second federal rule, 42 CFR Part 2, which is stricter than HIPAA about sharing. FacilityDash is built around it:

• Before a record protected by Part 2 leaves the product as a report, a download or a shared document, the product checks that a current consent covers that release.
• A release that no current consent covers is refused, and the refusal is recorded.
• Each release is written down as a disclosure, so the facility can show what left, when, and under which consent.

The facility decides which of its records fall under Part 2 and collects the consents. The product enforces the check.

5. The access log

Every time someone reads or changes client information in FacilityDash, the product records who did it, when, and which client records were involved. The product has no way to edit or delete an entry. The log is kept for at least six years. A facility's administrators can review it.

6. Information about staff

If your facility gives you a FacilityDash account, the product holds information about you as a member of staff:

• your name and work email address;
• your role and permissions at each facility you belong to;
• sign-in and security details, such as your second sign-in step and your signed-in devices;
• a record of what you did in the product, including the access log entries and the signatures on documents you signed;
• work records your facility chooses to keep in the product, such as schedules, time clock entries, timesheets and policy acknowledgements.

Your facility decides who gets an account and what each person may do. We use this information to run the service for your facility, to keep it secure and to answer support requests.

To close your account, see Delete your account.

7. The staff apps

The iPhone and Android apps are for staff who already have an account from their facility. They are built for phones that are shared, set down or lost:

• Nothing from the record is stored on the device. The app keeps only what it needs to stay signed in and to work: a sign-in token held in the phone's secure storage, a key for unlocking, an identifier for the installation, the token used to deliver notifications, the last facility you chose, and settings that hold no client information.
• Notifications never carry client names. A notification says there is something to do. Notifications are delivered through Apple's and Google's notification services.
• Face or fingerprint unlock stays on your phone. The phone checks your face or fingerprint. We never receive it.
• The camera. A photo you take in the app, such as an ID or an insurance card, is sent to the record and is not kept on the phone afterward.

The apps ask for permission to use the camera, to send notifications and to use face or fingerprint unlock. You can refuse any of them in your phone's settings.

8. The assistant

FacilityDash includes an assistant that answers questions from the record, such as the census for a date.

• It acts with the permissions of the person asking. It cannot see more than that person can.
• What it reads is recorded in the access log, marked as read by the assistant for that person.
• Licensed assessment content, meaning published instruments a facility uses under license, is kept out of it.
• It does not diagnose, choose a dose or choose a level of care.

To answer, the assistant sends the question and the information it looked up to an AI model provider. We do not turn the assistant on for a facility that holds real client records until an agreement that covers protected health information is in place with that provider. Staff are asked not to type client names or dates of birth into a question. Conversations are kept for 90 days.

9. This website and email to us

The walkthrough request

The form on the home page asks for a work email address and your number of licensed beds. If you send us those details, through the form or by email, we use them to arrange the walkthrough and to reply to you. Please do not put client information in the form.

Your theme choice

If you switch between the light and dark theme, your choice is saved in your browser's local storage so the site looks the same on your next visit. It stays in your browser and is not sent to us.

No advertising trackers

This website does not use advertising trackers or advertising cookies, and we do not sell or share visitor information for advertising.

Server logs

Like most websites, the servers that deliver this site keep standard logs. A log entry usually holds the visitor's IP address, the date and time, the page requested, the page that linked to it, and the type of browser and device. The logs are used to keep the site working and secure. The provider that delivers the site may also use technical measures, which can include a security cookie, to protect it from abuse.

Email to support

When you write to our support address we receive your email address and whatever you put in the message. We use it to answer you and to fix problems. Never include client information in an email to us. See Support for what to include and what to leave out.

10. How we use information

• To provide FacilityDash to the facilities that subscribe to it.
• To keep the service secure, find and fix faults, and prevent misuse.
• To answer support requests and walkthrough requests.
• To send service messages, such as sign-in and security notices.
• To meet our legal obligations and our agreements with facilities.

The emails and notifications the product sends carry identifiers and counts. They do not carry client names.

11. Who we share information with

We do not sell personal information. We share information only as follows.

• With your facility. A facility's administrators can see the accounts, permissions and activity of their staff, and the records of their clients.
• With partners a facility connects. When a facility sets it up, the product exchanges information with the services that facility uses, such as a prescribing service, a claims clearinghouse or a laboratory. The facility chooses those partners.
• When the law requires it. We may disclose information when a law or a valid legal order requires it. For client information we follow HIPAA, 42 CFR Part 2 and our agreement with the facility, which limit what we may disclose and to whom.
• In a business transfer. If our business is merged, sold or reorganized, information may pass to the new owner, which must keep honoring this policy and our agreements with facilities.

12. Where information is kept

The product's database, its backups, its stored files and its logs are hosted in the United States.

13. How we protect information

• Each facility's data is separated from every other facility's inside the database.
• Every request is checked on the server against the permissions of the person making it. A facility can limit access down to single fields.
• Signing in requires a second step.
• Information is encrypted when it travels and when it is stored.
• The product does not store Social Security numbers.
• Every read and change of client information is logged, as described in section 5.

No system can be guaranteed secure. If we learn of a breach of client information, we notify the affected facility as our agreement with it and the law require.

14. How long we keep information

• Client records. The facility decides, within the law and its agreement with us. We keep them for the facility for as long as the agreement runs, and handle them at the end of the agreement as it sets out.
• The access log and the record of disclosures. At least six years.
• Staff accounts. Closing an account ends access. Records the facility must keep, such as signed documents and the access log, stay and remain attributed to the person. See Delete your account.
• Assistant conversations. 90 days.
• Walkthrough requests and support email. For as long as we need them to answer you and to keep a record of what was agreed.

15. Your choices and rights

• Clients. Your rights to see, correct and get a copy of your record are exercised through your facility. See section 3.
• Staff. Ask your facility's administrator to correct your account details or to close your account. You can also ask to close it from inside the product.
• Website visitors and people who wrote to us. You can ask us what we hold about you, and ask us to correct or delete it, by writing to the address in section 20.

Depending on where you live, the law may give you further rights. We will honor the rights that apply to you.

16. Children

This website and FacilityDash accounts are for businesses and their adult staff. They are not directed to children, and we do not knowingly collect information from a child through this website. A facility may keep records about clients of any age. Those records are handled as section 3 describes.

17. Visitors from outside the United States

FacilityDash is run from the United States and is offered to facilities in the United States. If you visit this website from another country, the information described in section 9 is handled in the United States.

18. Links to other sites

This website may link to sites we do not run, such as the app stores. Their own privacy policies apply there.

19. Changes to this policy

We may update this policy. When we do, we post the new version on this page and change the effective date at the top. If a change is significant, we also tell the facilities that use FacilityDash.

20. Contact us

App Me Developers LLC
Email: [email protected]

Please do not include client information in an email to us.