Privacy Policy

1. Information Stored on Our Platform

Customer Organizations may enter and store the following types of information using our platform. This data is controlled by and belongs to the Customer Organization, not AblePath.

1.1 Staff Information

• Account Information: Name, email address, phone number, date of birth, employee ID
• Employment Information: Job title, role, certifications, training records
• Identification: Driver's license number, Social Security Number (encrypted)
• Credentials: Professional certifications, background check status

1.2 Client Information (PHI)

• Name, address, date of birth, emergency contacts
• Care plans, preferences, and service notes
• Medication information and administration records
• Incident reports and health-related observations

1.3 Location Data

The platform collects precise location data when staff clock in or clock out of a shift (for EVV compliance) and during mileage tracking for reimbursement. When automatic mileage tracking is enabled, location is tracked continuously for the duration of the shift to calculate distance traveled. Location data is not used for any purpose other than EVV verification, mileage reimbursement, and billing. This data is stored for the Customer Organization's use.

1.4 Fax Records

When a Customer Organization uses fax features, the platform stores the faxed documents, sender and recipient fax numbers, page counts, and delivery status. Faxes are transmitted through a telecommunications service provider acting on AblePath's behalf.

1.5 Account Activity and Usage Information

The platform records limited usage information, such as which user accounts were active in a given month (signed in or recorded a clocked shift) and how many fax pages were sent and received. AblePath uses this information to operate the service and to calculate the Customer Organization's subscription charges.

2. How Data Is Used

AblePath does not use Customer Organization data for our own purposes, other than the limited account activity and usage information described in section 1.5, which we use to operate the service and bill the Customer Organization. Customer Organizations use the platform to:

• Provide and coordinate caregiving services
• Track work hours and process payroll
• Verify visits for EVV compliance and track mileage for reimbursement
• Manage medication administration records (MAR)
• Document and report incidents as required by law
• Send work-related notifications and messages
• Generate billing and service verification reports

AblePath only accesses Customer Organization data when necessary to provide technical support at the Customer Organization's request, to maintain and improve the platform's functionality, or to calculate subscription charges as described in section 1.5.

3. Data Security

We use administrative and technical safeguards designed to protect your data, including: encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, password hashing, session management, and audit logging of sensitive data access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

4. Data Sharing

AblePath does not sell Customer Organization data. We share it only with service providers who process it on our behalf for the core functionality of the features you use.

Customer Organizations may use the platform to share data with:

• Regional Centers: For service verification and billing
• Healthcare Providers: As necessary for coordinated care
• Government Agencies: As required by law

Any such data sharing is initiated and controlled by the Customer Organization, not by AblePath. Customer Organizations are responsible for ensuring their data sharing practices comply with applicable laws and regulations.

5. HIPAA Compliance

AblePath provides a platform designed to support HIPAA Privacy and Security Rules. We implement appropriate technical safeguards to protect data stored on our platform. Customer Organizations using our platform to store Protected Health Information (PHI) are responsible for their own HIPAA compliance, including entering into appropriate agreements with their staff, clients, and business associates.

AblePath offers a Business Associate Agreement (BAA) to every Customer Organization on every plan (Essentials, Professional, and Enterprise) at no additional charge.

6. California Privacy Rights (CCPA/CPRA)

If you are a staff member or client of a Customer Organization using AblePath, your California privacy rights (including the right to know, delete, correct, and non-discrimination) should be directed to the Customer Organization that manages your data. They are the data controller and can fulfill these requests.

AblePath, as a platform provider, will cooperate with Customer Organizations to help fulfill valid privacy requests.

7. Data Retention

Records stored on the platform, including employment and payroll records, client care records, incident reports, EVV and time entries, and medication logs, are retained for 7 years while the Customer Organization uses AblePath, to support its record-keeping requirements.

When an organization leaves AblePath: after a Customer Organization discontinues its business with AblePath, its data is deleted from the platform. The organization can export its data before its account is closed.

Exception: photos and images attached to messages are automatically deleted after 1 year by default. Customer Organizations can configure this period.

Customer Organizations remain responsible for their own data retention policies under applicable laws and regulations.

8. Contact Us

For questions about your personal data: Please contact the Customer Organization (your employer or care provider) that manages your information. They control the data and can address your inquiries.

For questions about this Privacy Policy or the AblePath platform: