Privacy Policy — Visiting Systems

Effective date: July 1, 2026

This Privacy Policy explains what information Visiting Systems ("we," "us," "our") collects through the Visiting Systems scheduling and visit-verification application (the "Service"), how we use it, and the choices available to home care agencies ("Agencies"), their caregivers ("Caregivers"), and their clients ("Clients") whose information passes through the Service.

1. Information We Collect

We collect the following categories of information:

Account information: name, email address, role (admin or caregiver), and a securely hashed password for each user an Agency creates.
Client information entered by the Agency: name, address, and approximate coordinates used to verify visit location.
Visit and verification data: scheduled and actual visit times, and precise GPS coordinates captured at caregiver check-in and check-out (and only at those two moments — the Service does not track location continuously).
Usage data: basic technical logs (e.g., timestamps of API requests) needed to operate and troubleshoot the Service.

2. How We Use Information

To operate core features: scheduling, GPS-based check-in/check-out, automatic exception flagging (e.g., late start, location mismatch, short visit), and payroll export.
To authenticate users and protect accounts.
To maintain and improve the Service, including diagnosing technical issues.
To communicate with Agency administrators about their account or the Service.

3. Data Sharing & Third Parties

We do not sell personal information or precise geolocation data. We share data only with the following categories of third parties, and only as needed to operate the Service:

Hosting and infrastructure providers that store and process data on our behalf, under their own security commitments.
Future Medicaid EVV aggregator(s) (e.g., the Texas TMHP aggregator) — only after an Agency opts into Medicaid-funded visit submission, and only for visits the Agency designates as Medicaid-funded. This functionality is not active in the current version of the Service.
Service providers who help us operate the business (e.g., payment processing), bound by confidentiality obligations.
Where required by law, legal process, or to protect the rights, safety, or property of Visiting Systems, our users, or the public.

4. Data Security

Passwords are stored using salted PBKDF2 hashing (not reversible plaintext). Session tokens are signed (JWT) and expire automatically. We use TLS encryption in transit for all data, and sensitive fields (such as client addresses and care notes) are encrypted at rest using authenticated AES encryption, with keys stored separately from the database. Database backups are encrypted before they leave our servers. Access is role-based with strict per-agency isolation, and administrative actions are recorded in an audit log. For a fuller description of our safeguards, see our Security page.

5. Data Retention

We retain Agency, Caregiver, Client, and visit data for as long as an Agency maintains an active account, and for a reasonable period afterward to allow account recovery and meet any legal recordkeeping obligations. An Agency may request deletion of its data by contacting us (see Section 8); we will delete data within a reasonable time after verifying the request, except where retention is required by law.

6. Your Rights & Choices (Including Texas Residents)

Precise geolocation data is classified as "sensitive data" under the Texas Data Privacy and Security Act (TDPSA) and similar state privacy laws. We do not sell sensitive data, so the TDPSA's consent-to-sell requirement does not apply to our current practices; if that ever changes, we will obtain affirmative consent first. Depending on your state of residence, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing. To exercise any of these rights, contact us using the information in Section 8.

7. Children's Privacy

The Service is intended for use by home care agencies, their administrative staff, and their caregivers, and is not directed to children. We do not knowingly collect personal information from children under 13.

8. Contact Us

Questions about this Privacy Policy or requests regarding your data can be sent to: support@visitingsystems.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated effective date, and for material changes, will provide additional notice to Agency administrators.