Privacy Policy

Effective date: [EFFECTIVE DATE]

This policy explains how [COMPANY LEGAL NAME] ("we", "us") handles personal information when you use Havaspot (the "Service"), a website where Arizona care homes show their current openings and placement agents find them.

Havaspot is operated in the United States and the homes on it are in Arizona. This draft is written for US federal and Arizona law. [COUNSEL TO CONFIRM WHICH STATE PRIVACY LAWS APPLY, FOR EXAMPLE IF ANY USERS ARE IN STATES WITH COMPREHENSIVE PRIVACY LAWS, OR IN THE UK OR EU.]

Who is responsible for your information

[COMPANY LEGAL NAME], a [ENTITY TYPE] formed in [STATE OF FORMATION] (entity number [ENTITY NUMBER]), registered address [REGISTERED ADDRESS]. Privacy questions go to [CONTACT EMAIL].

What we collect

When you sign in

Care home managers

Agents and placement teams

Messages

Check-in texts

Home listings from public records

Automatically

What we never want on Havaspot

Havaspot is not built to hold information about residents, patients or families. Please do not put a resident's or prospective resident's name, date of birth, diagnosis, medical records or photo in a listing, a photo or a message. See the Acceptable Use Policy. We are not a covered entity or business associate under HIPAA. [COUNSEL TO CONFIRM.]

Why we use it

• To run your account and sign you in.
• To show care homes' openings to agents, and to pass messages between them.
• To send the emails you rely on: sign-in links, message notifications, reminders to homes that have not answered, and digests you asked for.
• To send check-in texts to care home contacts who agreed to receive them.
• To keep the Service secure, prevent abuse and fix problems.
• To understand, in aggregate, whether the Service is working, so we can improve it.
• To meet legal obligations.

If UK or EU data protection law applies to you, we rely on: performance of a contract (running your account and the Service), legitimate interests (security, product measurement, showing public licence facts about care homes), consent (where we ask for it, such as check-in texts), and legal obligation. [COUNSEL TO CONFIRM WHETHER THIS PARAGRAPH IS NEEDED.]

We do not sell your information

We do not sell personal information and we do not share it for targeted advertising. Havaspot has no paid listings and no advertising.

Who we share it with

We use service providers who handle information only to run Havaspot for us:

• Supabase: database, sign-in and photo storage.
• Cloudflare: hosting and network delivery.
• Resend: sending email.
• PostHog: product measurement, limited to the named events above.
• Apple iMessage: check-in texts are sent from an Apple ID we operate.
• OpenStreetMap tile servers: the map's background images. Your browser requests them directly, so the tile server sees your IP address.

[COUNSEL TO REVIEW EACH PROVIDER'S TERMS AND DATA LOCATION. CONFIRM WHETHER ANY DATA IS STORED OUTSIDE THE US.]

We also share information when the law requires it, to protect people's safety, or as part of a sale or reorganization of our business, in which case this policy continues to apply.

How long we keep it

• Account information: while your account is open, and [RETENTION PERIOD] after you ask us to close it.
• Messages: [RETENTION PERIOD]. [DECIDE AND IMPLEMENT A MESSAGE RETENTION PERIOD.]
• Check-in contacts and replies: while the contact is on file, and [RETENTION PERIOD] after removal. Opt-out records are kept so we never text that number again.
• Product events: [RETENTION PERIOD].
• Hosting logs: as set by our hosting provider, [RETENTION PERIOD].

Security

Every table in our database has access rules that decide who may read or change each row, and changes that matter go through checks of who is asking. Information travels over encrypted connections. No system is perfectly secure; if a breach affects your personal information, we will tell you as the law requires, including Arizona's breach notification law.

Your choices and rights

• See and correct your account details on the Account page, or ask us.
• Ask for a copy of your personal information, or ask us to delete it, by writing to [CONTACT EMAIL]. We will reply within [RESPONSE PERIOD].
• Turn digest emails off on the Account page, or with the one-tap unsubscribe link in any digest.
• Stop check-in texts by replying STOP.

Depending on where you live, you may have further rights under your state's law, or under UK or EU law. [COUNSEL TO LIST STATE-SPECIFIC RIGHTS IF THEY APPLY.] We will not treat you differently for using them.

Complaints

Please contact us first at [CONTACT EMAIL]. You can also complain to the Federal Trade Commission or the Arizona Attorney General's Office. If UK data protection law applies to you, you can complain to the Information Commissioner's Office. [COUNSEL TO CONFIRM THE RIGHT REGULATORS.]

Children

Havaspot is for care home staff and placement professionals. It is not meant for anyone under 18 and we do not knowingly collect information from children.

Changes

We will post changes here with a new effective date, and tell account holders by email about changes that matter.