Privacy Policy

1. Introduction

POCDesk ("we," "our," or "us") is committed to protecting the privacy and security of information processed through our platform. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our Plan of Correction automation platform and public information pages.

This policy applies to all users, including facility administrators, compliance staff, other authorized personnel, and visitors to our public tools and educational resources. Uploaded content may contain Protected Health Information (PHI). A privacy policy is not a Business Associate Agreement (BAA), a HIPAA certification, or authorization to upload PHI. Confirm the applicable agreements, safeguards, and your organization's authorization before submitting sensitive information.

2. Information We Collect

Account Information: Name, email address, organization/facility name, and role. Used for authentication, communication, and account management. Authentication is provided through Clerk.

Survey and Clinical Data: CMS-2567 survey documents, deficiency narratives, F-Tags, POC responses, compliance dates, and related clinical content uploaded by users. This data may contain PHI. Remove resident-identifiable information before submitting content unless you have verified that the service is authorized for that use.

Audit and Compliance Data: Audit log entries (which may include resident names, room numbers, and clinical outcomes), training records, staff information, and compliance calendar events.

Usage Data: IP addresses, browser type, access timestamps, pages visited, and feature usage patterns. Collected automatically for security monitoring, analytics, and platform improvement. Cookies, similar browser storage, and third-party scripts may collect identifiers and device or interaction information.

PHI Access Logs: Where access logging is implemented, records may include user identity, action performed, resource accessed, and timestamp. This policy does not guarantee that every access is logged or that logging alone satisfies HIPAA requirements.

3. How We Use Your Information

• Service Delivery: To provide POC generation, compliance tracking, audit management, and platform features.
• AI Processing: To send context such as F-Tags, deficiency narratives, organization settings, and user-provided content to OpenAI, directly or through Replit's AI integration, for generating POC response suggestions. Submitted narratives or documents may contain personal or clinical information; we cannot promise that all resident identifiers are automatically removed. Review and de-identify content before using AI features.
• Security and Compliance: To maintain available audit trails, detect unauthorized access, administer access controls and session protections, and support compliance work. These measures do not establish HIPAA compliance by themselves.
• Communication: To send transactional emails, such as account messages, sharing invitations, and deadline reminders, using SendGrid or authentication-provider email services as applicable.
• Analytics: To provide aggregate analytics and benchmarking to administrators and understand public-site usage through Google Analytics and Ahrefs Analytics. Aggregated reports do not mean that the underlying collection is anonymous.

4. Data Sharing and Disclosure

We use service providers and may disclose information as described below. Advertising and analytics services may collect identifiers and browsing activity; we do not make a blanket promise that no disclosure could qualify as a sale, sharing, or targeted advertising under applicable privacy law.

• Service Providers: Third-party services assist in hosting, database operations, authentication, email delivery, AI processing, analytics, and other platform operations. Their processing is subject to the applicable service terms and any agreements actually in place. We do not represent that all providers have signed BAAs or that every integration is authorized to process PHI.
• Authorized Users: When you share surveys or POC responses with colleagues through the platform's sharing features.
• Legal Requirements: When required by law, court order, or regulatory authority, or to protect the rights, property, or safety of POCDesk, our users, or others.
• Analytics and Advertising Providers: As described in Sections 8 and 12, providers may receive technical information when their scripts, cookies, pixels, fonts, or map services load.

5. Data Security

Security controls may include encryption provided by hosting and database infrastructure, encrypted transport, authentication and credential protections, session controls, account access restrictions, security headers, access logging, and ownership-based data scoping. Their coverage and configuration depend on the service and deployment.

We do not warrant a specific encryption algorithm, password-hashing work factor, lockout threshold, session duration, complete audit coverage, or absolute tenant isolation through this policy. Clerk manages authentication under its own security practices. No internet service or storage system can guarantee complete security. Confirm required safeguards and contractual protections with us before using the Platform for PHI.

6. Data Retention

We retain information to operate the service, support account access and data export, maintain security records, and meet applicable legal or contractual obligations. Retention varies by data type, provider, and backup lifecycle. We cannot promise that all data and backups are permanently deleted within 30 days of account closure.

HIPAA documentation requirements may require certain records to be kept for six years where applicable (45 CFR § 164.530(j)); this does not establish a verified six-year retention schedule for every PHI access log in this service.

You may request data export or deletion by contacting privacy@pocdesk.com. Applicable legal requirements, authorization checks, service-provider retention, and backup cycles may limit or delay deletion. Confirm any required export or deletion schedule before closing your account.

7. Your Rights

Depending on your location, role, and applicable law, you may request:

• Access: A copy of your personal data and authorized access to PHI stored in the platform.
• Correction: Correction of inaccurate personal data.
• Deletion: Deletion of your data, subject to legal retention requirements.
• Export: Export of your survey data and POC responses in supported formats, such as PDF or CSV.
• Audit Trail: Access to available PHI access logs pertaining to your organization's data.
• Restrict Processing: Limitations on how your data is processed, including applicable advertising choices in Section 12.

Requests may require verification of identity and authority. For resident records controlled by a healthcare facility, contact that facility as well. Send requests without PHI to privacy@pocdesk.com.

8. Third-Party Services

The Platform uses or conditionally integrates the following external services. A listed integration does not mean it is active on every page or that it has an executed BAA:

• Clerk: Authentication, account identity, sessions, and related account communications. Clerk may process account details, device information, and authentication cookies.
• Replit: Application hosting, database infrastructure, and AI integration. Platform data, technical logs, and AI requests may pass through these services.
• OpenAI: AI-assisted POC response generation. Submitted context can include user-provided narratives and documents. OpenAI's API terms and data handling policies apply to data sent to its services; do not assume automatic removal of PHI.
• SendGrid: Transactional email delivery. Email addresses, user names, and notification content may be processed. Do not include PHI in email messages or notification fields.
• Google Analytics: The public application includes Google's analytics script to measure page views and interactions. It may process identifiers, device and browser information, and browsing activity using cookies or similar technologies.
• Ahrefs Analytics: The public application includes an Ahrefs analytics script to measure website traffic and usage. Technical request and page-view information may be processed.
• Meta and LinkedIn: Meta Pixel and LinkedIn Insight Tag load only when their respective configuration identifiers are supplied. When enabled, they may process page visits, device identifiers, cookies, and advertising attribution information. Their availability in the code is not a statement that either is currently configured.
• Google Fonts: The site requests externally hosted font styles and files from Google Fonts domains. Those requests disclose technical information, such as IP address and browser request headers, to the font provider.
• OpenStreetMap and routing services: Interactive facility maps request map tiles from OpenStreetMap. Tour-planning features use OpenStreetMap-related routing services, including routing.openstreetmap.de. Map or route requests may disclose IP addresses, viewed map areas, and selected locations or route coordinates to those providers.
• Google Maps links: If you open a Google Maps directions link from the tour planner, the selected route locations are passed to Google Maps. Google's terms and privacy policy apply when you visit that external service.

External providers operate under their own privacy policies and terms. Review them before using an integration. This policy does not guarantee that third-party services are suitable for PHI or that signed BAAs exist.

9. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we learn that we have collected information from a child under 18, we will take steps to delete such information promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or in-platform notification. The revision notice at the top of this policy identifies the most recent update. Continued use of the Platform after changes constitutes acceptance, except where applicable law requires separate consent.

11. Contact Information

For privacy-related inquiries, data requests, or to report a concern:

• Privacy and data requests: privacy@pocdesk.com
• Compliance, HIPAA, and BAA questions: compliance@pocdesk.com

Do not send PHI, resident identifiers, passwords, or clinical documents by email. Request an appropriate secure communication method first.

12. Cookies, Google Advertising, and Your Choices

Authentication and service functionality may use cookies and similar storage. Google Analytics and any configured marketing pixels may also use cookies or identifiers for measurement and attribution.

Advertising readiness is not active advertising: This disclosure prepares the site for possible Google advertising, including AdSense. It does not assert that AdSense has approved the site, that Google ads are currently being served, or that personalized advertising is currently enabled. Google Analytics already included in the application is separate from activating Google ads.

If Google advertising is enabled, third-party vendors, including Google, may use cookies to serve ads based on a user's previous visits to this website or other websites. Google's use of advertising cookies enables Google and its partners to serve ads based on visits to this site and/or other sites on the Internet. Such ads may be personalized according to browsing activity and applicable settings and consent requirements.

You can opt out of personalized advertising by visiting Google Ads Settings. You can also learn about and opt out of participating third-party vendors' use of cookies for personalized advertising at aboutads.info/choices. These choices may apply only to the browser or device used and do not necessarily remove all advertising.

You can manage or delete cookies through your browser settings. Blocking cookies may affect sign-in and other features. You can also review how Google uses information from sites that use its services and the Google Analytics opt-out browser add-on. Advertising opt-outs are distinct from analytics controls. This page does not itself implement a consent-management tool or guarantee that all scripts wait for consent.