Privacy Policy

CareYeti LLC ("CareYeti", "we", "us") Effective date: October 17, 2026

CareYeti provides electronic visit verification (EVV), scheduling, payroll and compliance software to home and community care agencies ("Agencies"). This policy explains what the CareYeti web app, mobile app and phone (IVR) line collect, why, who processes it for us, how long we keep it, and what you can ask us to do.

1. Who this applies to

• Agency staff and caregivers who sign in to CareYeti or clock in by phone.
• Clients (the people who receive care). Clients do not have a CareYeti login. Their information is entered by their Agency.
• Visitors to careyeti.com.

2. Our role: Agencies decide, CareYeti processes

For client and caregiver records, the Agency is in control of the data and CareYeti acts on the Agency's behalf. Where an Agency is a HIPAA covered entity, CareYeti is its business associate and handles protected health information (PHI) under a Business Associate Agreement (BAA) with that Agency. If you are a client or caregiver and want access to, or correction of, your records, ask your Agency first; we will help the Agency respond.

3. What we collect

Caregiver and staff information: name, email address, phone number, role, the Agency or Agencies you belong to, a password (stored only as a hash), multi-factor authentication settings, a caregiver PIN for phone clock-in, hire date, site assignments, pay rates, payroll entries, and training records and certificates.

Client information entered by the Agency: name, address, contact details, service plan and authorized services, case-manager details, visit notes, and uploaded documents. This is health information and is treated as PHI.

Visit and EVV data: the service type, the date and time of clock-in and clock-out (both the time your device reports and the time our server received it), visit duration, and any review or edit of those times by an administrator.

Location (GPS): when you clock in or out in the app, we record the device's GPS coordinates and its reported accuracy at that moment, so the visit can be verified against the client's service location as federal and state EVV rules require. We collect location at clock-in and clock-out only; the app does not track you continuously. You can refuse the location permission, but then the app may not be able to complete an EVV-compliant clock-in.

Phone and IVR data: if you clock in or out by phone, we process the calling phone number, the PIN or verification you enter, call time and call status, and a log of the call. The phone line is provided by our telephony provider (see section 5).

Text messages (SMS): if you give us your mobile number and agree to texts, we send sign-in codes, account setup links and schedule notices to it. Message frequency varies, message and data rates may apply, reply STOP to opt out, HELP for help. Mobile numbers and SMS consent are never shared with third parties for marketing. Details are in our SMS Terms.

Technical data: IP address, browser or device type and operating system, app version, date and time of access, the screens or endpoints used, and your user ID. We use it for security, audit trails and troubleshooting.

Offline use: if the app has no signal, clock events are held on your device and sent when it reconnects. Each event keeps the time your device recorded and the time our server received it.

Cookies: we use cookies and similar storage that are needed to keep you signed in and to remember settings such as language. We do not use advertising cookies or sell data to advertisers.

Visitors and demo requests: if you ask for a demo, we collect the details you type into the form (name, email and message).

4. How we use it

• To provide the service: verify visits, produce timesheets and payroll, and submit visit data to the state or payer EVV system (for example the HHAeXchange aggregator for Minnesota DHS) for the Agencies that use that feature.
• To keep the service secure, detect fraud and misuse, and keep audit trails.
• To send service emails (sign-in setup, password reset, notifications).
• To support you and to fix bugs.
• To meet legal and contractual obligations.

We do not sell personal information or PHI, and we do not use it for advertising or profiling.

5. Service providers (processors) we use

We share data only with providers that help us run the service, and only what each needs:

We sign a Business Associate Agreement with each Agency. We use, or will use, only providers that either sign a BAA with us or never receive PHI. We may also disclose information when the law requires it, to protect safety or rights, or in a merger or sale of the business (with notice to Agencies).

6. HIPAA

CareYeti operates as a business associate for Agencies that are covered entities. We use administrative, technical and physical safeguards for PHI, including encryption in transit, role-based access limited to the Agency's own data, audit logging, and encrypted backups. We use and disclose PHI only as the BAA and the law permit, and we will notify the affected Agency of a breach of unsecured PHI as the BAA and HIPAA require. Each Agency is responsible for its own HIPAA obligations, including its notice of privacy practices to clients.

7. How long we keep data

EVV, payroll and compliance records must be kept for years, so they outlive an individual login.

• Visit, EVV, payroll and audit-trail records: kept for at least 7 years. An Agency may set a longer period. Records past the period are deleted on a schedule, after any archive copy is made.
• Backups: encrypted nightly backups are kept for 35 days and then expire.
• Agencies that leave CareYeti: the Agency's data is placed on a retention hold and is not deleted until its retention period has run. Only then is it purged.
• Technical logs: kept only as long as needed for security and troubleshooting.

8. Your choices and rights

• Delete your account. Signed-in users can delete their own login from the app. To confirm, you type DELETE, enter your password, and enter the code from your authenticator app if you have multi-factor authentication turned on. If you are the only administrator of an Agency you cannot delete your own login: someone else must be made an administrator first. This removes your email, name, phone number, password, MFA settings, active sessions, notifications and chat history, and removes your memberships. Because of the retention rules above, we keep the records that must be preserved: visits you worked, EVV and location data, payroll and audit records, and your Agency's employee record, which is de-identified of your contact details (email and PIN removed) and marked inactive. Those records no longer link to a working login.
• Access and correction. Ask your Agency, or write to us and we will route the request to the Agency.
• Location. You can turn off the location permission in your device settings; see section 3 for the effect.

State privacy laws may give you additional rights. To the extent we act for an Agency, we will help the Agency respond.

9. Security

We use TLS in transit, hashed passwords, optional multi-factor authentication, per-agency data isolation enforced in the database, role-based access, audit logging and encrypted backups. No system is perfectly secure. Do not send PHI by regular email.

10. Children

CareYeti is not directed to children under 13 and we do not knowingly collect information from them. A client who is a minor is recorded by their Agency like any other client, under HIPAA and state law.

11. Changes

We will post changes on this page and update the effective date. For material changes we will notify Agencies.

12. Contact

CareYeti LLC 2688 Rice St, Unit #2159
Little Canada, MN 55113 Email: support@careyeti.com

For privacy questions or to route an access or deletion request, email us at the address above.