Privacy Notice

PRIVACY NOTICE

This privacy notice for RAVAD Software, LLC ("RAVAD," "we," "us," or "our") describes how we collect, use and share ("process") personal information when you use our services ("Services"), including:

• Our websites, ravadsoftware.com and support.ravadsoftware.com
• RAVAD Remote Support for Windows and Mac, including the Microsoft Store version
• Our mobile application RAVAD EVV
• Our software for care providers: Home Care, Adult Day Care, M-edi and RAVAD Docs

This notice replaces our earlier RAVAD EVV privacy notice. Questions or concerns? Contact us at contact@ravadsoftware.com.

SUMMARY OF KEY POINTS

This summary gives the key points of this notice; each section below has the details. You can also click here to go directly to our table of contents.

TABLE OF CONTENTS

1. 1WHAT INFORMATION DO WE COLLECT?
2. 2HOW DO WE USE YOUR INFORMATION?
3. 3WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
4. 4HOW LONG DO WE KEEP YOUR INFORMATION?
5. 5HOW DO WE KEEP YOUR INFORMATION SAFE?
6. 6DO WE COLLECT INFORMATION FROM MINORS?
7. 7WHAT ARE YOUR PRIVACY RIGHTS?
8. 8CONTROLS FOR DO-NOT-TRACK FEATURES
9. 9DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
10. 10DO WE MAKE UPDATES TO THIS NOTICE?
11. 11HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

01WHAT INFORMATION DO WE COLLECT?

In Short: We collect what you give us, what our apps need to work, and basic technical data.

Information you give us

When you contact us, request a demo or ask for support, we receive the details you provide, such as your name, email address, phone number, company and message. Website forms send this information to us by email; the website does not store it.

RAVAD Remote Support

RAVAD Remote Support lets an IT specialist help you after you share a six-digit code and select Allow. It processes:

• Session Information. To connect you with your specialist, our servers store the app's device identifier, your computer's name, the app version, and the session's status and times. The six-digit code and the connection token are stored only as one-way hashes.
• Specialist Accounts. For our technicians: a username, a display name and a password stored only as a one-way hash.
• Security Records. Events such as a session being created, approved or closed, or a download link being issued. Instead of your IP address, we keep a keyed one-way hash of it.
• Screen and Input. During an approved session, the app sends your screen and receives keyboard and mouse input. This traffic is encrypted and passes through our relay server when a direct connection is not possible. We do not record or store screen contents or keystrokes, and audio is not shared.
• Downloads. To protect downloads from abuse, your browser completes a small automated check and our server keeps short-lived counters per IP address, stored as keyed hashes. The download page sets no cookies and uses no analytics.

On a Mac, the app asks macOS for Screen Recording and Accessibility permission. These let a specialist see your screen and use the keyboard and mouse only during a session you approve.

RAVAD EVV

Caregivers use the RAVAD EVV mobile app to record visits as required by Colorado's Electronic Visit Verification (EVV) program. It processes:

• Location. With your permission, the app uses your device's location to verify visits, as the EVV program requires. You can change this permission in your device settings, but visits may then not be verified.
• Visit Records. Visit times, services, client and caregiver identifiers and verification data, which we send to the State of Colorado's EVV system as the program requires.
• Notifications. With your permission, the app may send push notifications about your account or visits. You can turn them off in your device settings.

The care agency you work for decides how this information is used; we process it on the agency's behalf.

Software for care providers

Home care agencies, adult day care centers, and home health and dental providers store client or patient, caregiver, care plan, visit, billing and document information in our Home Care, Adult Day Care, M-edi and RAVAD Docs software, including scanned timesheets and signatures used for signature verification. We process this information under our agreement with the provider. Where it includes protected health information (PHI), our Business Associate Agreement with the provider governs it under HIPAA, and that agreement controls if anything in this notice differs. Requests about this information should go to the provider; we help the provider respond.

Information collected automatically

Our web servers log the IP address, time, requested page and result of each request to keep the Services secure and working. We do not use advertising or analytics trackers.

02HOW DO WE USE YOUR INFORMATION?

In Short: We use information to provide and support the Services, keep them secure and comply with law, and de-identified data to improve our products.

We use personal information:

• To provide, operate and support the Services, including connecting you with your IT specialist.
• To answer your requests and communicate with you.
• To verify visits and support billing as agencies and Colorado Medicaid rules require.
• To keep the Services secure, prevent abuse and investigate incidents.
• To comply with our legal obligations.

De-identified and usage data

We also use information about how the Services are used and perform, and care-provider data that has been de-identified under HIPAA (45 C.F.R. § 164.514) so that it no longer identifies any person. We use it to operate, improve and develop the Services and our other products; to train and improve machine learning, artificial intelligence and analytics models, including signature verification; for analytics and benchmarking; and to create aggregated or de-identified data sets and insights, which we may share or commercialize. De-identified data is no longer protected health information.

03WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: Only with care providers and the State EVV program as described, with our service providers, and when the law requires it.

We share personal information only with:

• Care Providers and the State EVV Program. As described in section 1.
• Service Providers. Companies that host our servers or deliver our email, bound by confidentiality and security obligations. Those that handle protected health information agree in writing to the same restrictions as our Business Associate Agreement.
• De-Identified Data. Aggregated or de-identified data that does not identify any person, as described in section 2.
• Microsoft Store. Microsoft distributes the Store version of RAVAD Remote Support; Microsoft's privacy statement applies to the Store itself.
• Legal Reasons. Authorities or others when the law requires it, or to protect our rights, our users or others.
• Business Transfers. A buyer or investor in connection with a merger, sale of company assets, financing or acquisition.

We do not sell personal information or share it for targeted advertising.

04HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: Only as long as needed for the purposes in this notice, or as the law requires.

We keep:

• Remote Support Records. Session and security records for 90 days, download counters for one day.
• Web Server Logs. About two weeks.
• Messages and Contact Requests. As long as needed to answer and follow up, and no longer than two years.
• RAVAD EVV and Care-Provider Data. For the term of our agreement with the provider. After it ends, the provider can retrieve its data for 30 days, after which we may delete it; protected health information is returned or destroyed as our Business Associate Agreement requires.

When we no longer need information, we delete or anonymize it. Copies in backups are isolated and deleted in the normal backup cycle.

05HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We protect information with technical and organizational measures.

We use HTTPS for web traffic, encrypted remote support connections, one-way hashes for codes, tokens and passwords, role-based access and audit records. For protected health information we maintain the administrative, physical and technical safeguards HIPAA requires, and we notify the care provider of security incidents as our Business Associate Agreement requires. No transmission or storage method is completely secure, so we cannot guarantee absolute security.

06DO WE COLLECT INFORMATION FROM MINORS?

In Short: No. The Services are intended for adults and businesses.

We do not knowingly collect information from children under 18. If you believe we have, contact us at contact@ravadsoftware.com and we will delete it.

07WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on where you live, you can ask to access, correct or delete your personal information.

Depending on where you live, including under Colorado and California law, you may have the right to access, correct, delete or obtain a copy of your personal information, and to opt out of its sale, targeted advertising or profiling; we do none of these. To make a request, email contact@ravadsoftware.com. We will verify your request and answer within the time the law requires, and you can appeal our decision by replying to our answer. If a care provider controls the information, we will pass your request to that provider.

If you are in the European Economic Area, the United Kingdom or Switzerland, you may also complain to your local data protection authority.

08CONTROLS FOR DO-NOT-TRACK FEATURES

There is no common standard for Do-Not-Track signals, so we do not respond to them. We do not track you across other websites.

09DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes, as described here and in section 7.

California's "Shine the Light" law lets California residents ask, once a year and free of charge, which personal information we disclosed to third parties for their own direct marketing. We make no such disclosures. To ask, contact us using the details below.

10DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, as needed to keep it accurate and compliant.

We may update this notice. The date at the top shows the latest version. For material changes, we will post a notice on this page.

11HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, email us at contact@ravadsoftware.com or write to: