CareOneX Privacy Policy
Last updated: June 10, 2026
CareOneX ("we," "us") provides scheduling, electronic visit verification (EVV), and care
documentation software for home care agencies. This policy describes what information the
CareOneX web and mobile applications collect, how it is used, and the choices you have.
CareOneX is used by home care agencies (our customers) to manage their staff and clients;
we process information on their behalf.
Information we collect
- Account information. Name, email address, role, employer (agency),
certifications, work preferences, and an optional profile photo.
- Location information. The mobile app records your device's GPS
coordinates at the moment you check in and check out of a scheduled visit, as required for
electronic visit verification of home care services. With your permission, the app also uses
background location to detect when you leave a client's home during an active visit so it can
remind you to check out. Location is not collected when you do not have an active visit.
- Visit and care information. Visit schedules, check-in/check-out times,
care tasks and notes, reasons for skipped tasks or early/late checkout, and photos or
documents you attach to a visit as part of the care record.
- Device and usage information. Device type, push notification token, and
security/audit logs of access to records (required for healthcare compliance).
How we use information
- To operate scheduling, visit verification, and care documentation for your agency.
- To verify that home care visits occurred at the right time and place (EVV), which may be
required by state Medicaid programs.
- To send notifications related to your visits (reminders to check in or check out).
- To maintain tamper-evident audit logs required for healthcare compliance (HIPAA).
- To secure accounts and prevent unauthorized access.
How information is shared
- With your agency. Your employer (the home care agency that gave you your
account) can see your schedule, visit records, check-in/check-out times and locations, and
care documentation.
- With government programs and payers. Where required, visit verification
records may be reported to state Medicaid EVV systems or payers for billing and compliance.
- Service providers. We use cloud infrastructure (Amazon Web Services) and
authentication (Auth0/Okta) providers to run the service. They process data on our behalf
under contractual safeguards.
- We do not sell personal information, and we do not use it for advertising.
Health information
Visit and care records may include protected health information (PHI) about agency clients.
CareOneX handles this information in accordance with HIPAA, including encryption in transit and
at rest, role-based access controls, and audit logging. CareOneX acts as a business associate
of the home care agencies that use the platform.
Data retention
Care and visit records are retained as required by healthcare recordkeeping laws (typically
at least six years). Account information is retained while your account is active and as
required for compliance after deactivation.
Security
Data is encrypted in transit (TLS) and at rest. Access requires authentication with
multi-factor authentication enforced. Access to records is logged in a tamper-evident audit
trail.
Your choices
- You can decline location permissions in your device settings; however, GPS check-in is
required to verify visits, so your agency may require it for visit documentation.
- You can disable push notifications in your device settings.
- To access, correct, or delete your information, contact your agency administrator or
email us at the address below. Note that healthcare records may be subject to mandatory
retention periods.
Children
CareOneX is a workplace application for adult caregivers and agency staff and is not
directed to children under 13.
Changes
We will update this policy as the service evolves and revise the "Last updated" date above.
Contact
CareOneX
Email: support@careonex.com