Privacy Policy

Horizon Care Systems ("Horizon", "we", "us", or "our") is committed to protecting the privacy and security of our healthcare partners, facility administrators, clinical therapy staff, and their patients. This Privacy Policy describes how we collect, use, store, and safeguard information when you visit our website (horizoncareops.com), use the Horizon Care Ops portal, or access our offline-first mobile application.

Horizon Care Ops serves as a Business Associate to Covered Entities (including skilled nursing facilities, long-term care organizations, home health agencies, and therapy providers) under the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act.

• Business Associate Agreements (BAAs): We execute standard BAAs with all Covered Entity customers prior to provisioning platform access.
• Handling of PHI: All Protected Health Information (patient profiles, Plans of Care, clinical session notes, treatment records) is processed strictly in accordance with HIPAA Security, Privacy, and Breach Notification Rules.
• Local/Isolated AI Processing: Audio dictation and AI clinical note generation (Whisper and LLM pipelines) execute within isolated customer application containers. Patient data is never transmitted to third-party public AI APIs or shared with external model trainers.

Unlike conventional multi-tenant cloud platforms that co-mingle customer data in shared tables, Horizon Care Ops provisions a dedicated database instance and application environment per customer organization. Your organization's data, encryption keys, network routes, and authentication services are completely isolated, eliminating any risk of cross-tenant data exposure.

We collect information required to deliver scheduling, PRN shift outreach, and clinical workflow tools:

Horizon Care Ops sends transactional SMS text alerts (PRN shift availability, magic-link login tokens, schedule changes, and MFA codes) to staff who have consented to receive mobile notifications.

You can opt out of text notifications at any time by replying STOP to any SMS message. For detailed opt-out and help instructions, visit our SMS & Email Opt-Out Policy.

• Encryption at Rest: Database storage and sensitive integration credentials are encrypted using AES-256-GCM. Passwords are hashed using memory-hard Argon2id.
• Encryption in Transit: All communications over public networks utilize TLS 1.3 encryption.
• Authentication & MFA: Support for SAML 2.0 / Microsoft Entra ID Single Sign-On and TOTP-based Multi-Factor Authentication.
• Immutable Audit Logging: System operations generate tamper-evident audit logs tracking user IDs, timestamps, and data modifications.

We use essential session tokens and local storage strictly to authenticate users and persist application preferences (such as dark/light mode and selected facility ID). We do not use third-party advertising cookies, cross-site tracking pixels, or data-broker scripts.

If you have questions regarding this Privacy Policy, your account data, or BAA execution, please contact our privacy compliance team: