Privacy Policy

1. Introduction

Fair Care Plus ("we," "our," or "us") is committed to protecting your privacy and the confidentiality of your health information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our mobile application, website, and services (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our Service.

2. Information We Collect

2.1 Protected Health Information (PHI)

We collect the following types of Protected Health Information:

• Personal Identifiers: Name, email address, phone number, date of birth, employee ID
• Health Information: Medical receipts, procedure codes (CPT, ICD-10, HCPCS), diagnosis codes, provider information, service dates, treatment amounts
• Financial Information: Reimbursement amounts, payment history, benefit plan details
• Account Information: User credentials, account settings, preferences

2.2 Automatically Collected Information

• Device Information: Device type, operating system, unique device identifiers
• Usage Data: App usage patterns, features accessed, time spent in app
• Technical Data: IP address, browser type, access times, error logs

2.3 Camera and Storage Access

Our app requests access to your device's camera and photo library to allow you to upload receipt images. We only access these features when you explicitly choose to upload a receipt. Images are processed securely and stored in encrypted cloud storage.

3. How We Use Your Information

We use your information for the following purposes:

• Service Provision: To process receipt uploads, calculate reimbursements, and manage your benefit account
• OCR Processing: To extract information from receipt images using automated text recognition
• Reimbursement Processing: To verify eligibility, calculate reimbursement amounts, and process payments
• Account Management: To create and manage your account, authenticate users, and provide customer support
• Compliance: To comply with legal obligations, including HIPAA requirements
• Improvement: To analyze usage patterns and improve our Service (using de-identified data)
• Security: To detect and prevent fraud, abuse, and security threats

4. How We Share Your Information

4.1 With Your Employer

We share your reimbursement information with your employer or benefit plan administrator to process claims and manage your benefits. This includes receipt amounts, reimbursement calculations, and benefit utilization data.

4.2 With Service Providers

We may share information with third-party service providers who assist us in operating our Service:

• Cloud Storage: Google Cloud Platform (Firebase) for secure data storage
• OCR Services: For receipt text extraction (processed securely)
• Payment Processors: For reimbursement payments (if applicable)
• Analytics: Firebase Analytics for app usage analysis (de-identified data)

All service providers are bound by confidentiality agreements and HIPAA Business Associate Agreements (BAAs) where applicable.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, including:

• Compliance with HIPAA and other healthcare regulations
• Response to legal process or government requests
• Protection of rights, property, or safety
• Investigation of fraud or security issues

4.4 We Do NOT Sell Your Information

We do not sell, rent, or trade your Protected Health Information to third parties for marketing purposes.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest
• Access Controls: Role-based access controls limit who can view your information
• Authentication: Secure authentication and authorization mechanisms
• Audit Logging: Comprehensive audit logs track all access to your information
• Regular Security Reviews: Ongoing security assessments and updates
• Business Associate Agreements: All third-party vendors handling PHI are bound by BAAs

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to maintaining the highest standards.

6. Your Rights Under HIPAA

You have the following rights regarding your Protected Health Information:

• Right to Access: Request copies of your health information
• Right to Amend: Request corrections to inaccurate information
• Right to an Accounting: Request a list of disclosures of your information
• Right to Request Restrictions: Request limitations on how we use or disclose your information
• Right to Confidential Communications: Request alternative methods of communication
• Right to File a Complaint: File a complaint if you believe your privacy rights have been violated

To exercise these rights, please contact us using the information provided in the "Contact Us" section below.

7. Data Retention

We retain your Protected Health Information for as long as necessary to provide our Service, comply with legal obligations, resolve disputes, and enforce our agreements. Healthcare records are typically retained for a minimum of 6 years as required by law, or longer if required by your employer's benefit plan.

When you request account deletion, we will securely delete or de-identify your information in accordance with HIPAA requirements, except where retention is required by law.

8. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We may also notify you via email or through the app for significant changes.

Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

10. Breach Notification

In the event of a security breach that may have compromised your Protected Health Information, we will notify you and the appropriate authorities as required by HIPAA. Notifications will be provided without unreasonable delay and in accordance with applicable law.

11. International Users

Our Service is primarily designed for users in the United States. If you are accessing our Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where our servers are located.

12. Contact Us

13. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information (we do not sell personal information).