Privacy Policy

Effective October 10, 2026

swiftEVV handles two very different kinds of information, and this policy is honest about the difference: patient records we process on behalf of home care agencies, and account information we collect ourselves from the people who use the product.

1. Patient records (PHI), processed for agencies

Clinical and billing records in swiftEVV, patient charts, medications, visit notes, schedules, claims, belong to the home care agency that created them. For that data, swiftEVV is a business associate under HIPAA: we process it only to provide the service to the agency, under a Business Associate Agreement. We never sell PHI, never use it for advertising, and never share it except with the subprocessors below or as the law requires.

If you are a patient or family member: your relationship is with the agency that provides your care, they are the record owner. Requests to see or correct your records go to your agency, which can fulfill them using the platform. We support agencies in meeting those obligations but cannot alter a provider’s records on our own.

2. Account information, collected by us

For the people who sign in, we collect what the service needs to run: name, work email, role and agency, authentication records (including sign-in attempts, for security), actions taken in the product (as audit logs), and for paying customers, billing details handled by our payment processor, card numbers never touch our servers. We use this to operate, secure, and support the service and to send service communications. We do not sell personal information and we do not use it for third-party advertising.

3. Subprocessors

We use a small set of infrastructure providers. Those that can touch PHI are required to sign Business Associate Agreements:

This list changes only with our vendor review process; the current list always appears here.

4. Security

Data is encrypted in transit and at rest; every agency’s data is isolated from every other’s; access to patient records is logged; and our full, current security posture, including what is implemented versus in progress, is published at the Trust Center. We say there exactly what is true, and nothing more.

5. Retention and deletion

Uploaded processing files are retained per the customer’s plan (14 to 180+ days). Clinical records are retained for the life of the customer relationship, because agencies are legally required to keep them. When an agency leaves swiftEVV, the records it owns are deleted from the application in a single audited operation. Access-audit logs are retained for six years, separately from the content they describe. Account holders can request deletion of their account data at the address below.

6. If something goes wrong

If a security incident affects PHI, we notify the affected agencies without unreasonable delay, and in no case later than 60 days after discovery, so they can meet their own notification duties to individuals and regulators. Incident procedures are part of our written security program.

7. Your choices

Account holders may access, correct, or request deletion of their account information by emailing us. Patients and families: contact your agency, which owns your care records. The service is for professional use by agencies and their staff; it is not directed at children, though agencies use it to document care for pediatric patients, those records are PHI handled under Section 1.

8. Changes and contact

We will post updates here and notify account administrators of material changes. Questions, requests, or anything that looks wrong: support@swiftevv.com.