Privacy Policy

1. Introduction

CaseMgmt (“we,” “our,” or “us”) is committed to protecting the privacy of our users and the individuals whose information is managed through our platform. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website at casemgmt.io and use our case management platform.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, phone number, company name, and billing information. This information is necessary to provide our services.

Protected Health Information (PHI)

Our platform is used to manage patient case information, which may include Protected Health Information as defined by HIPAA. We process this information solely on behalf of our customers (covered entities) and in accordance with our Business Associate Agreement (BAA).

Usage Data

We automatically collect certain information about your device and usage of our services, including IP address, browser type, operating system, pages visited, and time spent on our platform.

Cookies & Tracking Technologies

We use essential cookies required for the platform to function, including session cookies and authentication tokens. We do not use third-party advertising cookies or tracking pixels.

3. How We Use Your Information

• To provide, maintain, and improve our case management platform
• To process billing and subscription management
• To send transactional emails (account confirmations, billing receipts, security alerts)
• To send SMS messages for appointment reminders, care coordination, and video call links (with patient consent)
• To provide customer support
• To comply with legal obligations, including HIPAA requirements
• To detect and prevent fraud, abuse, or security incidents
• To generate anonymized, aggregate analytics to improve our services

4. HIPAA Compliance

CaseMgmt operates as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). We enter into a Business Associate Agreement (BAA) with each customer who uses our platform to manage Protected Health Information (PHI).

We implement administrative, physical, and technical safeguards as required by the HIPAA Security Rule, including encryption of PHI at rest and in transit, access controls, audit logging, and workforce training.

5. Data Sharing & Subprocessors

We do not sell, rent, or trade your personal information. We share information only with the following categories of recipients:

Authorized Subprocessors

We use the following subprocessors to provide the Service. Each is bound by a Business Associate Agreement (where PHI is involved) and a Data Processing Agreement:

We provide 30 days' notice before engaging any new subprocessor that will process PHI. The current list is also available in our Business Associate Agreement.

Other Disclosures

• Legal compliance: When required by valid legal process (subpoena, court order, or regulatory request). We will notify the affected customer unless legally prohibited.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with continued protection under this Policy and your BAA.
• With your consent: When you explicitly authorize disclosure.

5a. Breach Notification

In the event of a breach of unsecured Protected Health Information, we will notify the affected customer (covered entity) without unreasonable delay and in no case later than 60 days after discovery, in accordance with HIPAA §164.410. Our notification will include the information required under §164.410(c), including the individuals affected (if known), the nature of the PHI involved, and the steps individuals should take to protect themselves from potential harm.

For non-PHI security incidents affecting customer accounts, we will notify the affected account holder via email within 72 hours of incident confirmation.

6. Data Security

We implement administrative, physical, and technical safeguards required by the HIPAA Security Rule (§164.308-312), including:

• AES-256 encryption for sensitive fields at the application layer (SSN), plus AES-256 disk encryption on all database and S3 storage
• TLS 1.2+ for all data in transit; HSTS with preload directive on the public endpoint
• Role-based access controls with five roles plus per-user permission overrides
• Multi-tenant data isolation enforced at the application query layer
• Audit logging capturing user, IP, user-agent, timestamp, and affected record for PHI access
• Automatic session timeout after 30 minutes of inactivity, with an 8-hour maximum session (HIPAA §164.312(a)(2)(iii))
• Single-session enforcement preventing concurrent logins from different devices
• Rate limiting on authentication endpoints to prevent brute force
• Mass-assignment protection on all data modification endpoints
• Server-side HTML sanitization on outbound communications
• File upload validation with extension blocklist and size limits
• Server-side header injection protection on email sending
• Regular vulnerability assessment and remediation

7. Data Retention

We retain your account information for as long as your account is active or as needed to provide services. Patient and case data managed through the platform is retained according to your organization's retention policies and applicable regulatory requirements. Upon account termination, we will delete or de-identify your data within 90 days, unless retention is required by law.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access and receive a copy of your personal data
• Request correction of inaccurate data
• Request deletion of your personal data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent at any time

To exercise any of these rights, please contact us at privacy@casemgmt.io.

9. Children's Privacy

Our platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If patient records include information about minors, such data is managed by the covered entity in accordance with applicable laws.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or sending an email to your registered email address. Your continued use of the platform after changes constitutes acceptance of the updated policy.

11. SMS Messaging

CaseMgmt may send SMS text messages to patients who have provided consent through a signed Medical Case Management Agreement, verbal consent documented by their case manager, or through our web portal registration process. Messages include appointment reminders, video call links, and care coordination updates. We do not send marketing or promotional messages.

Message frequency varies based on the patient's care plan (typically 1-5 messages per month). Message and data rates may apply. Patients may opt out at any time by replying STOP to any message or contacting their case manager. For help, reply HELP or email admin@casemgmt.io.

Phone numbers are stored securely and shared only with our SMS delivery provider (Twilio) for message delivery. For full details, see our SMS Consent Policy.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: