Privacy Policy

Effective Date: June 14, 2026  ·  PivotWorks Group LLC  ·  Wayzata, MN 55391

PivotWorks Group LLC ("PivotChart," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use the PivotChart care management platform ("Platform").

1. Information We Collect

We collect the following categories of information:

• Account Information: Name, email address, agency name, state, and role when you create an account.
• Clinical Data: Patient records, care notes, schedules, and other data you enter into the Platform. This data belongs to your agency and is governed by HIPAA when it constitutes Protected Health Information (PHI).
• Usage Data: Log files, feature usage, browser type, IP address, and session duration collected automatically to improve the Platform.
• Communications: Emails, support requests, and feedback you send to us.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Platform
• Authenticate your identity and manage your account
• Send transactional emails (account setup, password reset, billing notices)
• Respond to support requests
• Monitor for security threats and unauthorized access
• Comply with legal obligations
• Generate aggregated, de-identified analytics to improve platform features

We do not sell your data to third parties. We do not use PHI for marketing purposes.

3. HIPAA and Protected Health Information

PivotChart is designed to support HIPAA-compliant workflows. When your agency has executed a Business Associate Agreement (BAA) with PivotWorks Group LLC, we act as a Business Associate with respect to PHI you store on the Platform. We implement administrative, physical, and technical safeguards required by the HIPAA Security Rule.

PHI is never used for advertising, sold, or shared with third parties except as required to provide services to your agency or as required by law.

4. Data Sharing

We share your information only in the following circumstances:

• Service Providers: We use third-party vendors (including Supabase for authentication and Medplum for FHIR-based clinical data storage) who process data on our behalf under data processing agreements.
• Legal Requirements: We may disclose information if required by law, court order, or government authority.
• Business Transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

5. Data Storage and Security

Your data is stored on HIPAA-eligible cloud infrastructure in the United States. We use encryption in transit (TLS 1.2+) and at rest. Access to clinical data is restricted by role-based permissions and organization-level tenant isolation.

No system is 100% secure. We encourage you to use strong passwords and notify us immediately at support@pivotchartmn.com if you suspect a security incident.

6. Data Retention

We retain your account and clinical data for as long as your account is active or as needed to provide services. After account termination, we retain data for 90 days to allow for export requests, after which it is securely deleted unless longer retention is required by law.

7. Cookies and Tracking

The Platform uses session cookies strictly necessary for authentication and security. We do not use third-party advertising cookies or tracking pixels on the Platform. Our public marketing website (pivotchartmn.com) may use analytics tools to measure traffic. You may disable cookies in your browser settings; however, this may affect Platform functionality.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access and receive a copy of the data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict certain processing
• Data portability — request an export of your agency's data

To exercise any of these rights, contact us at support@pivotchartmn.com. We will respond within 30 days.

9. Children's Privacy

The Platform is intended for use by healthcare agency professionals. We do not knowingly collect personal information from individuals under 18 years of age.

10. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before material changes take effect. The updated policy will be posted at this URL with a new effective date.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us:

• Email: support@pivotchartmn.com
• Phone: (612) 814-6466
• Mail: PivotWorks Group LLC, Wayzata, MN 55391