CareFlow Technologies — Data Security and Retention Overview

Effective Date: August 7, 2026 Last Updated: August 7, 2026

---

Purpose of This Document

Home care agencies entrust CareFlow with employee records that include Social Security numbers, employment eligibility documentation, and health assessments. This document describes how that information is protected.

It is written for agency owners, administrators, and compliance officers evaluating CareFlow. It is a summary, not a contract. Our binding commitments are in the Terms of Service and Privacy Policy.

1. What We Store

We store: caregiver and applicant records, training progress and results, certificates, and — for agencies using CareFlow Plus — employment documentation including Social Security numbers, Form I-9 information, Form W-4 information, health assessment responses, and direct deposit details.

We do not store: health information about your clients. CareFlow Training is a workforce platform. It does not hold care plans, visit notes, or patient records.

We do not store: full payment card numbers. Payment card data is handled directly by our payment processor.

2. Encryption

In transit. All connections to the Service are encrypted using industry standard transport encryption.

At rest. Stored data is encrypted at rest by our infrastructure provider.

Field-level encryption. The most sensitive fields receive an additional layer of encryption applied by the application before storage:

• Social Security numbers
• Form I-9 Section 1 payloads, including date of birth and identity document details

These are encrypted using AES-256-GCM. They are stored in dedicated, access-controlled tables separate from general records.

3. Access Control

Agency isolation. Every record belongs to exactly one agency. Access rules are enforced at the database layer through row-level security, not only in the application interface. An administrator at one agency cannot see another agency's records.

Role-based permissions. Within an agency, access depends on assigned role. Roles include agency owner, agency administrator, compliance coordinator, read-only viewer, and caregiver. A caregiver sees their own training. A read-only viewer cannot modify records.

Confidential record segregation. Health assessments, I-9 records, and payroll records are held in separate access-controlled areas. Access to each requires a specific grant, tracked independently. Being an agency administrator does not automatically grant access to every confidential category.

CareFlow personnel access. Our staff access customer data only when necessary to provide support, investigate an incident, or comply with law. Such access is logged.

4. Audit Logging

The Service maintains audit records of security-relevant activity, including:

• Access to and changes affecting confidential records
• Application status changes and lifecycle transitions
• Administrative actions, including who performed them, when, and under what role
• Authentication events

Audit records are append-only and are retained for compliance and security purposes.

5. Availability and Backup

The Service runs on managed cloud infrastructure with automated backups. Backups are encrypted.

We do not currently offer a contractual uptime guarantee. Any such commitment would be established in a separate written agreement.

6. Data Retention

While active. Your data is retained for as long as your subscription is active.

After cancellation.

Deletion includes all sensitive employment documentation. It is permanent and cannot be reversed.

What we retain longer: billing and transaction records, security audit logs, and anything required to be kept by law. These are held in the minimum form necessary.

7. Your Retention Obligations

Important. CareFlow is not your system of record for legally mandated retention.

Federal law requires employers to retain Form I-9 documentation for a defined period after hire or termination. Employment, tax, and state licensing records carry their own requirements. Those obligations belong to your agency as the employer.

Export and retain your own copies of any records you are legally required to keep. This is true whether or not you remain a customer.

8. Regulatory Context

HIPAA. CareFlow Training stores employee health assessments as employment records held by an employer. Employment records held by an employer in its role as employer are generally outside the scope of HIPAA's protected health information rules. CareFlow Training does not store client protected health information.

If your agency believes a Business Associate Agreement is required for your specific circumstances, contact us and we will evaluate the request.

This is not legal advice. Determining your regulatory obligations is your responsibility. Consult your own counsel or compliance advisor.

Training content and survey readiness. CareFlow Content is designed to support common home care training requirements. It is not certified or approved by any regulatory body unless expressly stated. You remain responsible for confirming that the training you deliver satisfies the requirements applicable to your agency, state, and payers.

9. Security Incidents

If we become aware of a security incident affecting personal information, we will notify affected agencies without undue delay and in accordance with applicable law.

Agencies are responsible for any notifications required to their own employees, applicants, or regulators.

10. Reporting a Vulnerability

If you believe you have found a security vulnerability in the Service, email support@careflowtraining.com with the subject line "Security." Please do not publicly disclose the issue until we have had a reasonable opportunity to address it.

Do not test the security of the Service without our prior written consent. See the Acceptable Use section of the Terms of Service.

11. Contact

CareFlow Technologies Email: support@careflowtraining.com Web: app.careflowtraining.com

---

CareFlow Technologies