Privacy Policy

Last updated: June 30, 2026

This Privacy Policy explains how DSPLife™ Collaborative Group ("DSPLife," "we," "us") collects, uses, protects, and shares information in connection with CareHub ("the Service"). By using the Service, you agree to the practices described here.

1. Who This Policy Covers

CareHub is software for licensed IDD and behavioral-health providers. This policy covers (a) the people at provider organizations who use CareHub ("Users"), and (b) visitors to our marketing website. Information about the individuals receiving services is entered and controlled by the provider organization; for that data we act as a service provider on the organization's behalf (see Section 6).

2. Information We Collect

• Account information. Name, email address, role, organization, and credentials you provide when you sign up or are invited.
• Service data you enter. Records you create in CareHub, which may include protected health information (PHI) such as individual records, daily notes, medication administration records, incident reports, and plans. This data belongs to your organization.
• Billing information. Subscription and payment details, processed by our payment provider. We do not store full card numbers.
• Usage and device data. Log data such as IP address, browser type, pages viewed, and timestamps, used to operate, secure, and improve the Service.
• Cookies. See our Cookie Policy for details.

3. How We Use Information

• To provide, maintain, and secure the Service;
• To authenticate users and enforce access controls;
• To process subscriptions and billing;
• To provide customer support and respond to requests;
• To monitor performance, prevent abuse, and improve features;
• To send service-related and, where permitted, product updates;
• To comply with legal obligations.

4. How We Share Information

We do not sell your information. We share information only as needed to run the Service:

• Service providers (subprocessors). We use trusted infrastructure and tooling providers — including Supabase (database and authentication), Vercel (application hosting), Stripe (payment processing), and Google Workspace (email delivery) — who process data on our behalf under their own security and confidentiality obligations.
• Within your organization. Data is visible to authorized users in your organization according to their role and permissions.
• Legal and safety. When required by law, to protect rights and safety, or in connection with a corporate transaction.

5. Protected Health Information & HIPAA

CareHub is built for providers who handle PHI. When your organization stores PHI in the Service, DSPLife acts as a business associate, and a Business Associate Agreement (BAA) governs our handling of that PHI. We use PHI only to provide the Service and as permitted by the BAA and applicable law — never to advertise or sell. A BAA is available on request.

6. Data Controlled by Your Organization

Your provider organization controls the service data it enters, including individual records. Requests to access, correct, export, or delete that data should be directed to your organization, which administers it. We assist organizations in fulfilling such requests.

7. Data Security

We use industry-standard safeguards, including encryption in transit, role-based access controls, row-level data isolation between organizations, and audit logging. No method of transmission or storage is completely secure, but we work continuously to protect your information.

8. Data Retention

We retain information for as long as your account is active and as needed to provide the Service, comply with legal and regulatory recordkeeping obligations, resolve disputes, and enforce our agreements. On termination, data is handled in accordance with your agreement and any applicable BAA.

9. Your Choices

• Update your account information from within the Service or by contacting your organization administrator.
• Opt out of non-essential product emails using the unsubscribe link; service-related messages may still be sent.
• Control cookies through your browser settings.

10. Children's Privacy

CareHub is a workplace tool intended for use by provider staff and is not directed to children. Information about minors who receive services is entered by the provider organization in its role as the data controller.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by additional notice.

12. Contact Us

Questions about this Privacy Policy or our data practices? Email support@dsplifecollaborative.com.