Home Scarlet is software that home care agencies use to run their operations: scheduling, client and caregiver records, visits, billing, hiring, and communication. Home Scarlet is operated by Aloha Senior Home Care (“we”, “us”). This policy explains what information we handle, why, and the choices you have.
It covers this website (homescarlet.com) and the Home Scarlet application.
1. Who is responsible for which information
Most information in Home Scarlet is entered by a home care agency about its own clients, caregivers, staff and business contacts. For that information the agency decides how it is used, and we process it on the agency’s behalf and under its instructions. If you are a client, family member, caregiver or job applicant of an agency, please contact that agency first about your information.
For information we collect for our own purposes — for example when you request a demo, or the account details of an agency’s administrator — we are responsible.
2. Information we handle
Information you give us directly
- Contact details you submit through this website (name, work email, phone, agency name, your message).
- Account details for people who sign in: name, email address, role, and a password that is stored only in hashed form.
Information an agency stores in the application
- Client records, which can include health information needed to deliver care.
- Caregiver and staff records, schedules, visit records, timesheets and documents.
- Business contacts and prospective clients, and the emails, text messages and call records exchanged with them through the application.
- Billing records. Payment card numbers are handled by a payment processor; we do not store full card numbers.
Information collected automatically
- Security and audit records: sign-ins, and a log of sensitive actions taken in an agency’s account.
- Basic technical information needed to deliver the service, such as IP address and browser type.
3. Google user data
A person who signs in to Home Scarlet can choose to connect their own Google account so that meetings they schedule in Home Scarlet are placed in their Google Calendar with a Google Meet link. Connecting is optional and each person connects only their own account.
What we access
- Your Google account email address (the
emailandopenidpermissions), so we can show which account is connected. - Permission to view, create, change and delete calendar events in your Google Calendar (the
calendar.eventspermission).
We do not request access to Gmail, Google Drive, Google Contacts, or any other Google data.
How we use it
- To create a calendar event (with a Google Meet link, and optionally an invitation to the person you are meeting) when you schedule a meeting in Home Scarlet.
- To delete that event when you cancel the meeting in Home Scarlet.
- To show you your own upcoming and recent calendar events on your Meetings page, so your whole day is in one place. They are read from Google each time you open the page and shown only to you.
- To avoid double-booking you: when someone uses your agency’s public booking page, a time is not offered if your calendar shows you are busy then. Only whether you are busy is used — nothing about the event (its title, who it is with, or any detail) is shown to anyone or stored.
We only create and remove the events you schedule or cancel through Home Scarlet. Your other calendar events are displayed to you and nothing more: we do not store, copy, analyse, change or share them, and your colleagues cannot see them.
What we store
- Your Google account email address.
- An authorization token issued by Google, stored encrypted, which lets us act on your calendar until you disconnect.
- For each meeting you schedule here: its title, start and end time, the Google event identifier, and the Meet link.
Sharing
We do not sell Google user data. We do not share it with third parties, except with the service providers that host Home Scarlet for us and only as needed to run the service, or where the law requires it. We do not use Google user data for advertising, and we do not use it to develop, improve or train generalized artificial-intelligence or machine-learning models.
Limited Use
Home Scarlet’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting and deleting
You can disconnect at any time in Home Scarlet under Meetings → Your Google Calendar → Disconnect. When you do, we ask Google to revoke our access and we delete the stored authorization token. You can also remove access from your Google Account under Security → Third-party access. Meetings already placed in your calendar stay there until you delete them. To have the records of meetings scheduled through Home Scarlet deleted, contact us at the address below.
4. Bank account information
An agency owner may choose to connect a bank account to Home Scarlet so they can see what is being spent on what. The connection is made through Plaid, a bank-data provider, and is read-only: Home Scarlet cannot move money, make payments or change anything at your bank.
- What we receive: the name of your bank, the name and last digits of each account you choose to share, and that account’s transactions (date, amount, merchant and the bank’s own description and category).
- What we never receive: your bank username or password. You type those into your bank’s or Plaid’s own window, not into Home Scarlet.
- What we store: the items above, and an access token issued by Plaid, stored encrypted, which lets us read new transactions until you disconnect.
- Who can see it: an account marked business is visible to the people in your agency who are permitted to see its expenses. An account marked personal is visible only to the person who connected it — not to administrators, not to other owners — and is never included in an agency report.
- How we use it: only to show you your own ledger and summaries of it. We do not sell it, use it for advertising, or share it, except with the service providers that host Home Scarlet for us and only as needed to run the service, or where the law requires it.
- Stopping: you can disconnect a bank at any time. We tell Plaid to end the connection and erase the access token. Personal transactions are deleted when you disconnect; business transactions remain as the agency’s record until the agency deletes them or closes its account.
Plaid handles your information under its own privacy policy, available at plaid.com/legal.
5. How we use information
- To provide the service an agency has asked for, and to keep it secure and working.
- To send the messages the service exists to send — for example schedule reminders and account notices.
- To respond to you when you contact us.
- To meet legal obligations.
We do not sell personal information.
6. Health information
Agencies may store protected health information in Home Scarlet. The application is built with HIPAA-ready safeguards — encryption, role-based access and audit trails — and a Business Associate Agreement is available for eligible customers. Each agency remains responsible for its own compliance with HIPAA and other laws that apply to it.
7. Service providers
We use other companies to run parts of the service. They receive only what they need for that purpose:
- Cloud hosting and storage (Amazon Web Services).
- Email delivery (Twilio SendGrid).
- Phone calls and text messages (Twilio).
- Payment processing (Stripe).
- Google, when a user chooses to connect Google Calendar, and for address look-up (Google Maps).
- AI providers, for optional writing and summarising features. An agency can choose not to use these features.
8. Security
Sensitive fields and files are encrypted (AES-256), connections use TLS, access is limited by role, and sensitive actions are recorded in an audit log. No system is perfectly secure; if we learn of a breach that affects your information we will notify the affected agency, and individuals where the law requires.
9. Keeping and deleting information
We keep an agency’s information for as long as the agency has an account, and afterwards for as long as the agency instructs or the law requires. Home care records often have legally required retention periods, which the agency determines. Website enquiries are kept for as long as needed to respond and to keep a record of the conversation.
10. Your choices and rights
Depending on where you live, you may have the right to ask for a copy of your personal information, to have it corrected or deleted, or to object to certain uses. If your information was entered by an agency, ask that agency; we will help the agency respond. Otherwise, contact us. California residents: see also our California privacy notice.
11. Children
The service is for businesses and is not directed to children under 13. We do not knowingly collect information from them.
12. Changes to this policy
We will post any changes on this page and update the date at the top. If a change is significant we will tell agency administrators.
13. Contact
Privacy questions and requests: support@notify.homescarlet.com
Aloha Senior Home Care, San Diego, California, USA