Privacy policy

This Privacy Policy describes how UHHCA (United Home & Health Care Alliance) handles information through uhhcahealth.org and its related website tools. It covers visitors, people submitting care-related documents, and authorized staff using restricted website areas.

This website policy is not a HIPAA Notice of Privacy Practices or a treatment consent. If UHHCA’s activities or your records are subject to HIPAA or other health privacy laws, any required healthcare privacy notice, authorization, and applicable law also govern. This page does not claim that the website or upload tool has been certified as HIPAA compliant.

• Document submissions: your full name and email address; optional phone number, relationship to the patient, and note; the document you choose; and your authorization to receive and store it.
• Submission details: the original file name, file type, file size, submission time, and an internal storage identifier. Documents may contain medical, insurance, identification, or other sensitive information depending on what you submit.
• Staff sign-in: account information and authentication data needed to verify authorized staff and restrict access.
• Technical information: hosting and security services may process IP addresses, browser and device information, request details, and diagnostic logs. Error reporting can include the page path and technical error information.

The contact page currently includes an inquiry form that does not transmit its entries to UHHCA. Do not rely on that form to send a request or medical information. If submission functionality is introduced, this policy will be updated to describe it.

Share only what is necessary. Do not include passwords, full payment card numbers, or unrelated personal records. If a document concerns someone else, submit it only when you have the necessary authority or permission.

Information submitted through the upload tool is used to receive and review care paperwork, understand the context of a referral or inquiry, and contact you about arranging or coordinating care. Technical and account information supports website operation, troubleshooting, abuse prevention, and staff access controls.

Your upload authorization permits receipt and storage for the care-coordination purpose shown on the form. It is not a blanket authorization for unrelated disclosures, marketing, or treatment. Where law requires a separate consent, authorization, or other legal basis, that requirement still applies.

Stored submissions and files are restricted to authenticated accounts with the administrator role. Hosting, authentication, database, and storage services process information as needed to operate the website; the current tools use Lovable Cloud. These technical service providers are distinct from the people reviewing your care paperwork.

Information may also need to be disclosed when legally required, to respond to a valid legal process, to address a security incident, or to protect rights and safety, subject to applicable privacy and health-information laws. Care-related disclosures beyond the website’s intake process must follow any applicable consent and legal requirements.

The current website implementation does not include advertising pixels, a personal-data sales feature, or automatic forwarding of uploaded documents to an email recipient. Documents are not posted as public website content.

Documents are stored in a private storage bucket rather than a public folder. Published-site connections use HTTPS. Restricted staff access requires authentication and an administrator-role check, and downloads use temporary links that expire after five minutes.

A temporary download link permits access to anyone who possesses it until it expires, so authorized staff must protect these links and downloaded copies. Downloaded files are no longer protected solely by the website’s access controls.

These safeguards reduce risk but cannot guarantee that every transmission, device, or storage system is completely secure. File type and size checks do not amount to a guarantee that a file is safe or malware-free. Avoid sending medical records in ordinary email, and use a device and connection you trust.

The upload tool does not currently enforce a fixed automatic deletion period. Stored files and submission details remain until removed by an authorized administrator. A specific care-record retention schedule is not established by this website policy.

Retention and deletion requests must be assessed against applicable recordkeeping duties, care needs, legal holds, and security requirements. Deleting a submission from active storage may not immediately remove it from service-provider backups or previously downloaded copies.

Do not use the upload tool as your only document archive. Keep your own copies and ask UHHCA about the retention requirements that apply to your particular records.

Staff authentication uses browser storage and may use cookies or similar technology to maintain sign-in state. Hosting and security services may also use technical information needed to deliver and protect the site. Disabling browser storage or cookies may interfere with staff sign-in.

The site loads its fonts from Google Fonts, which means your browser makes requests to Google when those fonts load. Those requests may disclose technical information such as your IP address and browser request details. Third-party websites linked from this site follow their own privacy policies.

No dedicated advertising tracking or marketing analytics tools are included in the current site code. Hosting diagnostics are different from advertising tracking. The site does not currently provide a dedicated response to browser “Do Not Track” signals; any legally required privacy preference signals must be honored where applicable.

You may choose not to upload information, leave optional fields blank, or ask about an alternative way to provide documents. You may request access to information you submitted, correction of inaccurate details, or deletion, or ask to withdraw your upload authorization for future processing.

The rights available depend on your location, the type of record, and applicable law. Some requests may be limited by healthcare recordkeeping or other legal duties. Withdrawal does not undo lawful processing already completed.

We may need to verify your identity and authority before providing records or acting on a request. Do not send identity documents or sensitive medical details in an initial ordinary email. Ask for an appropriate verification channel. Where applicable, you may also raise a concern with the relevant privacy or healthcare regulator.

This site is intended for adults making care inquiries and authorized care representatives. A parent, guardian, or other legally authorized person may submit relevant information on behalf of a child. Children should not independently submit personal information through the website.

If you believe a child submitted information without appropriate authorization, notify UHHCA so the matter can be reviewed. Hosting and service-provider processing may occur outside your state or country; this policy does not promise that information remains in a particular location.

For a privacy question or request, use the direct contact information on our Contact page once confirmed with UHHCA; the inquiry form itself currently does not send messages. Identify the request as a privacy matter and provide only the minimum information needed to arrange a response.

We may update this policy when website practices or legal requirements change. Revisions will be posted here with an updated effective date. Additional notice or consent will be provided where required by law.