Privacy Policy

Empower U. Service Corp.
65 Monmouth Street, Floor 3
Red Bank, NJ 07701
Email: privacy@justempower.me
Support: support@justempower.me
Phone: (855) 500-3848

This Policy applies to:

• Visitors to justempower.me and any subdomains we operate.
• Users of our patient portals, caregiver portals, and mobile applications distributed through the Apple App Store, Google Play Store, or by direct download.
• Clients receiving behavioral and mental health services, their families and authorized representatives, caregivers, direct-support professionals, school staff, and payers who interact with the Services.

This Policy does not apply to third-party sites, services, or applications we link to but do not operate.

3.1 Information you provide directly

• Account information: name, email address, phone number, password, organization, role/title.
• Caregiver and staff information: first and last name, date of birth, address, email, phone, professional license number, certification details, hire date, service type, and background-check information where required by contract or law.
• Client / member information: name, date of birth, service address, diagnosis codes (where applicable), insurance or payer information, authorization numbers, and emergency contact details.
• Service and session information: scheduled and actual session start/end times, service type (DDD, counseling, respite, etc.), session notes, progress data, treatment goals, and care-plan updates.
• Billing information: invoice numbers, billed amounts, units, contract rates, insurance claims data, and secondary payer details.
• Communications: messages, support tickets, feedback, appointment confirmations, and other content you send us — including text (SMS) messages and emails you exchange with our team.

3.2 Information collected automatically

• Device and technical data: device model, operating system version, app version, browser type, IP address, language preference, time zone, crash logs, and diagnostic information.
• Mobile permissions data (only when you grant permission and only as needed for the feature):
  • Location (GPS): precise latitude/longitude captured at session start and end when required for in-home service verification or electronic visit verification (EVV) compliance.
  • Phone state (READ_PHONE_STATE): on Android, may be used to detect when an active phone call interrupts the app, to identify the originating phone number for telephony-based verification, and for crash diagnostics. We do not read your call log or contacts.
  • Camera: if you use barcode/QR or document-capture features.
  • Microphone / Storage: only if explicitly required by a feature you use.
  • Biometrics (Face ID / Touch ID): processed locally on your device for sign-in; we never receive or store biometric templates.
• Usage data: pages visited, features used, button taps, session duration, referral source.
• Cookies and similar technologies: see Section 9.

3.3 Information from third parties

• HHAeXchange (HHAX), Inovolon, and state EVV aggregators: visit confirmations, transaction IDs, error codes, and status updates returned to us when we submit service data on behalf of an agency, depending on the payer or program requirements.
• Identity and authentication providers: if you sign in with a single sign-on (SSO) or OAuth provider, that provider may share your name, email, and a unique identifier with us.
• Payers and MCOs: eligibility, authorization, and enrollment information shared by a Managed Care Organization or state agency on behalf of an authorized provider.

We use the information we collect to:

• Provide, operate, and maintain the Services, including delivering DDD services, outpatient counseling, in-home behavioral health services, respite care, and school-based programs.
• Verify caregiver and staff identity and confirm in-home sessions in compliance with payer contracts, the 21st Century Cures Act, and state EVV requirements where applicable.
• Manage scheduling, billing, and recordkeeping for the individuals, families, and agencies that contract with us.
• Communicate with you about the Services, respond to support requests, and send transactional notifications — including text (SMS) and emailed account updates such as appointment reminders, schedule changes, billing notices, and service alerts.
• Improve the Services, debug issues, and develop new features.
• Detect, prevent, and respond to fraud, abuse, security incidents, and unlawful activity.
• Comply with our legal obligations and enforce our agreements.

We do not sell personal information, and we do not use PHI for advertising or marketing purposes.

If you are located in a jurisdiction that requires a legal basis for processing personal information (such as the European Economic Area or the United Kingdom), our legal bases are:

• Contract: to provide the Services you or your employer have requested.
• Legal obligation: to comply with healthcare, tax, employment, and EVV mandates where applicable.
• Legitimate interest: to secure the Services, prevent fraud, and improve our products.
• Consent: for any optional features (e.g., marketing emails); you may withdraw consent at any time.

We share information only as described below:

• With your service coordinator or employer. If you are a caregiver or direct-support professional, your coordinator receives your record, scheduling data, service data, and related information. The coordinating entity is a separate controller of that data.
• With HHAeXchange, Inovolon, state Medicaid agencies, and Managed Care Organizations. We transmit service and caregiver data to these entities as required for EVV aggregation, claims processing, and program oversight, depending on the specific payer or program.
• With service providers (sub-processors). Cloud hosting, email and SMS delivery, analytics, error logging, customer support, and payment processing vendors that act under our instructions and are bound by confidentiality and, where applicable, BAAs.
• For legal reasons. When required by law, subpoena, court order, or government request, or to protect the rights, property, or safety of Empower U., our users, or the public.
• In a business transaction. If we merge with or are acquired by another company, information may be transferred subject to this Policy or a successor policy at least as protective.
• With your consent. For any other purpose disclosed to you at the time of collection or with your express permission.

We retain personal information only for as long as necessary to provide the Services, comply with legal and regulatory requirements (which for Medicaid, behavioral health, and EVV records can be 7+ years depending on jurisdiction), resolve disputes, and enforce agreements. When information is no longer needed, we delete or de-identify it using industry-standard methods.

If you close your account, we will retain records as required by law and our contracts with the entities that engaged us, but we will limit access to those records to authorized personnel.

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption in transit using TLS 1.2 or higher.
• Encryption at rest for databases and backups.
• OAuth 2.0 client-credentials authentication for system-to-system API access.
• Role-based access controls and the principle of least privilege.
• Audit logging of administrative actions and data access.
• Regular vulnerability scanning, penetration testing, and security training.

No method of transmission or storage is 100% secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as required by law.

Our website uses cookies and similar technologies to keep you signed in, remember preferences, and measure usage. We use:

• Strictly necessary cookies (always on) for authentication, security, and session management.
• Analytics cookies to understand aggregate usage and improve the Services.

You can control cookies through your browser settings. Our mobile applications do not use cookies but may use equivalent local-storage and device-identifier mechanisms. We do not use third-party advertising cookies and do not engage in cross-context behavioral advertising.

10.1 All users

• Access and correction. You may request a copy of the personal information we hold about you and ask us to correct inaccuracies. Contact privacy@justempower.me.
• Account closure. You may close your account at any time. We may retain certain records as required by law (see Section 7).
• Communications preferences. You can opt out of non-transactional emails using the unsubscribe link in any message. You may also reply STOP to text messages to opt out of SMS notifications.
• App permissions. You can revoke camera, location, microphone, biometric, or other permissions at any time in your device settings; some features will stop working without them.

10.2 California residents (CCPA / CPRA)

You have the right to know what personal information we collect, to delete it (subject to legal retention requirements), to correct it, to opt out of any "sale" or "sharing" of personal information (we do neither), and to limit use of sensitive personal information. We will not discriminate against you for exercising these rights. To submit a request, email privacy@justempower.me from the address on file or call (855) 500-3848. We will verify your request before responding.

10.3 Other US states

Residents of Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws have similar rights of access, deletion, correction, and opt-out. Submit requests to privacy@justempower.me.

10.4 EEA / UK / Switzerland

You have the right to access, rectify, erase, restrict, and port your data, to object to certain processing, and to lodge a complaint with your supervisory authority. We are not currently established in the EEA. If our processing is subject to EU/UK law, contact our Privacy Officer for inquiries.

10.5 HIPAA rights

If your information includes PHI, your rights under HIPAA are administered by the covered entity (your care coordinator, school district, or MCO), not by Empower U. as a Business Associate. Contact your coordinator or MCO to exercise HIPAA rights, or contact us and we will help direct your request.

The Services are intended for use by adults (18+) acting in a professional or caregiving capacity, or by children under the supervision of a parent, guardian, or authorized representative. We do not knowingly collect personal information directly from children under 13 (or 16 in the EEA/UK) without appropriate consent. The Services may include information about minor clients receiving behavioral health services; that information is provided by their authorized representative and handled as PHI in accordance with HIPAA and applicable BAAs.

We are based in the United States and process data in the U.S. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S., which may have data-protection laws different from those in your jurisdiction. Where required, we use appropriate safeguards such as Standard Contractual Clauses.

The Services may contain links to third-party websites or services that we do not operate. We are not responsible for their privacy practices. We encourage you to review their policies before providing any information.

Our website does not respond to "Do Not Track" browser signals. We do honor the Global Privacy Control (GPC) signal as a valid opt-out request from California residents.

We may update this Policy from time to time. When we make material changes we will notify you by email, text message, or through an in-app or on-site notice and update the "Last Updated" date above. Your continued use of the Services after the changes take effect constitutes acceptance of the revised Policy.

If you have questions, concerns, or requests regarding this Policy or our privacy practices, contact us at:

Privacy Officer
Empower U. Service Corp.
65 Monmouth Street, Floor 3
Red Bank, NJ 07701
Email: privacy@justempower.me
Phone: (855) 500-3848