Hands In Unity Provider App Privacy Policy

Hands In Unity LLC | hiucare.com

Effective date: October 30, 2026

Last updated: October 30, 2026

1. Who we are and what this policy covers

Hands In Unity LLC ("HIU," "we," "us") is a provider licensed by and contracted with the Tennessee Department of Disability and Aging (DDA). We provide Family Model Residential Support in East Tennessee through TennCare's 1915(c) waivers and Employment and Community First (ECF) CHOICES. Our office is at 900 E Hill Ave. Ste 430, Knoxville, TN 37915. Phone 865-659-8279 (TRS 711).

This policy explains what the Hands In Unity mobile app for iPhone and Android (the "app") collects, how we use it, and your choices. The app is only for Family Model Providers (FMPs) who contract with HIU and for HIU office staff. Accounts are created by invitation from our office. The app isn't meant for the general public or for anyone under 18.

This policy is posted at hiucare.com/app-privacy. Our website has its own policy at hiucare.com/privacy.

Health information about the people we support is covered by a different notice.

Some forms you open in the app, such as the Medical Encounter Form, collect health information about people HIU supports. That information is protected health information under HIPAA, the federal health privacy law. Our Notice of Privacy Practices (hiucare.com/hipaa-notice) explains how HIU uses and shares it and the rights of the people we support. As an FMP, your contract with HIU, including its business associate terms, also governs how you protect it. This app policy doesn't change either of those.

2. The short version

• The app is for HIU work only.
• We collect what we need to run your account, track your credentials and trainings, and let you submit HIU forms.
• We don't use advertising, tracking or analytics tools in the app, and we don't sell your information.
• We don't collect your location or your contacts.
• The app doesn't have a chat or messaging feature right now. If we add one, we'll update this policy and tell you in the app before it starts.
• The app asks for your phone's passcode, fingerprint or face every time you open it or come back to it.
• Phone notifications are always general, such as "You have a training due soon." They never include health information or anyone's name.
• You can ask us to delete your account from inside the app or on our website (see section 10).
• Questions? Contact our Privacy Officer, Daniel Byerley, at d.byerley@hiucare.com or 865-659-8279 (TRS 711).

3. Information the app collects

a. Account information. Your name, email address and role (FMP or office staff). When our office invites you, it may also enter your phone number. You set a password when you accept your invite. Our sign-in provider stores it in protected (hashed) form, and HIU staff can't see it. Our office gives you your invite code in person or by phone. If you forget your password or can't sign in, call the office at 865-659-8279 (TRS 711).

b. Credential and training records. For each of your credentials (such as CPR/First Aid, medication certification, fingerprinting, driver's license, auto insurance and Relias DDA courses), the app keeps the type, the title, the completion and expiration dates, and any note from our office. Office staff enter or import some of these, for example from Relias training reports.

c. Documents you upload. The app doesn't accept document uploads right now. The office will tell you how to send copies of your cards and certificates. Never send anything about a person you support with your own credentials.

d. Forms. The Forms tab opens HIU's secure online forms, run by Jotform, inside the app. What you type or attach in a form goes straight from your phone to HIU's Jotform account. It isn't stored in the app's own database. Some forms, like the Medical Encounter Form, collect health information about people we support (see the box in section 1). That information is kept in HIU's HIPAA-protected Jotform account and in HIU's Microsoft 365 SharePoint, not in the app. When you close a form or sign out, the app clears the form pages, cookies and temporary files from your phone. The Insurance Renewal Form is for your own auto insurance. It collects your policy information and card, not health information.

e. Announcements. Office staff post announcements, and we also post each month's approved Unity Circle newsletter there. The app shows announcements to every app user. Office staff can hide a post, and then only office staff can see it. Announcements aren't used for information about people we support.

f. Activity records. To keep the app secure and meet legal requirements, we keep records of certain actions, such as:

• a credential being updated;
• a document being uploaded, viewed or downloaded;
• an announcement being posted, hidden or deleted;
• an invite being used;
• an account deletion being requested or completed;
• this app's privacy notice being accepted.

Each record includes the time, the account that acted, the type of action and the record affected. It doesn't include notes, file names or document contents. Our sign-in provider also records sign-ins and keeps those records for a limited time set by its service plan.

g. Technical information. When the app connects to our service providers, their servers keep standard technical logs, such as IP address, device or app type, and the time of each request. These logs are used to run and secure the service, and they can be linked to your account. Our service providers keep them for a limited time set by their service plan. We don't use them to find your location. The app has no analytics or advertising tools. Each time the app starts, it checks with Expo for app updates. That check sends a random ID for your copy of the app and, if the app couldn't start the last time, a short technical error message. These don't include your name, email or records.

h. Information kept on your phone. To sign you out automatically, the app saves your sign-in session and the times you were last active. Your sign-in session is encrypted on your phone, and the key that unlocks it is kept in your phone's secure storage (the iPhone Keychain or the Android Keystore). Reminder notifications are scheduled on your phone.

Remember my email. If you tick "Remember my email" when you sign in, the app keeps your email address on this phone so it's filled in next time. It's encrypted, and the key stays on this phone only. The app never saves your password this way. It stays saved when you sign out. To remove it, untick the box, or delete the app. Don't use it on a shared phone.

4. Phone permissions

The app asks for a permission only when you use the feature that needs it. You can turn any permission off in your phone's settings.

Your fingerprint or face data stays on your phone. The app only learns whether the unlock worked.

When you tap Call, the app opens your phone's own calling app with HIU's number filled in. The app doesn't read your calls, texts or contacts. Please don't text or email us health information or information about anyone we support. Call us instead, or use the secure forms in the app.

The app doesn't use location, the microphone (except inside your phone's camera app), contacts, calendar, or your phone's advertising ID.

5. Notifications

Reminder notifications use general wording only:

• "You have a training due soon."
• "You have an item that needs attention."
• "You have items that need attention."
• "The office posted an announcement."

They never include health information, the name of a person we support, your credential names, or dates. Details stay inside the app after you sign in. The app schedules these reminders on your phone.

6. How we use information

We use the information in the app only to:

• create and secure your account and sign you in;
• track and remind you of credential and training due dates, and confirm you meet DDA and TennCare requirements to provide services;
• receive and review the documents and forms you submit;
• share office announcements and contact information;
• keep the app secure, investigate problems, and meet our legal and contract obligations.

We don't use app information for advertising or marketing, and we don't sell or rent it.

7. Who we share information with

• Service providers that run the app for us, under contracts that limit how they use the information:
  • Supabase (database, file storage, sign-in, and sign-in emails). It holds your account and credential records only, not documents and not health information about people we support.
  • Jotform (online forms).
  • Microsoft (HIU's Microsoft 365, including SharePoint, where form information and uploads are stored).
  • Apple and Google (delivering the app through the App Store and Google Play).
  • Expo (tools used to build the app and deliver app updates). When the app checks for updates, Expo receives a random ID for your copy of the app, technical details such as the app version and your IP address, and, if the app couldn't start, a short error message. Expo uses this to deliver updates and keep the app working, and keeps it only as long as reasonably necessary. Expo doesn't receive your name or your records.
  • Of these, Jotform and Microsoft handle health information for us, under HIPAA business associate agreements.
• Government agencies and health plans, when the law or our contracts require it. For example, we may show your credential records to DDA, TennCare or a TennCare managed care organization during a review of provider qualifications.
• When the law requires it, to report suspected abuse, neglect or exploitation as Tennessee law requires, or to protect someone's safety, our rights, or the security of the app.

Office staff can see FMP account and credential records so they can track due dates. FMPs can see only their own records.

8. How long we keep information

After each period below ends, we delete the information, unless a law, a government or contract audit, or a legal claim requires us to keep it longer.

• Your FMP account and credential records and uploaded documents: while you contract with HIU, then for 6 years after the end of the calendar year in which your contract with HIU ended, then deleted. For example, if your contract ended in March 2027, we keep these records through December 31, 2033.
• Office staff records (your app account and records): while you work for HIU, then for 6 years after the end of the calendar year in which your employment with HIU ended, then deleted. They follow HIU's personnel file rules.
• Activity records: 6 years after the activity.
• Announcements: kept until office staff remove them. Office staff can hide a post and then delete it permanently. When a post is deleted, its words are removed from the app. We keep only the activity records about it (that it was posted, hidden and deleted, by whom, when and why it was hidden), not what it said. A newsletter section that was deleted won't be posted in the app again. Copies in our service provider's backups are removed on that provider's backup schedule. Deleting a post in the app doesn't change newsletters that were already sent by email.
• Your acknowledgment of the app's privacy notice (with the email address you used): 6 years from the date you accepted it or the date that notice was last in effect, whichever is later.
• A record of your account deletion request (with the email address you used): 6 years after the request is completed.
• Forms about you, such as the Insurance Renewal Form, and copies of your cards and certificates that you send through HIU's forms: kept with your FMP records, for the same period (6 years after the end of the calendar year in which your contract ended), then deleted.
• Forms about a person we support, such as the Medical Encounter Form: they become part of that person's HIU record. They aren't your records, and deleting your app account doesn't delete them. We keep them for 6 years after the end of the calendar year in which HIU's services to that person ended, then delete them. The Notice of Privacy Practices explains how HIU uses and shares them.
• Information on your phone: when you sign out, the app removes your sign-in session and any form pages, cookies and temporary files. Everything else the app keeps on your phone is removed or made unreadable when you delete the app. To be sure, sign out before you delete it.
• Technical logs: only as long as our service providers' plans keep them.

9. How we protect information

• Accounts by invitation only, with a unique sign-in for each person.
• Database rules so each FMP can see only their own records.
• Encrypted connections (HTTPS) between the app and our service providers.
• Encryption of stored data by our database provider.
• An app lock: your phone's passcode, fingerprint or face is needed every time you open the app or come back to it.
• Automatic sign-out after 15 minutes of inactivity and after 12 hours.
• Screenshots and screen recording are blocked on the Forms screens, and the Forms screens are hidden in your phone's app switcher.
• General-only notifications.
• No analytics or advertising tools.

No system is completely secure. Please protect your phone with a screen lock, don't share your password, and use the app only on a phone that only you use.

If you think information was lost, seen or sent by mistake, including a lost or stolen phone, contact our Privacy Officer right away (section 12).

10. Your choices, and deleting your account

• See or correct your information: most of it is on your Credentials screen. Ask our office to correct anything that's wrong.
• Turn off notifications or permissions: in your phone's settings.
• Delete your account:
  • In the app: FMPs open Profile → Privacy & Notices → Delete my account. Office staff open More → Privacy & Notices → Delete my account. Then follow the steps.
  • On the web: go to hiucare.com/app-account-deletion to see how to ask us without the app.
  • Or contact our Privacy Officer.

Our Privacy Officer, Daniel Byerley, handles deletion requests, including those made in the app. We may ask you to confirm your identity. We turn off your account's access right away and finish the request within 30 days, and we'll confirm when it's done. When we finish deleting your account, we permanently close your sign-in, erase your email address, password and phone number from your sign-in and app profile, and delete any other information we aren't required to keep. We keep your name, your role (FMP or office staff) and your contract end date with the records we must keep, so they still show whose records they are and when they can be deleted. The record of your deletion request and your privacy-notice acknowledgment keep the email address you used, as described below.

Because HIU is a licensed and regulated provider, we must keep some records even after you ask us to delete your account. We keep:

• your credential records and documents, for 6 years after the end of the calendar year in which your contract ended;
• office staff records, for 6 years after the end of the calendar year in which employment with HIU ended;
• activity records, for 6 years after the activity;
• your privacy-notice acknowledgment (with the email address you used), for 6 years;
• a record of your deletion request (with the email address you used), for 6 years after it's completed;
• forms about you, such as the Insurance Renewal Form, for the same period as your credential records;
• forms about people we support, as part of their HIU records, for 6 years after the end of the calendar year in which HIU's services to that person ended.

11. Children

The app isn't meant for anyone under 18, and we don't knowingly collect information from children through it.

12. Questions, concerns and complaints

Privacy Officer: Daniel Byerley, Co-founder and Executive Director
d.byerley@hiucare.com | 865-659-8279 (TRS 711) | 900 E Hill Ave. Ste 430, Knoxville, TN 37915
Office hours: Monday through Friday, 8 a.m. to 5 p.m. Eastern Time.

App help and account deletion requests: support@hiucare.com. Please don't put health information in an email.

After hours, to report a lost or stolen phone or a possible privacy incident: HIU after-hours line, 865-659-8279 (TRS 711). Then also tell the Privacy Officer the next business day.

If your concern is about the privacy of health information, you can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

• Online: https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf
• Phone: 1-800-368-1019 | TDD: 1-800-537-7697
• Email: OCRMail@hhs.gov

We won't retaliate against anyone for raising a privacy concern.

13. Changes to this policy

We may update this policy. We'll post the new version on this page (hiucare.com/app-privacy), change the "Last updated" date, and tell app users in the app before a significant change takes effect, such as adding a new type of information or a new service provider.

Language and disability help. If you speak a language other than English, free language help is available. Free large print, sign language interpreters and other aids are also available. Call 865-659-8279 (TRS 711). See hiucare.com/language-assistance.

Hands In Unity LLC · 900 E Hill Ave. Ste 430, Knoxville, TN 37915 · 865-659-8279 (TRS 711) · Monday through Friday, 8 a.m. to 5 p.m. Eastern Time