1. Who we are

PoC360 ("PoC360", "we", "us") is a software-as-a-service platform that helps US skilled nursing facilities manage CMS compliance. Our registered business address is on file with the state of incorporation. Questions about this policy can be directed to privacy@getpoc360.com.

2. Information we collect

Account data — name, email address, job title, and facility details you provide when you register or update your profile.

Facility & compliance data — CMS-2567 citation data, Plans of Correction, internal audit records, policy documents, and staff training records that you upload or that we import from CMS Care Compare on your behalf.

Usage data — pages visited, features used, session duration, browser type, IP address, and device identifiers, collected via cookies and server logs.

Communications — emails and support tickets you send us.

Payment data — billing is processed by Stripe. We store only the last four digits of your card and your Stripe customer ID; we never hold full card numbers.

3. How we use your information

Provide, operate, and improve the PoC360 platform
Import and display your facility's CMS citation data
Send transactional emails (account confirmations, password resets, task reminders you have opted into)
Respond to support requests
Detect and prevent fraud, abuse, and security incidents
Comply with legal obligations
Aggregate and anonymise data for product analytics (individual users are never identifiable in these reports)

We do not sell your data to third parties or use it to train external AI models without your explicit consent.

4. HIPAA notice

PoC360 is designed for use with CMS survey data, which may contain Protected Health Information (PHI) in limited circumstances. We maintain technical and organisational safeguards consistent with the HIPAA Security Rule. Where required, we will enter into a Business Associate Agreement (BAA) with covered entities. Contact privacy@getpoc360.com to request a BAA.

5. Cookies & tracking

We use cookies and similar technologies for authentication, preference storage, and analytics. See our Cookie Policy for a full list and opt-out instructions.

6. Data sharing

We share your data only with:

Supabase — database and authentication hosting (US servers)
Stripe — payment processing
Vercel — application hosting and CDN
Anthropic — AI inference for PoC generation (prompts do not include resident-identifiable information)
Web Push providers — browser push notification delivery
Law enforcement or regulators when required by law

All sub-processors are bound by data processing agreements.

7. Data retention

We retain your account and compliance data for the duration of your subscription plus 90 days after cancellation, to allow you to export your records. After that period, data is permanently deleted. Anonymised aggregate analytics are retained indefinitely.

8. Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data. To exercise these rights, email privacy@getpoc360.com. We will respond within 30 days.

9. Security

We use TLS encryption in transit, AES-256 encryption at rest, role-based access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or by a notice in the application at least 14 days before they take effect. Continued use of the platform after that date constitutes acceptance.

11. Contact

PoC360 · privacy@getpoc360.com

Privacy Policy