Privacy Policy

Last Updated: October 20, 2026

HomeCareBilling is a service operated by eCommerce Friendly, LLC ("we," "our," or "us"). We are committed to protecting your privacy. This policy explains how we collect, use, and protect your information.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

Name and email address
Company/agency name
Phone number (optional)
National Provider Identifier (NPI)
Tax identification number

1.2 Billing Information

For payment processing, we collect:

Payment card information (processed by Stripe)
Billing address
Transaction history

1.3 Claims Data

To provide our billing services, we process:

Patient demographic information
Service dates and procedure codes
Diagnosis codes
Provider information
Claim amounts and payments

1.4 Usage Information

We automatically collect:

IP addresses and device information
Browser type and version
Pages visited and features used
Login timestamps

2. How We Use Information

We use your information to:

Provide and improve our billing services
Process and submit Medicaid claims on your behalf
Reconcile payments and generate reports
Communicate about your account and our services
Ensure security and prevent fraud
Comply with legal obligations

3. Information Sharing

3.1 Service Providers

We share information with trusted third parties who assist us in operating our service:

Stripe - Payment processing
Edifecs (a Cotiviti business) - Operates the electronic data interchange gateway for Colorado HCPF (Department of Health Care Policy and Financing). Edifecs receives the electronic claims (837P) we submit on your behalf and returns remittance advice (835). This transmission includes Protected Health Information (PHI) necessary for claim adjudication. We maintain a Trading Partner Agreement governing these transmissions. Prior to August 2026 this role was performed by Gainwell Technologies, which no longer receives claim transmissions from us.
Colorado HCPF - The state agency that administers Colorado Medicaid and makes payment decisions on submitted claims
Twilio - Phone calls for caregiver clock-in and out, and the text messages an agency sends its caregivers
Cloud hosting providers - Data storage and processing

The full list of services that receive client information, and what each receives, is on our Security page.

3.2 Legal Requirements

We may disclose information when required by law, court order, or government request.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

3.4 No Sale of Personal Information

We do not sell your personal information to third parties.

3.5 Mobile Numbers and Text Messages

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. Caregiver mobile numbers are used only to send the work messages described in our Terms of Service (section 9), and Twilio receives a caregiver's number only to deliver those messages and to connect the caregiver's clock-in and clock-out calls.

4. Data Security

We protect your agency's data with:

Encryption in transit: Your browser reaches our service over TLS, and our servers reach our database over an encrypted private network.
Encryption at rest: Our hosting provider encrypts stored data, and the most sensitive fields (Social Security numbers, dates of birth, medical history) and uploaded claim files are additionally encrypted by our application (AES-256-GCM).
Access controls: Each agency sees only its own data, each person only what their role allows; sessions end after a period of inactivity, and an account locks after repeated failed sign-ins.
Audit logging: Sign-ins and changes to records are logged, and the audit log is append-only and kept for at least seven years.
Infrastructure: Hosting with established cloud providers.

Our Security page describes these protections in detail, field by field.

5. HIPAA Compliance

5.1 Protected Health Information (PHI)

As a Business Associate under HIPAA, we are bound by the HIPAA Privacy and Security Rules for the PHI we handle on your behalf.

5.2 Business Associate Agreement

We will execute a Business Associate Agreement (BAA) with each customer that handles PHI through our service.

5.3 Safeguards

We protect PHI with the technical safeguards described in section 4, together with administrative and physical safeguards appropriate to our service.

5.4 Breach Notification

In the event of a data breach involving PHI, we will notify affected parties in accordance with HIPAA breach notification requirements.

6. Data Retention

6.1 Active Accounts

We retain your data for as long as your account is active and as needed to provide services.

6.2 After Termination

Following account termination:

Your agency's records, claims included, are kept for at least 7 years (as required for Medicaid records); we do not delete an agency's records when its account ends.
The audit trail is kept for at least 7 years and is never changed or deleted by the application.
Aggregated, anonymized data may be retained indefinitely.

6.3 Legal Requirements

We may retain data longer if required by law or for legitimate business purposes.

7. Your Rights

7.1 Access and Correction

You may access and update your account information through the application settings.

7.2 Data Export

You may export your claims data at any time through the application.

7.3 Account Deletion

You may request account deletion by contacting us. Some data may be retained as required by law.

7.4 Colorado Privacy Rights

Colorado residents have additional rights under the Colorado Privacy Act, including:

Right to access personal data
Right to correct inaccuracies
Right to delete personal data
Right to opt out of certain processing

8. Cookies and Tracking

8.1 Essential Cookies

We use essential cookies to:

Maintain your login session
Remember your preferences
Ensure security

8.2 Analytics

We may use analytics services to understand how our service is used. These services collect anonymized usage data.

8.3 Do Not Track

We currently do not respond to "Do Not Track" browser signals.

9. Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect information from children.

10. International Users

Our service is intended for use in the United States. By using our service from outside the US, you consent to the transfer of your information to the US.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email. Continued use after changes constitutes acceptance.

12. Contact Information

For privacy-related questions or to exercise your rights, contact us at:

eCommerce Friendly, LLC Website: https://www.homecarebilling.co Email: privacy@homecarebilling.co Address: Denver, Colorado

For HIPAA-related inquiries: Email: hipaa@homecarebilling.co