Privacy Policy

Organizational account data: Organization name, contact email, billing information, and administrator details provided during account setup.

Staff and user data: Names, email addresses, phone numbers, roles, and system activity logs for users your organization invites to the platform.

Youth and participant records: Personal identifying information, dates of birth, intake and referral data, case notes, attendance records, incident reports, goal plans, medication records, family engagement logs, discharge summaries, and any other records your organization enters into the platform on behalf of the youth and families you serve.

Usage and system data: Pages visited, features used, session timestamps, and browser/device identifiers — collected for platform security, stability, and product improvement purposes only.

Communications data: Support requests, feedback submissions, and any correspondence with our team.

• To provide, operate, and maintain the CaseNote Vault platform and its features
• To support case management, compliance reporting, and service delivery workflows
• To send account-related communications (billing receipts, security alerts, service updates)
• To respond to support requests and improve the platform based on usage patterns
• To generate aggregated, de-identified analytics for product development
• We do NOT use participant data for advertising or marketing purposes
• We do NOT sell, rent, or trade your data to any third party

CaseNote Vault does not claim that simply creating an account or using a pilot makes an agency's use HIPAA compliant. Whether CaseNote Vault would act as a Business Associate depends on the agency, the data involved, the production hosting arrangement, and an appropriately executed agreement.

Do not enter Protected Health Information (PHI) until your organization has completed its legal/security review and any required Business Associate Agreement has been separately executed. The BAA page is a review draft, not an automatically effective agreement.

CaseNote Vault does not unilaterally determine that it qualifies as a school official or that a particular agency's use satisfies FERPA. Those determinations depend on the educational institution's relationship, contract, policies, and applicable law.

Organizations handling FERPA-covered education records should complete their own legal and vendor review and configure access, disclosure, and retention practices accordingly before production use.

• Application authorization: Authenticated users are subject to role-based and organization-scoped access controls
• Infrastructure security: Exact transport encryption, storage encryption, backup, key-management, and hosting certifications must be confirmed against the production infrastructure before regulated use
• Role-based access controls: Organization Owners, Program Admins, Supervisors, Staff, and Auditors each have strictly limited access permissions
• Organization-level isolation: Application data rules and server workflows are designed to scope agency records to the active organization
• Audit logging: Key documentation and approval workflows record audit events; CaseNote Vault does not claim universal logging of every read or infrastructure event
• Authentication: Authentication and session services are provided by the platform provider; agency-specific requirements such as MFA must be confirmed before production use
• Security reviews: Internal production verification and targeted workflow hardening are performed; independent assessments are not implied unless separately documented

For our complete security posture, see our Data Security page.

Retention requirements vary by agency, program, contract, funder, and jurisdiction. CaseNote Vault does not prescribe a universal seven-year retention period.

Organizations are responsible for establishing appropriate retention settings and confirming export, deletion, backup-retention, and account-termination procedures before production use. No fixed deletion timeline is promised by this public policy unless established in an applicable service agreement.

You may request a full data export at any time by contacting support@casenotevault.com.

Subject to applicable law, you and the individuals whose data your organization manages may have the following rights:

• Access: Request a copy of data we hold about you or your organization
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of data, subject to legal retention requirements
• Portability: Request an export of your data in a structured, machine-readable format
• Restriction: Request that we restrict processing of your data in certain circumstances

To exercise any of these rights, contact us at privacy@casenotevault.com.

We do not sell, rent, or trade your data. We share data only in the following limited circumstances:

• Service providers: Infrastructure, hosting, payment processing (Stripe), and email delivery providers — under strict data processing agreements
• Legal compliance: When required by law, court order, or lawful government authority
• Safety: To prevent imminent harm to an individual when no other lawful means exists
• Business transfer: In connection with a merger or acquisition, with advance notice to affected organizations

We never share participant data with third parties for advertising, marketing, or research purposes without explicit written consent.

CaseNote Vault uses session cookies for authentication and maintaining your logged-in state. We do not use third-party advertising cookies, cross-site tracking technologies, or behavioral analytics that are shared with advertisers.

Essential cookies required for platform operation cannot be disabled without impairing functionality.

We will provide at least 30 days' advance notice of material changes to this Privacy Policy via email to your organization's registered contact address. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

For privacy questions, data requests, or to report a concern:

• Email: privacy@casenotevault.com
• Support: support@casenotevault.com
• Mailing Address: CaseNote Vault™ · AgencyVault OS · Pennsylvania, USA