Privacy Policy

1. Who is responsible for your data

AideBoard (aideboard.com) is operated by GENAK Estates LLC (or future inheriting LLC), Tolland, Connecticut, which is the controller of the personal information described here. Contact for privacy matters: privacy@aideboard.com. AideBoard is offered in the United States only.

2. What we collect

If you are a caregiver

• Account: your name, email address, and password (stored only as a cryptographic hash — we cannot read it); optionally, a phone number and how you prefer to be contacted (email, phone call, or text); and your confirmation that you are 18 or older.
• Profile, all self-reported: city, state, and the first digits of your ZIP code (search screens deliberately never show your full ZIP); travel radius; roles; availability; driver and car status; live-in/out preference; an optional short bio; and whether you chose to appear in the agency directory.
• Activity: jobs you save, applications you submit (with your optional cover note), application stages, and your contact-sharing decisions (grants, declines, revocations).

If you are an agency user

• Account: your name, email address, and password (hash only).
• Organization: name, market region, your confirmation that it is a home-care agency, and your office address (city, state, ZIP). Our systems are built never to store private-home addresses.
• Activity: jobs you post (role, location, schedule, description), applicant-stage actions, saved caregivers, contact requests, and your acknowledgement timestamps.

Collected automatically

• Login sessions (stored as hashed tokens with an expiry), password-reset records (hashed, single-use, one-hour), and email-confirmation records (hashed, single-use, 24 hours).
• If you use the AideBoard mobile app: an identifier the app creates for your device, and your device's name, so you can see and end your mobile sign-ins.
• If you turn on two-factor sign-in: your authenticator secret (encrypted) and your recovery codes (stored only as hashes).
• An audit log of data-changing actions — who did what and when — kept for security and accountability.
• Moderation records: when our content filter blocks a submission, we store only a category label (for example, "patient identifier"). The blocked text itself is never saved.
• Standard server logs (IP address, time, page requested) for security and operations, and short-lived counters used to limit abuse (for example, repeated sign-in attempts), stored in scrambled form and deleted when their time window closes.

3. What we never collect — and what we actively block

• We collect no payment information, no files or documents, no government IDs, no Social Security numbers, and no dates of birth (you confirm you are 18 or older with a checkbox instead). The only phone number we collect is one a caregiver chooses to add; it is shared only as described in section 5.
• Patient information is prohibited and blocked by software before it can be saved: patient names and identifiers, diagnoses, medications, care plans, insurance or record numbers, patient photos, and home addresses tied to care.
• The same filter keeps emails and phone numbers out of free-text fields, so contact details can only move through the consent-based sharing flow described in section 5. Name and city fields accept letters only, for the same reason.

4. Why we use your information

To run your account and log you in; to operate the job board (show jobs, deliver applications, track stages); to carry out the contact-sharing choices you make; to send you operational notifications; to keep the platform safe (moderation, abuse prevention, rate limits, audit logs); to provide support; and to comply with law. We do not use your information for advertising, and we do not sell it — see section 6.

5. Who sees what

• Agencies see a caregiver's profile only if the caregiver applied to them or opted in to the agency directory — where agencies see only the first name and last initial. They see a caregiver's email address — and phone number and preferred contact method, if the caregiver added them — only after the caregiver explicitly grants their request for that specific application — and the caregiver can revoke that at any time. An agency the caregiver has blocked no longer finds them in search.
• Caregivers see the job posts agencies publish and the stage of their own applications.
• Service providers (hosting, database, and an email delivery provider) process data for us under contracts limiting them to our instructions.
• Legal: we disclose information if the law requires it, or as needed to protect users, the public, or our rights — and no more than required.
• That is the whole list. No data brokers, no advertisers, no selling.

6. Things we do not do

• We do not sell personal information and have never sold it.
• We do not use your information for targeted advertising.
• We do not use advertising or analytics trackers — see the complete cookie list in section 12.

7. Your rights

You can see, correct, download, or delete your information. You can download a copy of your data and delete your account yourself, at any time, from your Account page, and you can edit your profile in the product. For anything else, email privacy@aideboard.com and we will act within 30 days, subject to narrow legal exceptions (for example, audit records we must keep). If we decline a request, we will say why, and you may appeal by replying to our decision at privacy@aideboard.com; we will answer the appeal within 45 days.

8. Security

What we actually do today: encrypted connections (TLS); passwords stored only as scrypt hashes; login and reset tokens hashed at rest; email-address confirmation for new accounts; optional two-factor sign-in with an authenticator app; role-based access control on every request; rate limits on sign-in, sign-up, password reset, contact requests, and other abuse-prone actions; an audit log, which the application only ever adds to, naming the actor for every change; strict security headers; and automated checks on every code change that fail the build if safety rules break. No security is perfect, but these are real, verifiable controls — not aspirations.

9. If something goes wrong

If a breach affects your personal information, we will investigate, contain it, and notify affected users and the authorities required by law — including the Connecticut Attorney General and the Massachusetts Attorney General and Office of Consumer Affairs and Business Regulation where their statutes apply — without unreasonable delay and within the timelines the law sets.

10. How long we keep information

11. Children

AideBoard is for adults. We do not knowingly collect information from anyone under 18; if we learn we have, we will delete it. Both signup forms require confirming you are 18 or older.

12. Cookies — the complete list

That is every cookie. There are no analytics, advertising, or third-party cookies. If that ever changes, we will update this policy first and add any consent controls the law requires.

13. Changes and contact

We will post changes here and, for material changes, notify you by email and in-app notice before they take effect. Questions: privacy@aideboard.com, or by mail to GENAK Estates LLC, Tolland, Connecticut.