Privacy Policy

We collect information you provide when contacting us, requesting services, making a referral, applying for employment, or using an authorized portal. Depending on the activity, this may include your name, email address, phone number, organization, relationship to a member, inquiry details, employment history, and references.

Authorized care records may include member identification and contact details, guardian information, service plans, medication and administration records, daily living documentation, daily logs and events, and other information necessary to coordinate services. Workforce records may include staff profiles, assignments, schedules, time entries, and training records. Provide another person's information only when you are authorized to do so.

Follow each form's instructions. Do not send sensitive health details through a public inquiry form or ordinary email when a secure method is needed; contact us to arrange an appropriate way to provide them.

Sign in with Google is offered on our authorized care and workforce portals; it is not offered on the public information pages of our website. When you choose it, Google asks you to confirm that basic identity information may be shared with us. The flow requests only the standard Google sign-in permissions (also called scopes): openid, email, and profile.

Through those permissions we receive a limited set of information: a unique Google account identifier for your account, your email address and whether Google has verified it, and basic profile information such as your display name and a link to your Google profile picture when your account has one.

We do not receive your Google password or any Google sign-in credentials. This sign-in flow does not request or receive access to your Gmail messages, Google Drive files, Google Calendar, Google Contacts, Google Photos, or any other Google service content, and we request no Google API permissions beyond openid, email, and profile.

Google sign-in confirms who you are. It does not by itself give you access to member or workforce information; access depends on the role and assignments approved for your account.

We use the information received through Google sign-in to: verify your identity when you sign in; create your account the first time you sign in, or link Google sign-in to an authorized account that already exists; authenticate each subsequent sign-in; display your name, email address, and profile picture in the portal so that you and other authorized users can identify your account; apply the access rules that match your role and assignments; administer accounts, roles, and permissions; and record and monitor sign-in activity for security, troubleshooting, and audit purposes.

We do not use Google sign-in information for advertising or marketing. We do not sell it, share it with data brokers, use it to determine creditworthiness or make lending decisions, or use it to track you across other websites or apps.

We do not use Google sign-in information to train artificial intelligence or machine learning models. Our personnel do not read it except with your consent, when necessary to investigate a security incident or resolve a support issue you raise, or when we are required to do so by law.

Google-derived identity information is stored as part of your account record within our application's cloud hosting and data services, alongside the rest of your profile. It is transmitted over encrypted connections (HTTPS/TLS) and protected by role-based access controls, so only personnel with an authorized administrative or management role can view it. We do not store your Google password and we do not maintain a separate Google credential for you.

Only the following parties receive this information, and only for the purposes described in this policy: Google, which processes the sign-in and provides the identity information; Base44, our application hosting, data storage, and authentication provider, which operates the portals and handles the sign-in callback and your application session; and authorized The Blooming Homes administrators, who can view account identity details such as name, email address, and role for account and access management. We do not disclose Google sign-in information to any other third party, and we do not sell it or provide it for advertising.

Information collected through other parts of the website and portals — for example inquiry, referral, or employment information and authorized care or workforce records — is handled as described in the other sections of this policy.

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means that we limit our use of Google user data to providing and supporting the sign-in and account functions described in this policy, that we do not transfer it except as needed to provide those functions or to comply with applicable law, that we do not use it for advertising, and that we do not allow humans to read it except in the limited circumstances described above.

We use information to respond to inquiries, review referrals and applications, coordinate authorized services, maintain care and workforce records, communicate with you, and operate the website and portals.

We also use account and activity information to manage permissions, troubleshoot problems, maintain audit records, investigate misuse, and meet applicable recordkeeping and legal obligations. Google sign-in information is used for account identity, authentication, and these related operational and security purposes.

The website and its hosting and authentication providers may process technical information such as IP address, browser and device details, request times, and error or security logs when you use the service.

Cookies and browser storage may be used to maintain authentication, remember application settings, and support portal functions such as saved drafts. You can manage cookies and stored site data in your browser. Blocking or clearing them may sign you out, remove locally saved work, or prevent features from working.

Where a workforce feature requests device location for visit or attendance verification, your browser asks for permission. Location information is used for that feature; Google sign-in does not provide device location.

Application account information, including Google-derived identity information used in your profile, and submitted records are stored through the app's hosting and data services. The app uses Base44 for application hosting, data processing, and authentication services. Google processes Google sign-in, and Base44 handles the authentication callback and application session.

Service providers supporting hosting, authentication, storage, and communications process information as needed to provide those services. Their own privacy notices also describe their processing. Access by Blooming Homes personnel is intended to be limited to authorized responsibilities.

We do not sell personal information. We share information with authorized personnel and service providers as needed to operate the service, and with your authorized representatives, support coordinators, treating providers, DDD, AHCCCS, or other authorized care partners when permitted or required for services.

Google-derived account information is processed by our authentication and hosting providers and may be visible to authorized account administrators for identity and access management. We do not use Google sign-in data for advertising or sell it to data brokers.

We may also disclose information with your authorization, when required by law or valid legal process, or as permitted to address fraud, security incidents, or threats to safety. Only information appropriate to the purpose should be disclosed.

Member health and care information is subject to applicable confidentiality requirements, including HIPAA where applicable. It is accessed and shared according to authorization, care responsibilities, and applicable law.

This website policy does not replace any separate notice of privacy practices, service agreement, or member rights notice that applies to your care. Contact us to request applicable notices or assistance with care records.

Google-derived identity information — the Google account identifier, your email address, and basic profile details such as name and profile picture — is kept only while your account exists and is needed for the purposes described above. It is deleted from our active systems when your account is deleted. Residual copies may remain in encrypted backups for a short period before those backups are overwritten in the normal course of operations.

Records of sign-in events (for example, your email address, the date and time, the sign-in method, and whether the attempt succeeded or was blocked) are kept separately for security, audit, and compliance purposes. These security logs are not removed simply because you delete your account or remove our access in your Google Account.

We do not keep Google sign-in information longer than is necessary for the purposes described in this policy or longer than applicable recordkeeping requirements allow.

We retain other information for the purposes described in this policy, including providing services, administering accounts, maintaining required care and employment records, resolving disputes, and meeting applicable legal, contractual, and audit requirements. Retention depends on the type of record and the requirements that apply, so there is no single retention period for all information.

Care and clinical documentation, medication and event records, workforce and payroll records, and audit and security logs are generally kept for the period required by applicable law, licensing, and recordkeeping rules, which may extend beyond the end of your account or a member's services.

If you have an authorized portal account, you can delete your account yourself: open your Profile page (or your account menu) and choose Delete Account, then type DELETE to confirm. This permanently removes your account and the personal information associated with it, including the Google-derived identity information described above, and it cannot be undone. You will be signed out and will need to contact us if you later need access again.

If you cannot sign in, or you prefer to submit a request, email info@thebloominghomes.com with the subject line "Data Deletion Request" or call (602) 823-8898. Please include your name, the email address associated with your account, and your relationship to The Blooming Homes. We verify your identity — and, where you request information about someone else, your authority as a guardian, representative, or authorized contact — before we act, and we aim to respond within 30 days.

Some records may not be deleted immediately, or at all, where we are required or permitted to keep them — for example care and clinical documentation, medication and event records, workforce and payroll records, and audit and security logs. When a request covers records of that kind, we explain what is being retained and why, and we delete or de-identify the rest.

To stop us from receiving new information through Google, you can remove our access from your Google Account: open https://myaccount.google.com/connections, select The Blooming Homes, and choose Remove access. This stops future Google sign-in. Depending on how your account was set up, another sign-in method may be available, or we can help you arrange one — contact us so you do not lose access.

Removing our access in your Google Account does not delete your Blooming Homes account or information we already hold. Your account identity information will remain until you delete your account or submit a deletion request as described above.

If you want your access to end but your records to be retained — for example while an employment matter or a care record is still active — choose Request Account Deactivation on your Profile page instead of deleting your account, and an administrator will review the request.

You may contact us to request access to or correction of your information, ask about its use, request deletion, or raise a privacy concern. Available rights and any exceptions depend on applicable law and your relationship to the records. A guardian or representative may need to provide proof of authority.

For Google sign-in specifically, the section above titled "Deleting Your Information and Revoking Google Access" explains how to delete your account, how to request deletion of information we hold, and how to remove our access in your Google Account under Security, then Your connections to third-party apps and services, at https://myaccount.google.com/connections.

If you do not want to use Google sign-in, contact us about available access or service alternatives. Do not include passwords, sign-in codes, or detailed health records in a privacy request email.

We use access controls and other administrative and technical measures intended to protect information. No internet service or storage method can guarantee complete security. Use only your own authorized account, protect your credentials, and report suspected unauthorized access promptly.

Our public website and workforce sign-in are not intended for children to create accounts independently. Information about members who are minors should be provided through authorized care processes by appropriate representatives or personnel. Contact us if you believe a child has submitted information without appropriate authorization.

We will post changes to this policy on this page with an updated date and provide additional notice where required. For privacy questions, record requests, account deletion, or concerns about Google sign-in information, contact The Blooming Homes LLC at info@thebloominghomes.com or (602) 823-8898.