Privacy Policy

Account Information

When an administrator invites you, we collect:

• Email address
• Authentication credentials (managed by our authentication provider)
• Basic profile information (such as display name and role, if provided)

User-Provided Content

The application allows users to input and manage case-related information, including:

• A non-identifying family label and de-identified context
• De-identified case notes and summaries
• Barriers, goals, and plans
• Task and referral information

This context is sensitive even when de-identified. Do not enter names, contact details, student identifiers, signatures, or other information that could identify a person.

Automatically Collected Information

We may collect limited technical information, including:

• Session and authentication data (via cookies)
• Basic request metadata (such as timestamps)
• Network metadata such as IP address processed by hosting and security providers

We do not use tracking cookies or third-party advertising analytics.

We use collected information to:

• Provide and operate the application
• Store and manage case-related data
• Generate action plans and recommendations
• Improve reliability, performance, and security

CaseLink uses OpenAI to generate plans and propose mappings for standard form fields.

When AI features are used:

• Only reviewed, de-identified case context and bounded PDF field metadata may be sent
• Uploaded PDF bytes, completed PDFs, identity fields, and signature fields are not sent to OpenAI
• AI output remains a draft until a case manager reviews it

Identifying student or family information is not permitted in the current pilot.

We use Supabase to store accounts, de-identified case records, plans, and audit events, and Vercel to host the application. Each pilot organization uses a dedicated deployment.

Data is stored in a database with access controls designed to ensure that:

• Case managers can access only records they own or are explicitly assigned
• Access is restricted using row-level security policies

Blank PDF files and completed drafts remain in the active browser tab. CaseLink does not persist those files on its server, and they are cleared after download or refresh.

We use cookies and similar technologies to:

• Maintain user sessions
• Authenticate users securely

These cookies are strictly necessary for the application to function and are not used for tracking or advertising.

We do not sell or share personal data for advertising purposes.

Data may be shared only with:

• Supabase, Vercel, and OpenAI as needed to operate the approved features
• Authorities when disclosure is legally required

The production operating schedule is:

• Active case records: for the authorized service period
• Archived case records: 90 days, unless an approved legal hold applies
• Product and security audit events: 365 days; application logs: 30 days
• Browser PDF drafts and server-side raw PDF retention: none
• Encrypted database backups: no more than 30 days after source deletion

Deletion and access requests must be made through the participating organization or the contact below.

CaseLink is available only to invited users in the participating organization.

• Assigned case managers and authorized administrators may access a case
• An administrator must remove access promptly when a user's role changes or ends
• A shared multi-organization CaseLink environment is not approved for the current pilot

We implement technical measures to protect data, including:

• Authentication and session management
• Row-level database access controls
• Input validation and rate limiting
• Secure handling of API keys and server-side processing

No system is completely secure, but we take reasonable steps to protect user data.

CaseLink is a support tool and:

• Does not provide legal, medical, or financial advice
• Does not guarantee accuracy of AI-generated content

Users are responsible for reviewing and validating all outputs.

We may update this Privacy Policy from time to time. Updates will be reflected by the “Last updated” date.

If you have questions or requests related to this Privacy Policy, you can contact us at:

willsanz23@gmail.com