Privacy Policy

This Privacy Policy explains how QAPI One (“QAPI One,” “we,” “us,” or “our”) collects, uses, and protects information when you visit our website, request early access, or use our quality management platform (the “Service”). QAPI One provides software for home health and hospice agencies to manage compliance, incidents, audits, and performance improvement.

Information we collect

We collect the following categories of information:

• Contact information you provide through our early-access or contact forms — your name, email address, organization name, and organization type.
• Account information for users of the Service, including profile details, role, and the agency you belong to.
• Usage and device data collected automatically, such as pages visited, approximate location, browser type, and analytics events.
• Customer content, which may include protected health information (“PHI”) that customer agencies enter into the Service about their patients and staff.

Protected health information (HIPAA)

When a customer agency uses the Service to store PHI, QAPI One acts as a Business Associate under the U.S. Health Insurance Portability and Accountability Act (HIPAA). Our handling of PHI is governed by a Business Associate Agreement (BAA) with each covered entity. We process PHI only as permitted by that BAA and applicable law, and we do not use PHI for advertising or sell it to third parties.

How we use information

• To provide, operate, secure, and improve the Service.
• To respond to early-access requests, demos, support inquiries, and billing.
• To communicate updates, security notices, and service changes.
• To comply with legal obligations and enforce our agreements.

How we share information

We do not sell personal information. We share information only with service providers (subprocessors) that help us operate the Service under contractual confidentiality and security obligations, including:

• Supabase — database, authentication, and storage.
• Vercel — application hosting and analytics.
• Stripe — subscription billing and payment processing.
• Resend — transactional and contact-form email delivery.

We may also disclose information when required by law or to protect the rights, safety, and security of our users and the Service.

Data security

We use technical and organizational safeguards designed to protect information, including per-organization data isolation via row-level security, encryption of data in transit and at rest, scoped session cookies, and audit logging of significant actions. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data retention

We retain personal information for as long as needed to provide the Service and for legitimate business or legal purposes. Customer content, including PHI, is retained and deleted in accordance with the applicable customer agreement and BAA.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete, or restrict the use of your personal information. Requests related to PHI are handled through the relevant customer agency as the covered entity. To exercise your rights, contact us using the details below.

Cookies and analytics

We use essential cookies to operate the Service and privacy-conscious analytics to understand usage. You can control cookies through your browser settings.

Children’s privacy

The Service is intended for use by healthcare organizations and is not directed to children. We do not knowingly collect personal information directly from children through the marketing site.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised “Last updated” date and, where appropriate, provide additional notice.

Contact us

Questions about this Privacy Policy or our privacy practices? Email support@qapione.com or reach us through our contact section.