Privacy policy

Who we are and what this covers

Sevana is operations software for California residential care facilities for the elderly, known as RCFEs. Our customers are the facility operators. This policy covers this website (sevanacare.com), the Sevana app your staff use, and the family portal.

Two roles matter throughout this policy. For information about our own customers and about visitors to this site, we decide what is collected and why, so we are the business responsible for it. For resident and staff records that an operator enters into Sevana, the operator decides what is collected and why. We hold and process that information on the operator’s instructions, under our contract with the operator. Under California privacy law that makes us a service provider for those records.

Sevana is a product of Souli Software Solutions, which is the controller of operator account information and the service provider for records operators enter.

What we collect

Demo bookings

Booking a demo on /book-a-demo means giving our scheduling provider your name, your email address, and whatever you write in the notes. The calendar is ours, so we receive and keep that booking, and we use it only to hold the call and reach you about Sevana. The provider holds its own copy under its own policy, which is covered below. Please keep resident details out of the booking notes.

Email and older request links

If you write to info@sevanacare.com, or send details through an older access-request link, we receive what you send: usually your name, email, facility name and bed count. We use it only to reply about Sevana, and writing to us does not add you to our email list.

Email list

If you sign up for one of our downloads, such as the California RCFE forms checklist, you join our email list. We collect your email address, your answer to the optional question “I run a home” or “I’m opening one,” the page you signed up from, and the time you signed up. Only the signup form adds you to the list. Writing to us, replying to an email or booking a demo does not. “Our email list” below explains how we use it.

Site visits and session replays

On this website’s pages outside the demo (sevanacare.com) we use an analytics provider to learn how visitors use the site. It records the pages you visit and your clicks. A click record leaves out the text of what you clicked, though a session replay shows the page around it. It also records how fast each page loads: how long it takes to show its first and its largest content, how long it takes to respond to a tap or click, and how much the layout shifts while it loads. It also records session replays: a playback of each page as you saw it, including the text on the screen. We set the replay to hide anything you type. It also records error reports: when a script on a page fails, a fixed description of the kind of error (for example “could not read a property”), where in our code it happened, the page, the build, and the same browser, device and session details as the rest of the analytics, never the specific text from the error or what was typed. Reports include errors the page recovers from, not only crashes. Our analytics provider keeps your IP address and works out a rough location from it. It keeps its own data in your browser’s storage for this site and sets no cookie. It also counts when you book a demo call in the calendar on our demo page and when you sign up for the checklist, with the page you signed up from but not your email address. If your browser sends a Global Privacy Control signal, we do not run any of it. Analytics never runs on our document-signing page or our account-deletion page, or on a page you open from a link that carries anything beyond campaign or ad-click tags in its address. Anything after a # in the page’s address is removed before it is sent.

Demo visits and session replays

Our demo (sevanacare.com/demo) uses the same analytics provider to learn how visitors use it. It records the screens you view and your clicks, leaving out the text of what you clicked. It also records how fast the demo loads: how long it takes to show its first and its largest content, how long it takes to respond to a tap or click, and how much the layout shifts while it loads. It also records when you record a dose, approve a medication order, complete a care task, report an incident, mark an inspection item checked, publish a staff schedule or log a drill, and nothing about the record itself. It also records session replays: a playback of each screen as you saw it. We set the replay to hide anything while you type it, but text you save in the demo shows on later screens and in your replay. The demo holds only made-up sample data. It also records error reports: when the demo fails, a fixed description of the kind of error (for example “could not read a property”), where in our code it happened, the screen, the build, and the same browser, device and session details as the rest of the analytics, never the specific text from the error or what was typed. Reports include errors the demo recovers from, not only crashes. Our analytics provider keeps your IP address and works out a rough location from it, because the demo is served on our sales site’s address. Analytics runs only on the demo pages of sevanacare.com, and the demo opened on the app’s address sends nothing. Anything after a ? or # in the address you arrive at is removed before anything is sent. It keeps its own data in your browser’s storage, shared with our site’s pages, and sets no cookie. If your browser sends a Global Privacy Control signal, we do not run any of it.

Staff use of the app

When staff use the Sevana app in a web browser, the same analytics provider records how the app is used, so we can see which screens and features homes rely on. It runs for staff accounts only. Family accounts send nothing, and neither do our iPad, iPhone and Android apps. For each screen opened and each click, it records the time, the staff login (by an internal id, not a name or email address), the home, the login’s role, and whether the login is a person’s own or a home’s shared tablet. It names a screen by its kind, such as “a resident’s medication record,” never by the resident or record on it. Along with that, it records the app’s address, the browser and operating system with their versions, the device type and the window size. A click record leaves out the text of what was clicked. It also records how fast the app loads in a browser tab: how long it takes to show its first and its largest content, how long it takes to respond to a tap or click, and how much the layout shifts while it loads, with the same details as a screen record, naming the screen the app was loaded on. It also records each server error you hit, with the same details as a screen record plus which part of the app, the error code and a random request number, such as “residents, 500,” never the record the request was for. It also records how long each screen takes to open, from the tap until it has drawn and our server has answered the requests made while it opened, and whether any of those answers was a server error or never came, with the same details as a screen record. For each request the app makes to our server, it also records which part of the app it was for, whether it read or saved, whether the server answered, refused or failed with a server error, and how long it took, never the record the request was for, with the same details as a screen record. It also records when staff record a dose, approve a medication order, complete a care task, report an incident, mark an inspection item checked, publish a staff schedule or log a drill, with the same details as a screen record and nothing about the record itself. It also records when staff invite a teammate, add a resident, or complete a step of the first-run setup or finish it, with the same details as a screen record plus the step’s name, and nothing about the teammate invited or the resident added. It also records error reports: when the app fails, a fixed description of the kind of error (for example “could not read a property”), where in our code it happened, the screen, the build, and the same browser, device and session details as a screen record, tied to the signed-in staff account, its home and its role, never the specific text from the error or what was typed. Reports include errors the app recovers from, not only crashes. It records no session replays, no resident names or ids, and nothing written in a record. To tell one visit from the next, each record also carries a session id, a tab id and a device id, and the first one after sign-in carries an anonymous id from before it. The app keeps these in that browser tab’s storage and sets no cookie. The tab’s storage also holds the address of the screen each session began on and the page that led there, and none of it is sent. Our analytics provider receives your IP address with each request. It removes the address before the event is stored and works out no location from it. The app does not check for a Global Privacy Control signal.

Account information

When a facility sets up Sevana, we collect the names, email addresses, and roles of the people who sign in, plus their sign-in activity, so we can authenticate them and show who did what.

Facility records

Operators enter the records they need to run the home: resident profiles, care plans, medication administration records, daily task and note history, incidents, staff credentials, documents, and photos. Much of this is health information about residents. It belongs to the facility and its residents, not to us.

Family portal information

An operator invites a family member or resident representative to a specific resident. Only the resident or their legal representative can turn on family access. They choose which information categories to authorize; every category starts off. Sevana enforces both that signed authorization and the selected categories on each request. The resident or their legal representative can withdraw consent at any time, which changes subsequent access.

Technical information

Running the service produces server logs and error reports. These contain request details such as timestamps, routes, and identifiers. We use them to keep the service working and to investigate problems.

Billing information

Our payment processor handles payment details for us. We see the billing contact and the status of a subscription, not full card numbers.

Why we use it

We use this information to provide the product, to authenticate people and keep accounts secure, to answer support requests, to invoice operators, to detect and fix faults, to see how visitors use this website, and to meet our own legal obligations. If you join our email list, we use your address to send what you signed up for, as described in “Our email list”. We do not sell or share personal information for cross-context behavioral advertising, and we do not use resident records to train models or to build advertising profiles. The booking calendar on /book-a-demo is the one place where another company’s advertising providers run; it is described below.

Who we share it with

We share information with the service providers that run Sevana. They fall into these groups:

• sign-in
• hosting
• the database
• file storage
• email delivery
• error monitoring
• site and app analytics, including error reports
• scheduling
• payments

Each one works under a contract that limits it to processing information for us, and we keep a current list available to operators on request. We also disclose information when a law or a valid legal process requires it, and to professional advisers who are bound to keep it confidential. If Sevana is ever acquired or merged, information moves with the business and this policy travels with it until it is replaced.

Our scheduling provider runs on one page: /book-a-demo. The calendar is part of that page and loads with it, so opening the page connects your browser to the provider before you type anything. The provider sees that request — your IP address, your browser, and the page you are on — and sets its own cookies.

Inside the calendar, the provider also loads its own analytics and advertising providers. We do not choose them, we do not control them, and we get nothing back from them. They run under the scheduling provider’s privacy policy, not ours. If you book, the name, email, and notes you give the form go to the provider too. Please keep resident details out of the booking notes. If you would rather not load any of it, email us instead of opening /book-a-demo.

Our email list

Some pages on this site offer a download, such as the California RCFE forms checklist. To get it, you give us your email address, and that adds you to our email list. It is the only email list you can join on this site.

What we collect. When you sign up, we record:

• your email address
• your answer to “I run a home” or “I’m opening one,” if you choose one
• the page you signed up from
• the date and time you signed up

Why. We use your email address to send the download you asked for. If you told us you run a home, we send one short, plain note two days later, and a reply to it reaches a person at Sevana Care. We use the page you signed up from to learn which guides people find useful. We do not sell the list, and we do not share it for advertising. If we start sending the list a new kind of email, we will update this section first.

Who stores it. Our email provider stores the list and sends these emails for us. It processes the data in the United States. We do not track whether you open our emails or click the links in them. The signup passes through our own servers on its way to the email provider, so it shows up in the request logs described under “Technical information”.

How to unsubscribe. Every email from the list has an unsubscribe link. Use it and the list stops emailing you right away. You can also reply to any of our emails and ask to be removed. We remove you by hand, within 10 business days. If you unsubscribe and later ask for a download again, we still email you the download, but nothing else.

How long we keep it. We keep your entry while you are on the list. If you unsubscribe, we keep your entry, marked unsubscribed, so that we do not email you again by mistake. If you ask us to delete it, we will; a deleted entry can no longer stop a later signup from adding you back.

Health information and email

Sevana stores protected health information for the homes that use it. We built it, and we run it, to meet HIPAA’s privacy and security rules. That describes how we work. It is not a certification: no one certifies HIPAA compliance.

Our email provider does not sign a business associate agreement (the HIPAA contract that covers health information), so our emails carry as little as we can: a family invitation may name the resident it is for, and everything clinical is read only after signing in.

Whether we sign a business associate agreement with a given operator, and on what terms, is settled in that operator’s contract.

How we protect it

Recorded audit entries are sealed so a later edit shows. Staff requests are scoped to the active facility; family sessions can reach only residents named in their signed authorizations. Data is encrypted in transit and at rest. Security reports go to info@sevanacare.com, and we acknowledge them within two business days.

How long we keep it

We keep account and facility records for as long as the facility has an active Sevana account. After an account closes, we keep records for the period the operator’s contract sets, then delete or de-identify them. Care records also carry retention duties that fall on the facility under California law, and we do not delete ahead of those duties. Email list entries follow the rule in “Our email list” above.

Your rights

California residents have rights over their personal information under the California Consumer Privacy Act as amended by the California Privacy Rights Act. You can:

• ask what we hold about you
• ask for a copy
• ask us to correct it
• ask us to delete it
• ask us to limit the use of sensitive personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. That holds for every record we control.

One page is not fully ours: /book-a-demo embeds our scheduling provider’s calendar, and that provider loads its own advertising and analytics providers inside it. California law may count that as sharing. We are not paid for it and we get no advertising data back. You can avoid the embedded providers by emailing us instead of opening /book-a-demo. We will not treat you differently for asking.

If your information is in Sevana because a facility put it there, the facility decides those requests. Send your request to the facility. If you send it to us, we pass it to the facility and support them in answering it, which is what our service-provider role requires.

To make a request about information we hold as the responsible business, write to info@sevanacare.com. We verify who you are before we act, usually by replying to the address already on the account. An authorized agent may act for you with written permission we can check.

Children

Sevana is built for adult residential care and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child’s information reached us, write to info@sevanacare.com and we will remove it.

Changes to this policy

When we change this policy we update the effective date at the top. If a change affects how we handle personal information in a way that matters to you, we tell account holders by email before it takes effect.

Contact us

Privacy questions, requests, and security reports: info@sevanacare.com.