1. Introduction

Welcome to the Khimbus application, operated by KHIT Consulting. We are committed to protecting the privacy and security of your information. This Privacy Policy describes how we collect, use, share, and protect the personal information of the users and residents of our application.

This policy applies to all information collected through our web application, including its various subdomains (e.g., libertyplace.khimbus.com, webtools.khimbus.com).

2. Information We Collect

We collect information to provide and improve our services. The type of information we collect depends on your interaction with our application.

A. Information You Provide Directly to Us:

• Account Information: When staff users create an account, we collect information such as your first name, last name, username, and a hashed password.
• Resident & Client Profile Information: When managing client records, sensitive data may be handled, which may include:
  • Identifiers: Full name, Social Security Number (SSN), date of birth, gender, sexual orientation, race, ethnicity, and contact information (email, phone number, physical addresses).
  • Health and Medical Information (PHI): Primary, secondary, and tertiary diagnoses (including ICD codes), medication details, eMAR data, drug test results, Medicaid information, and insurance details.
  • Financial Information: Employer details, job titles, income information, paystubs, and bank statements.
  • Emergency Contact Information: Name, phone number, and relationship of emergency contacts.
  • Other Sensitive Information: Veteran status, primary language, room number, driver's license details, incident reports, and contact notes.
• Dependent Information: We collect personal and health information about dependents only with the consent of the resident parent or guardian.
• User-Generated Content: Information voluntarily uploaded to the service, including notes, logs, and form submissions.
• Communications: If you contact us directly, we may receive additional information about you.

B. Information We Collect Automatically:

• Cookies and Session Data:
  • Session Cookies: Maintain your authenticated session as you navigate the application.
  • Functional Cookies: Store timezone preferences (e.g., America/New_York) to localize timestamps. No personally identifiable information is stored.
• Server Logs: Standard request logging including IP address, browser user-agent, pages visited, and timestamps used for security monitoring and diagnosis.

3. How We Use Your Information

• To provide, operate, maintain, and improve our application and services.
• To manage user authentication, authorization, and secure password recovery.
• To facilitate essential operational notifications and job completion alerts.
• To localize timestamps to user timezones.
• To ensure platform security, prevent unauthorized access, and protect against fraud.
• To comply with regulatory standards and legal obligations.

4. How We Share Your Information

We do not sell personal information. Information is disclosed only under strictly controlled operational conditions:

• Within Your Organization: Accessible exclusively to authorized staff and supervisors with appropriate access privileges.
• Service Providers: Encrypted transfer to essential infrastructure vendors (e.g., Google Workspace SMTP for notifications).
• Legal Requirements: When mandated by court order or lawful subpoena.

5. Data Security & Retention

We implement technical and organizational safeguards including bcrypt password hashing, encrypted transport (TLS), and isolated multi-tenant data access. Information is retained only as long as required for authorized institutional record-keeping.

6. Contact Information