TrueTime Health · Revenue Protection for Healthcare at Home

Effective Date: May 1, 2026 · Last Updated: August 4, 2026

TrueTime Health, Inc. (“TrueTime Health,” “we,” “us,” or “our”) is committed to protecting the privacy and security of individuals who use our platform at https://truetime.health (the “Platform”). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website, submit information, or interact with the Platform in any capacity.

TrueTime Health provides eligibility and compliance infrastructure for healthcare at home, connecting patients, family members, licensed clinical reviewers, referral sources, and home health and hospice agencies. Because our services involve health-related information, we take our privacy obligations seriously and comply with applicable federal and state privacy laws, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), applicable state consumer privacy and data protection laws, and other relevant regulations in the jurisdictions where we operate.

By accessing or using the Platform, you consent to the practices described in this Privacy Policy.

Information We Collect

Information You Provide Directly

We collect information that you voluntarily provide through the Platform, including:

Account Information: Name, email address, phone number, and login credentials when creating or managing an account.
Patient Information: Date of birth, insurance details, physician information, and demographic information submitted during eligibility verification or compliance review processes.
Medical Documentation: Documents uploaded for compliance review, including physician orders, insurance cards, referral forms, clinical notes, face-to-face encounter documentation, OASIS assessments, plan of care documents, and related materials.
Family and Caregiver Information: Names and contact details of family members, caregivers, or authorized representatives you choose to associate with a case.
Communications: Messages, phone numbers, and other information you provide when contacting us, requesting assistance, or using Platform support features (including the “May we help?” option).
Newsletter Information: Email addresses provided when subscribing to TrueTime 10 or other communications.

Information Collected Automatically

When you access or use the Platform, we may automatically collect:

Device and Browser Information: IP address, browser type, operating system, device identifiers, and similar technical information.
Usage Data: Pages visited, features used, timestamps, clickstream data, and referring URLs.
Cookies and Similar Technologies: Cookies and related technologies used to maintain sessions, support security, remember preferences, and improve Platform functionality.

Information from Third Parties

We may receive information from home health agencies, hospice agencies, referral sources, healthcare providers, or clinical reviewers who participate in your case, but only as necessary to facilitate eligibility verification, compliance reviews, clearance record generation, and care coordination.

Where a healthcare organization has authorized an electronic medical record (“EMR”) integration under a written agreement, we may also receive information from, and transmit information to, that organization’s EMR system. Information exchanged through such integrations is handled as Protected Health Information under the applicable Business Associate Agreement, and the organization’s own record remains the authoritative legal medical record.

Voice and Telephone Call Information

The Platform includes AI-assisted voice services that answer calls placed to participating agencies’ lines and place outbound welcome, reminder, and check-in calls at the direction of those agencies. When you interact with these services, we collect the phone number used, call metadata (such as date, time, duration, and routing), the audio content of the call, and transcripts of the call.

Calls handled by these services may be recorded, transcribed, and reviewed or scored, by automated systems and by people, for quality assurance, safety, and compliance purposes, where permitted by law. As between TrueTime Health and the participating agency, responsibility for providing any legally required notice of, and obtaining any legally required consent to, the placement and recording of calls rests with the participating agency, as described in our Terms of Service. If you do not wish to receive calls, you may tell the caller, contact the agency serving you, or contact us at the address below.

Assistant Conversations and Feedback

When you use on-Platform assistant features (such as asking a question, reporting a bug, making a feature request, or submitting a message through a chat widget), we collect the content of what you type along with your account context. These features are not intended for patient information, and we apply automated redaction as a safeguard, but you should not enter patient names or details into them.

How We Use Your Information

We use the information we collect for the following purposes:

Eligibility and Compliance Services: To review submitted information and documentation, apply TrueTime Extraction technology and TrueTime Wisdom clinical logic, and support human-verified clearance records across all services including intake and eligibility, pre-claim review, ADR defense, survey readiness, chart reviews, QA, coding, QAPI, discharge readiness, and authorization and benefit verification.
Care Coordination: To generate clearance records, facilitate patient consent, and route eligible cases to appropriate home health and hospice agencies when authorized.
Communication: To respond to inquiries, provide case updates, deliver newsletter content (TrueTime 10), and contact you or your designated representatives regarding case status.
Platform Operations: To operate, maintain, secure, and improve the Platform, including monitoring performance, troubleshooting, and internal analytics.
Voice Services: To answer and place calls on behalf of participating agencies, take and relay messages, escalate calls to human staff, and review and score completed calls for quality, safety, and compliance.
Compliance and Protection: To comply with legal obligations, enforce our terms, prevent misuse, and protect the rights, safety, and property of TrueTime Health, our users, and others.

Artificial Intelligence Processing

The Platform uses artificial intelligence systems, including document extraction, clinical logic, on-Platform assistants, and voice agents, to process information submitted to it. Where that information includes Protected Health Information, AI processing takes place on HIPAA-eligible infrastructure configured under executed Business Associate Agreements.

We may use information that has been de-identified in accordance with HIPAA standards to improve our services and to develop and train our own models. We do not use identifiable information to train AI models, we never permit our AI infrastructure providers to train their general-purpose models on your information, and our agreements with those providers limit their use of your information to providing services to us.
AI outputs that contribute to eligibility or compliance determinations are subject to human verification, and a qualified reviewer may override any automated output.
We do not make decisions that produce legal or similarly significant effects about you solely by automated means.
AI systems can produce inaccurate or incomplete output. Outputs are provided for use within the review workflows described in our Terms of Service and should not be relied on in isolation.

How We Share Your Information

We do not sell your personal information. We share information only in the circumstances described below.

With Your Consent

When you provide explicit authorization, we share your case information — including clearance records and supporting documentation — with home health or hospice agencies for the purpose of arranging care. You may withdraw consent at any time by contacting us, although withdrawal may affect our ability to complete care routing.

With Service Providers

We engage trusted third-party service providers to support Platform operations. These providers are contractually obligated to protect your information and use it only for authorized purposes. The categories of providers we use include:

Cloud hosting, storage, and AI processing: HIPAA-eligible Google Cloud Platform services, including Vertex AI, configured under executed Business Associate Agreements (BAAs) where required.
Telephony and voice: Voice-AI and telecommunications providers that carry, connect, record, and transcribe calls handled by our voice services.
Communications delivery: Email and fax transmission providers used to deliver Platform notifications, case communications, and documents.

Where a provider processes Protected Health Information on our behalf, we require an executed Business Associate Agreement. A current list of subprocessors that process PHI is available to contracting healthcare organizations upon written request.

With Clinical Reviewers

Licensed clinical reviewers who participate in compliance reviews may access submitted documentation and extracted data solely to perform or verify clearance records within the Platform.

For Legal and Compliance Purposes

We may disclose information if required by law, subpoena, court order, or governmental request, or if we believe disclosure is reasonably necessary to protect our rights, prevent fraud, ensure safety, or respond to legal obligations.

In Connection with Business Transfers

If TrueTime Health is involved in a merger, acquisition, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify users of any material change and applicable choices regarding their information.

HIPAA Compliance

When processing Protected Health Information (“PHI”) on behalf of covered entities such as home health agencies, hospice agencies, or healthcare providers, TrueTime Health operates as a Business Associate under HIPAA.

In this capacity, we:

Maintain Business Associate Agreements with covered entities and applicable subcontractors.
Implement administrative, physical, and technical safeguards in accordance with the HIPAA Security Rule.
Limit use and disclosure of PHI to the minimum necessary for the intended purpose.
Maintain audit logs of access to and actions taken on PHI.
Report breaches of unsecured PHI in accordance with the HIPAA Breach Notification Rule.
Designate a Privacy Officer — currently Sumit Arora, Founder & CEO — responsible for overseeing HIPAA privacy compliance, handling privacy-related inquiries, and managing breach notification procedures.

In certain contexts — such as when individuals submit information directly without involvement of a covered entity — TrueTime Health may act as an independent service provider rather than as a Business Associate.

Data Security

We use industry-standard safeguards to protect information, including:

Encryption of data in transit (TLS/SSL) and at rest.
Multi-factor authentication for all accounts.
Role-based access controls aligned with user roles (patient, clinical reviewer, agency, administrator).
Comprehensive audit logging of document access, compliance review actions, and routing events.
Continuous infrastructure monitoring and regular security assessments.
Secure authentication mechanisms for all accounts.

No system can guarantee absolute security, but we are committed to promptly addressing and mitigating any security incidents.

Data Retention

We retain information only as long as necessary to fulfill the purposes described in this Privacy Policy and to comply with legal obligations.

Eligibility and clearance records: Retained for a minimum of six (6) years from the final clearance record, consistent with HIPAA requirements.
Compliance review records: Retained for a minimum of six (6) years from the date of review, consistent with HIPAA and applicable regulatory requirements.
Account information: Retained while the account remains active and for a reasonable period thereafter.
Call recordings and transcripts: Retained consistent with our retention schedule, our agreements with participating agencies, and applicable legal requirements, and treated as PHI where they contain patient information.
Newsletter subscriber information: Retained while the subscription remains active. Users may unsubscribe at any time.
Usage and technical data: May be retained in aggregated or de-identified form for analytics and Platform improvement.

You may request deletion of your account and associated data. Deletion requests will be honored to the extent permitted by law and do not apply to records we are required to retain under HIPAA or other legal obligations.

Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

Request access to your personal information.
Request correction of inaccurate or incomplete data.
Request deletion of personal information (subject to legal retention requirements).
Request a portable copy of your data.
Opt out of non-essential communications.
Withdraw consent for information sharing.
Unsubscribe from newsletter communications at any time.

For HIPAA-covered information, you may also request an accounting of disclosures and request restrictions on certain uses of your PHI.

To exercise these rights, contact us using the information below.

State-Specific Privacy Rights

TrueTime Health operates nationally and is committed to complying with applicable state privacy and data protection laws. Depending on where you reside, you may have additional rights under state law. Below is a summary of key state frameworks and the rights they provide.

California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), may provide you with additional rights, including:

Right to Know: You may request the categories and specific pieces of personal information we have collected, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share information.
Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
Right to Correct: You may request correction of inaccurate personal information.
Right to Opt Out of Sale or Sharing: We do not sell personal information or share it for cross-context behavioral advertising. No opt-out action is required.
Right to Limit Use of Sensitive Personal Information: You may request that we limit the use of sensitive personal information to purposes necessary to provide the services you have requested.
Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To the extent TrueTime Health processes information that is governed by HIPAA, such information may be exempt from certain CCPA/CPRA requirements. We will clearly inform you which framework applies to your information upon request.

Texas Residents (TDPSA)

If you are a Texas resident, the Texas Data Privacy and Security Act (“TDPSA”) may provide you with additional rights, including:

Right to Access: You may confirm whether we are processing your personal data and access that data.
Right to Correct: You may request correction of inaccurate personal data.
Right to Delete: You may request deletion of personal data you have provided to us or that we have obtained about you.
Right to Data Portability: You may request a copy of your personal data in a portable, readily usable format.
Right to Opt Out: You may opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects.
Right to Appeal: If we deny your request, you have the right to appeal the decision.

New York Residents (SHIELD Act)

The New York Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”) requires businesses that hold private information of New York residents to implement reasonable data security safeguards. TrueTime Health maintains the administrative, technical, and physical safeguards described in this Privacy Policy to comply with SHIELD Act requirements. In the event of a data breach involving your private information, we will notify you in accordance with New York notification requirements.

Virginia Residents (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act (“VCDPA”) may provide you with additional rights, including:

Right to Access: You may confirm whether we are processing your personal data and access that data.
Right to Correct: You may request correction of inaccuracies in your personal data.
Right to Delete: You may request deletion of personal data you have provided or that we have obtained.
Right to Data Portability: You may request a copy of your personal data in a portable format.
Right to Opt Out: You may opt out of the processing of personal data for targeted advertising, sale, or profiling.
Right to Appeal: If we decline your request, you may appeal the decision, and we will respond within sixty (60) days.

Colorado Residents (CPA)

If you are a Colorado resident, the Colorado Privacy Act (“CPA”) may provide you with additional rights, including:

Right to Access: You may confirm whether we are processing your personal data and access that data.
Right to Correct: You may request correction of inaccuracies.
Right to Delete: You may request deletion of personal data.
Right to Data Portability: You may obtain a copy of your personal data in a portable format.
Right to Opt Out: You may opt out of targeted advertising, sale of personal data, or certain profiling.

Connecticut Residents (CTDPA)

If you are a Connecticut resident, the Connecticut Data Privacy Act (“CTDPA”) provides rights similar to those described above for Virginia and Colorado residents, including rights to access, correct, delete, and obtain a portable copy of your personal data, as well as the right to opt out of targeted advertising, sale, and profiling.

Other States

Additional states have enacted or may enact consumer privacy legislation, including but not limited to Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island. TrueTime Health is committed to monitoring and complying with emerging state privacy laws as they take effect.

If you are a resident of any state with applicable privacy legislation and wish to exercise your rights, please contact us at the address below. We will respond to verified requests within the timeframes required by applicable law.

Exercising State-Specific Rights

To submit a request under any applicable state privacy law:

Email us at admin@truetime.health with the subject line “State Privacy Request.”
Include your full name, state of residence, and a description of the right you wish to exercise.
We may ask you to verify your identity before fulfilling a request to protect your information.
We will respond to verified requests within the timeframes required by applicable state law (generally 30 to 45 days, with extensions where permitted).

We do not charge a fee for processing privacy requests unless a request is manifestly unfounded, excessive, or repetitive, as permitted by applicable law.

Cookies and Tracking Technologies

We use cookies and similar technologies to support Platform functionality and performance:

Essential Cookies: Required for security, authentication, and core functionality.
Analytics Cookies: Used to understand usage patterns and improve the Platform.

We do not use cookies for behavioral advertising or cross-site tracking. You may control cookie preferences through your browser settings, though disabling essential cookies may limit functionality.

Children's Privacy

Accounts must be created by individuals aged 18 or older. Patient information submitted through the Platform may relate to minors when provided by a parent, legal guardian, or authorized caregiver. We do not knowingly collect personal information directly from children without appropriate authorization.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When material changes occur, we will update the “Last Updated” date and provide notice through the Platform or by email where appropriate.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact:

TrueTime Health, Inc.
Privacy Officer: Sumit Arora, Founder & CEO
Email: admin@truetime.health
Website: https://truetime.health

For HIPAA-related inquiries, breach notifications, or to exercise rights regarding Protected Health Information, please contact our Privacy Officer at the email address above.