Privacy Policy

Who we are

HiveCompass is operated by Maxivize ("we") for social-care agencies in New York's Social Care Network program. Agencies use HiveCompass to coordinate services for their clients. Maxivize is a business associate of each agency under a Business Associate Agreement (BAA) and handles protected health information (PHI) only as that agreement and HIPAA allow.

What we hold

For agency staff: name, work email, role, sign-in activity. For referral partners: name, work email, organisation. For clients of an agency: the record the agency keeps (contact details, Medicaid identifiers, needs, services, notes, call recordings and transcripts where consent was given, documents). Clients' information belongs to the agency serving them; we process it on the agency's instructions.

Staff who choose to sign in with Microsoft 365 or Google share their name and email address (and, from Google, a profile picture link) with us that way; we use the email address only to match the account their agency invited. No client information is sent to Microsoft or Google through sign-in.

How we use it

To run the service the agency asked for: intake, screening, care coordination, service authorisations, deliveries, billing, and messages the client agreed to receive. To keep the service secure and to meet legal obligations. We do not sell information, use it for advertising, or train general-purpose AI models on it. Our AI features run under a BAA-covered contract with the model provider, with the minimum information needed for each task.

Who sees it

Staff of the agency serving the client, according to their role. Referral partners see only whether a referral is progressing, never a client's needs or notes. Our own staff see client information only through time-limited, logged support access at an agency's request. Vendors that store or transmit data for us (Microsoft Azure, Supabase, OpenAI) do so under BAAs.

Messages and recordings

Clients receive texts or emails only after consenting, in their language, with no health details. Calls are recorded only after an announcement and can be declined at any moment; recordings are kept for the period the agency sets and are deleted after it unless a legal hold applies.

The HiveCompass Bridge browser extension

Agency staff can install the HiveCompass Bridge in Microsoft Edge or Google Chrome. It works only on Unite Us pages and on the agency's own HiveCompass pages, only while the staff member is signed in to both, and only under that person's own logins. It fills in Unite Us forms from the HiveCompass record and sends back to HiveCompass what was recorded in Unite Us: client identifiers such as the Medicaid number, case, referral and authorization numbers, statuses, dates and amounts. Everything it reads is protected health information handled under the agency's BAA.

The Bridge sends data only to the agency's HiveCompass account, over encrypted connections. It never reads or stores passwords, never reads other websites or browsing history, and never sends data to anyone else. On the computer it keeps only its settings (the chosen environment, a computer name, and for the daily Agency Sync a device token issued by the agency) and a short list of captures waiting to be sent. We do not sell this data, use it for advertising, or use it for anything other than keeping the agency's HiveCompass record in step with Unite Us. Removing the extension deletes what it kept on the computer.

Retention

Client records are kept for 10 years after services end (for minors, until age 19 or 6 years, whichever is later), as New York Medicaid rules require, then deleted unless a legal hold applies. Audit logs are kept immutably for 10 years.

Your choices

Clients can ask their agency to see, correct or stop messages at any time, and can withdraw consent to recording or messaging. Staff and partners can update their profile in the app. Privacy questions: support@myhivecompass.com.