Privacy Policy

vkWorkforce is a multi-tenant workforce and home-care platform operated by VisionKraft Consulting (“vkTech”, “we”, “us”). Staffing and home-care agencies (each an “Agency”) use it to recruit and onboard workers, schedule shifts and home visits, record time and visit verification (EVV), keep client care records, bill payers, verify credentials and communicate by phone, text and email. This policy describes what the platform actually processes, who it is shared with, how long it is kept, and the choices you have.

Who is responsible for your data

The Agency that employs you, received your application, or provides your (or your family member’s) care decides why and how your information is used. It is the controller of that information and, for home-care health information, the HIPAA covered entity. vkTech processes that information only on the Agency’s instructions, as its service provider and, for protected health information (PHI), as its business associate. vkTech is the controller only of the information it needs to run, secure, bill for and audit the platform itself (for example Agency account contacts and security logs).

For access, correction or deletion requests, or questions about an employment or care decision, contact the Agency first. For questions about the platform, email privacy@vktech.ai; we route requests to the right Agency.

Information the platform processes

• Identity and contact data: name, email, phone, address, emergency contacts, account identifiers.
• Applicant and employment data: resumes, work history, licences and credentials (with expiry dates), availability, pay rates, time off, forms, payroll and paystub data, and HR records. Some HR fields (such as government identifiers) are stored encrypted.
• Home-care client information (PHI): client profiles, care plans and tasks, visit notes and charts, vitals, service authorizations and payer details, family contacts, and visit sign-offs. Agencies may also sync this from systems they already use, such as AxisCare.
• Time, location and visit verification: clock-in and clock-out times, the location submitted at each, distance to the work site, override reasons, breaks and signatures. For home-care workers, the app records a location trail from clock-in to clock-out while a shift is running, including in the background. Location is not collected outside a shift for this purpose.
• Workplace monitoring, only where an Agency turns it on: webcam snapshots, activity signals and location during working time, with AI-assisted presence and activity scoring. Monitoring starts only after the worker has seen the disclosure and given consent, which we record with its date, the text shown, IP address and device.
• Calls and messages: call logs, SMS, WhatsApp and email content and metadata, voicemail and transcripts. Call recording is off unless the Agency turns it on; when it is on, every recorded call begins with the announcement “This call may be recorded for quality and training” before recording starts, and recordings are deleted after 90 days.
• Voice dictation in the mobile app, which uses the device’s own speech recognition (Apple or Google may process the audio). You are shown a notice first and can always type instead.
• Background checks and screening: your authorization, report status, and pre-adverse and adverse action notices (see “Background checks” below); licence verification; and, where enabled, checks against the public OIG and SAM exclusion lists.
• Device and security data: IP address, browser and device details, sign-in events and audit logs.
• Business contact data about facilities and referral partners, from public sources, used by Agencies for client development.

How it is used

• To recruit, onboard, schedule and pay workers, and to keep the records employment and wage laws require.
• To deliver, document and verify home-care visits, and to bill payers (including submitting claims to the VA’s claims processor).
• To send shift, visit, credential and account messages by text, push notification, email or phone.
• To verify credentials and run background checks the Agency requests, with your authorization.
• To secure the platform, investigate incidents and keep audit trails.

We do not sell or share personal information for advertising, and we do not use Agency data to train AI models. The web app has no third-party analytics or advertising cookies; it uses a sign-in session cookie only.

AI-assisted features

Agencies can use AI to sort and summarise email and text threads, extract details from documents and business cards, draft messages, answer and place phone calls, transcribe calls, and score monitoring captures. Before email and text content is sent to an AI model, phone numbers, Social Security numbers, dates of birth and email addresses are removed. Some tasks run on AI models on dedicated servers we operate or rent; others use the AI providers listed below. AI output is advisory and can be wrong. Agencies should review it before relying on it, and each Agency can switch AI features off.

Who we share it with

Information is shared with the Agency that uses the platform, and with the service providers (subprocessors) we use to run it, only as needed for those services:

• Hosting and network: our own servers; Cloudflare (network and encryption in transit); DigitalOcean (file storage).
• Phone and messaging: Twilio and Telnyx (calls and texts), TextUs (texts), Meta WhatsApp Business (messages), SendGrid (email), Google (Gmail and Calendar, when an Agency connects its own accounts).
• Push notifications: Apple and Google.
• AI: Anthropic, OpenAI and xAI (text, document, image and voice processing); ElevenLabs (synthetic voice).
• Maps: Google Maps Platform and Mapbox (addresses, routes and navigation).
• Screening: Checkr (background checks, where an Agency orders them), Nursys (licence verification), and the public OIG and SAM exclusion lists.
• Billing: the VA’s claims processor (PGBA, for TriWest Community Care Network claims) and vkPay (payment links on invoices).
• Systems the Agency already uses, such as AxisCare or symplr, when the Agency connects them.

We may also disclose information when the law requires it, to protect someone’s safety, or as part of a merger or sale, subject to this policy. A current subprocessor list is available from privacy@vktech.ai.

Security

Connections are encrypted in transit. Integration credentials and sensitive HR fields are encrypted at rest with a dedicated, rotatable key. Access is limited by role, separated by Agency, and logged; viewing recordings and exporting reports are audited. No system is perfectly secure. If a breach affects your information, the Agency and, where required, you will be notified as the law requires.

How long it is kept

• Employment, timekeeping, care and billing records are kept for as long as the Agency uses the platform, plus whatever period the Agency must keep them under law (healthcare and payroll records often for six years or more). The Agency sets that schedule.
• Call recordings are deleted after 90 days.
• Background-check signing links expire after 7 days.
• Short-lived operational records (job queues, API request logs) are deleted after 2 to 90 days.
• Audit and security logs are kept long-term as compliance evidence.
• When a record or an Agency account is deleted, its data and files are deleted with it.

Background checks

An Agency can only order a background check after you have read a separate, standalone disclosure and authorized it in writing, either by signing online through a link the Agency sends you or on a paper form. If the Agency is considering a decision based on the report, it must first send you a pre-adverse action notice with a copy of the report and A Summary of Your Rights Under the Fair Credit Reporting Act, and wait before making a final decision. Any final adverse action notice names the reporting company and explains your right to a free copy of the report and to dispute it.

Your choices and rights

• Reply STOP to any text to opt out, or HELP for help.
• You can decline workplace monitoring, call recording (by ending the call), dictation and background-check authorization; the Agency will tell you if declining affects your work.
• Depending on where you live, you may have the right to access, correct, delete or get a copy of your information, and to appeal a refusal. Under HIPAA, clients can ask the Agency for their health records. Send requests to the Agency, or to privacy@vktech.ai and we will route them.
• Washington residents: health information not covered by HIPAA (for example from a family portal) is handled under the My Health My Data Act. We do not sell it, and we collect and share it only to provide the service you or the Agency requested.
• To delete your vkWorkforce account, see Delete your account. Agencies may have to keep some records by law.

Children

The platform is not directed at children under 16. Information about minors appears only where an Agency provides care to them, under the Agency’s responsibility.

Changes and contact

We will post material changes here with a new date. Contact: privacy@vktech.ai, VisionKraft Consulting, Washington, USA.