Privacy Policy for True Harbor

Our Role: Information We Process for Agencies vs. Information We Collect Directly

True Harbor serves agencies and the staff they authorize. Our handling of information falls into two categories:

• Information we process on behalf of agencies. When an agency uses True Harbor, it submits records about the children, families, caregivers, and other individuals it serves. The agency is the controller of that information and is responsible for its collection and use. We process it only as a service provider, on the agency's behalf and in accordance with our agreement with the agency. This Privacy Policy does not govern an agency's own privacy practices; please contact the relevant agency with questions about how it handles your information.
• Information we collect directly. When you visit our website or use True Harbor as an authorized user, we collect information about you as described below, and we act as the controller of that information.

Data Ownership and Control

The records an agency submits about the children, families, and caregivers it serves belong to that agency and the jurisdiction that collected them, not to True Harbor. We access and process this information only as a service provider, under our agreement with the agency, and solely to provide and support the services the agency has asked us to perform.

We do not pool different agencies' records into a combined dataset of the people they serve, and we do not use one agency's information to serve another or for any purpose beyond delivering the service to that agency. Each agency's records are segregated by per-organization access controls so that no agency can access another agency's data, and the agency directs how its information is accessed, corrected, exported, and deleted.

Information We Collect

We collect the following categories of information:

• Personal information: Your name, email address, phone number, and other contact information you provide to us.
• Account information: Your username, password, role, and agency affiliation within True Harbor.
• Usage information: Information about how you use True Harbor, including your activity, the pages you visit, and the features you use.
• Device information: Information about the device you use to access True Harbor, including your IP address, browser type, and operating system.

We collect this information when you provide it to us directly, automatically as you use True Harbor, and, in limited cases, from third-party sources such as identity and authentication providers you choose to connect.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve True Harbor.
• Communicate with you about True Harbor, including responding to your requests and inquiries and sending service and security notices.
• Personalize your experience with True Harbor.
• Prevent fraud and protect the security of True Harbor and our users.
• Comply with legal obligations.

We may also use your information for other purposes with your consent or as permitted or required by law. We do not use information we process on behalf of agencies for our own marketing or advertising, and we do not sell personal information. Any use of agency information in aggregated or de-identified form, whether for research, evaluation, or improving True Harbor, happens only with the agency's permission and in a form that does not identify individuals.

Text Messaging (SMS)

True Harbor sends SMS and other text messages on behalf of agencies (for example, case-related notifications and outreach) using third-party messaging carriers. When a phone number is enrolled to receive messages, we use it to deliver those messages and to manage opt-in and opt-out requests.

Message frequency varies. Message and data rates may apply. You can opt out of text messages at any time by replying STOP to any message, and you can reply HELP for assistance. Opting out of messages does not remove your information from an agency's records.

We do not sell or share mobile information or SMS opt-in or consent information with third parties or affiliates for their own marketing or promotional purposes. Phone numbers are shared only with the messaging carriers and service providers needed to deliver the messages you have agreed to receive.

How We Share Your Information

We may share your information with third parties for the following purposes:

• Service Providers: We share information with third-party service providers who help us operate, maintain, and improve True Harbor, including hosting, cloud storage, messaging, payment processing, and customer support providers, and, only for agencies that turn on an optional AI feature, an AI model provider. These providers are bound by contract to use the information only to provide services to us.
• The Agency: We share information you submit with the agency that authorized your account, consistent with that agency's use of True Harbor.
• Legal Compliance: We may share information in response to a subpoena, court order, or other legal request, or to comply with applicable laws and regulations.
• Protection of Rights: We may share information to protect the rights, property, or safety of True Harbor, our users, or others.
• Business Transactions: We may share information in connection with a merger, acquisition, financing, or other business transaction, subject to the commitments in this Privacy Policy.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Cookies and Tracking

We use cookies and similar technologies that are strictly necessary to operate True Harbor (for example, to keep you signed in and to secure your session), along with limited analytics to understand how the application is used. You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of True Harbor may become inaccessible or stop functioning properly.

Data Retention

We retain the personal information we collect directly for as long as needed to provide True Harbor, to comply with our legal obligations, to resolve disputes, and to enforce our agreements.

Information we process on behalf of an agency is retained according to that agency's instructions and our agreement with the agency. When an agency's engagement with True Harbor ends, we delete or return that information within the timeframe set out in our agreement, and we do not retain it afterward except where the agency specifically authorizes it or where retention is required by law. We maintain a documented process for the secure disposition of agency information at the end of the engagement.

Your Privacy Rights

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, or receive a copy of your information, and the right to opt out of the sale or sharing of your information and of targeted advertising. True Harbor does not sell personal information or share it for cross-context behavioral advertising.

To exercise these rights with respect to information we collect directly, contact us at support@trueharbor.io. We will not discriminate against you for exercising your rights, and we may need to verify your identity before responding. If your information was submitted to True Harbor by an agency, please direct your request to that agency; we will assist the agency in responding as required.

Privacy by Design and Data Minimization

We build privacy protections into True Harbor from the start. We collect only the information needed to provide the service, limit access to it through role-based permissions, and design our features to keep each agency's data segregated and protected by default.

Security

We take reasonable administrative, technical, and physical measures designed to protect your information, including encryption of data in transit, access controls, and authentication safeguards. Our safeguards are designed to align with recognized federal and state security standards for handling sensitive information. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee the absolute security of your information.

Responsible Use of Decision-Support Tools

Where True Harbor offers tools that surface recommendations or otherwise support decisions, those tools are designed to assist authorized staff, not to replace their judgment. A qualified person always reviews and remains responsible for decisions about the children and families an agency serves. We aim to be transparent about how these tools work, and agencies can contact us at support@trueharbor.io to raise questions or report concerns about a tool's output.

Optional AI Features

True Harbor offers optional features that use artificial intelligence, such as Cap'n Saige, an assistant that answers staff questions about an agency's records. These features are off by default. We turn one on for an agency only at the agency's request and after the agency's agreements with us are in place, and the agency's administrators choose which staff can use it. While an AI feature is off for an agency, none of that agency's information is sent to an AI model for that feature. Everything in this section applies only to agencies that have turned the feature on.

When an agency turns on Cap'n Saige:

• What is shared. To answer a question, Cap'n Saige sends the question and the information needed to answer it to an AI model, limited to records the person asking is already permitted to see in True Harbor. This can include names, statuses, dates, cities and states, ages, staff names, and the text of notes and messages. It leaves out the phone numbers, email addresses, street addresses, birthdates, and race saved on people and families.
• Where it is processed. The AI model is hosted by Amazon Web Services through Amazon Bedrock and processes information in data centers in the United States. Amazon Bedrock does not use this information to train AI models and does not share it with the model's developer.
• Read-only. Cap'n Saige can look up information but cannot create, change, delete, or send anything, and it does not take actions on anyone's behalf.
• Conversation history. Conversations are stored in True Harbor as part of the agency's records, and each staff member can see only their own. A conversation a staff member deletes is hidden from them but kept. Conversation history is retained and deleted along with the rest of the agency's information, as described under Data Retention.
• Quality review. When a staff member rates an answer, True Harbor's support team may review that answer, the question behind it, and any comment, to improve the feature. The agency's administrators cannot read staff conversations.
• Activity log. When an agency's activity log is turned on, each lookup Cap'n Saige runs is recorded there with who asked and what was looked up.
• AI tools an agency connects. An agency may also connect AI tools of its own choosing to True Harbor using API keys its staff create. Information those tools retrieve is handled by the provider the agency chose, under the agency's own agreements with that provider, and the commitments in this section about processing location and model training do not apply to it.

AI-generated answers can be incomplete or inaccurate. They are offered to support staff, as described under Responsible Use of Decision-Support Tools, and staff should check them against the underlying records before relying on them.

Data Breach Notification

If we become aware of a security incident affecting personal information, we will notify affected agencies and, where required by law, affected individuals and regulators, without undue delay and in accordance with applicable law.

International Users

True Harbor is based in and operated from the United States and is intended for use by agencies and users in the United States. If you access True Harbor from outside the United States, your information will be processed and stored in the United States, where data protection laws may differ from those in your country. By using True Harbor, you consent to this transfer.

Children

True Harbor is a tool for agency professionals and is not directed to children, and we do not knowingly allow children to create accounts. Agencies may, in the course of their work, submit records about children to True Harbor; we process that information only as a service provider on the agency's behalf and protect it under this Privacy Policy and our agreements with the agency.

Changes to Our Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on True Harbor prior to the effective date of the changes. By continuing to use True Harbor after the effective date of any changes, you agree to be bound by the updated policy.

Contact Us

If you have any questions or concerns about this Privacy Policy or our practices, or to exercise your privacy rights, please contact us at support@trueharbor.io.