Privacy Policy for True Harbor

Our Role: Information We Process for Agencies vs. Information We Collect Directly

True Harbor serves agencies and the staff they authorize. Our handling of information falls into two categories:

• Information we process on behalf of agencies. When an agency uses True Harbor, it submits records about the children, families, caregivers, and other individuals it serves. The agency is the controller of that information and is responsible for its collection and use. We process it only as a service provider, on the agency's behalf and in accordance with our agreement with the agency. This Privacy Policy does not govern an agency's own privacy practices; please contact the relevant agency with questions about how it handles your information.
• Information we collect directly. When you visit our website or use True Harbor as an authorized user, we collect information about you as described below, and we act as the controller of that information.

Data Ownership and Control

The records an agency submits about the children, families, and caregivers it serves belong to that agency and the jurisdiction that collected them, not to True Harbor. We access and process this information only as a service provider, under our agreement with the agency, and solely to provide and support the services the agency has asked us to perform.

We do not pool different agencies' records into a combined dataset of the people they serve, and we do not use one agency's information to serve another or for any purpose beyond delivering the service to that agency. Each agency's records are segregated by per-organization access controls so that no agency can access another agency's data, and the agency directs how its information is accessed, corrected, exported, and deleted.

Information We Collect

We collect the following categories of information:

• Personal information: Your name, email address, phone number, and other contact information you provide to us.
• Account information: Your username, password, role, and agency affiliation within True Harbor.
• Usage information: Information about how you use True Harbor, including your activity, the pages you visit, and the features you use.
• Device information: Information about the device you use to access True Harbor, including your IP address, browser type, and operating system.

We collect this information when you provide it to us directly, automatically as you use True Harbor, and, in limited cases, from third-party sources such as identity and authentication providers you choose to connect.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve True Harbor.
• Communicate with you about True Harbor, including responding to your requests and inquiries and sending service and security notices.
• Personalize your experience with True Harbor.
• Prevent fraud and protect the security of True Harbor and our users.
• Comply with legal obligations.

We may also use your information for other purposes with your consent or as permitted or required by law. We do not use information we process on behalf of agencies for our own marketing or advertising, and we do not sell personal information. Any use of agency information in aggregated or de-identified form, whether for research, evaluation, or improving True Harbor, happens only with the agency's permission and in a form that does not identify individuals.

Text Messaging (SMS)

True Harbor sends SMS and other text messages on behalf of agencies (for example, case-related notifications and outreach) using third-party messaging carriers. When a phone number is enrolled to receive messages, we use it to deliver those messages and to manage opt-in and opt-out requests.

Message frequency varies. Message and data rates may apply. You can opt out of text messages at any time by replying STOP to any message, and you can reply HELP for assistance. Opting out of messages does not remove your information from an agency's records.

We do not sell or share mobile information or SMS opt-in or consent information with third parties or affiliates for their own marketing or promotional purposes. Phone numbers are shared only with the messaging carriers and service providers needed to deliver the messages you have agreed to receive.

How We Share Your Information

We may share your information with third parties for the following purposes:

• Service Providers: We share information with third-party service providers who help us operate, maintain, and improve True Harbor, including hosting, cloud storage, messaging, payment processing, and customer support providers. These providers are bound by contract to use the information only to provide services to us.
• The Agency: We share information you submit with the agency that authorized your account, consistent with that agency's use of True Harbor.
• Legal Compliance: We may share information in response to a subpoena, court order, or other legal request, or to comply with applicable laws and regulations.
• Protection of Rights: We may share information to protect the rights, property, or safety of True Harbor, our users, or others.
• Business Transactions: We may share information in connection with a merger, acquisition, financing, or other business transaction, subject to the commitments in this Privacy Policy.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Cookies and Tracking

We use cookies and similar technologies that are strictly necessary to operate True Harbor (for example, to keep you signed in and to secure your session), along with limited analytics to understand how the application is used. You can set your browser to refuse all or some cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of True Harbor may become inaccessible or stop functioning properly.

Data Retention

We retain the personal information we collect directly for as long as needed to provide True Harbor, to comply with our legal obligations, to resolve disputes, and to enforce our agreements.

Information we process on behalf of an agency is retained according to that agency's instructions and our agreement with the agency. When an agency's engagement with True Harbor ends, we delete or return that information within the timeframe set out in our agreement, and we do not retain it afterward except where the agency specifically authorizes it or where retention is required by law. We maintain a documented process for the secure disposition of agency information at the end of the engagement.

Your Privacy Rights

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, delete, or receive a copy of your information, and the right to opt out of the sale or sharing of your information and of targeted advertising. True Harbor does not sell personal information or share it for cross-context behavioral advertising.

To exercise these rights with respect to information we collect directly, contact us at support@trueharbor.io. We will not discriminate against you for exercising your rights, and we may need to verify your identity before responding. If your information was submitted to True Harbor by an agency, please direct your request to that agency; we will assist the agency in responding as required.

Privacy by Design and Data Minimization

We build privacy protections into True Harbor from the start. We collect only the information needed to provide the service, limit access to it through role-based permissions, and design our features to keep each agency's data segregated and protected by default.

Security

We take reasonable administrative, technical, and physical measures designed to protect your information, including encryption of data in transit, access controls, and authentication safeguards. Our safeguards are designed to align with recognized federal and state security standards for handling sensitive information. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee the absolute security of your information.

Responsible Use of Decision-Support Tools

Where True Harbor offers tools that surface recommendations or otherwise support decisions, those tools are designed to assist authorized staff, not to replace their judgment. A qualified person always reviews and remains responsible for decisions about the children and families an agency serves. We aim to be transparent about how these tools work, and agencies can contact us at support@trueharbor.io to raise questions or report concerns about a tool's output.

Data Breach Notification

If we become aware of a security incident affecting personal information, we will notify affected agencies and, where required by law, affected individuals and regulators, without undue delay and in accordance with applicable law.

International Users

True Harbor is based in and operated from the United States and is intended for use by agencies and users in the United States. If you access True Harbor from outside the United States, your information will be processed and stored in the United States, where data protection laws may differ from those in your country. By using True Harbor, you consent to this transfer.

Children

True Harbor is a tool for agency professionals and is not directed to children, and we do not knowingly allow children to create accounts. Agencies may, in the course of their work, submit records about children to True Harbor; we process that information only as a service provider on the agency's behalf and protect it under this Privacy Policy and our agreements with the agency.

Changes to Our Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on True Harbor prior to the effective date of the changes. By continuing to use True Harbor after the effective date of any changes, you agree to be bound by the updated policy.

Contact Us

If you have any questions or concerns about this Privacy Policy or our practices, or to exercise your privacy rights, please contact us at support@trueharbor.io.