Privacy notice

AcuityRow, Llc ("AcuityRow", "we", "us") provides operating software to licensed senior living operators. This notice describes how we handle personal information collected through our public website, our operator product, and any data feeds an operator chooses to connect.

When an operator uses AcuityRow to handle resident records, we act as a business associate under HIPAA. The operator is the covered entity and remains responsible for resident notice and consent. This notice is not a substitute for the operator's own privacy practices notice.

We separate collection by source so it is clear what touches PHI and what does not.

• Public site: page views, IP, device and browser type, and information you submit in the request-access or contact forms (name, work email, organization, role, facility count, care setting, message).
• Operator product: account identifiers, role assignments, audit logs of every sign-in, signal review, approval, and family update action.
• Connected data feeds: resident records, staffing schedules, medication and incident events, and family contact information that the operator imports from systems like PointClickCare, MatrixCare, UKG, or ADP. This may include PHI.

• To assemble the daily morning brief, resident risk queue, staffing fit view, and family update draft queue requested by the operator.
• To produce an audit and survey trail for the operator's clinical and compliance teams.
• To operate, secure, monitor, and improve the service.
• To respond to support, security, or billing inquiries.

We do not sell personal information. We do not use PHI to train general-purpose AI models. Where the product uses AI to summarize or draft language, the prompt and output remain scoped to the operator's account and are not used to improve any third-party model.

Some AcuityRow workflows use AI models to cluster signals, summarize notes, and draft family-facing language. These calls run inside a private inference path governed by our BAA with the underlying provider. Prompts and outputs are logged for audit but are not shared across operators.

Drafts produced by AI are never sent to a resident's family without an approved human reviewer. End-of-life, hospitalization, and incident messages always require a named approver before delivery. See HIPAA & AI use for the full boundary.

• Sub-processors who operate hosting, monitoring, transactional email, and AI inference under written agreements that meet our security and BAA requirements.
• The operator's own users based on role assignments configured in the product.
• Authorities when required by law, and only after the narrowest reasonable response is identified.

We do not share PHI with marketing, advertising, or analytics vendors.

Operator data is retained for the term of the operator's agreement plus the period required to satisfy legal and audit obligations. On request, we will:

• Export the operator's records in a machine-readable format.
• Delete operator data, including PHI, within thirty (30) days of contract termination, unless retention is required by law.
• Honor verifiable individual rights requests routed to us by the operator (the covered entity).

Encryption in transit and at rest, role-based access, least-privilege internal access, audit logging of administrative actions, and incident response procedures. A BAA is signed before any production PHI is connected. See the trust center for the operator-facing version.

The public site uses a small number of strictly necessary cookies and privacy-respecting analytics. Operator product sessions use authentication cookies only. See the cookie policy.

Material changes will be communicated to operator administrators in product and by email. The "last reviewed" date above reflects the most recent substantive update.

Privacy questions: privacy@acuityrow.com. Security disclosures: security@acuityrow.com.