Privacy Policy

Tunzly (“Tunzly”, “we”, “us”) provides a software platform that helps home-care agencies manage scheduling, client records, caregivers, electronic visit verification, e-signatures, billing and related operations. This policy explains what information we collect through tunzly.com and the Tunzly application, how we use it, and the choices you have. Questions: hello@tunzly.com.

• Account information — name, work email, phone number, role, and password (stored as a salted hash) when you or your agency create an account.
• Agency data — information your agency enters to run its operations: client and caregiver records, schedules, visit logs, documents, messages, billing and claims data.
• Usage data — log and device information such as IP address, browser type, pages viewed, and actions taken, used for security auditing and to improve the product.
• Cookies and similar technologies — we use only the cookies and local storage needed to sign you in and keep your session secure. We do not use third-party advertising cookies.

Home-care agencies use Tunzly to manage information about their clients, which may include protected health information (“PHI”) under HIPAA. For that data, the agency is the covered entity (or business associate of one) and Tunzly acts as a business associate, processing PHI only on the agency’s behalf, under a Business Associate Agreement (BAA), and only as needed to provide the service.

We do not sell PHI, use it for advertising, or use it to train artificial-intelligence models. AI features route PHI exclusively through infrastructure covered by our BAAs with providers operating under zero-data-retention terms.

• Provide, operate, secure and support the service
• Send transactional messages: invitations, verification codes, password resets, notifications your agency configures
• Monitor for abuse, fraud and security incidents, and maintain audit trails required in healthcare settings
• Improve the product using aggregate, de-identified usage patterns
• Comply with law and enforce our agreements

We rely on a small set of infrastructure providers to run Tunzly, each bound by contract to protect your data: Amazon Web Services (hosting, storage, email delivery), Stripe (payments), Twilio and Aircall (telephony and SMS when your agency enables them), and Google (optional sign-in and calendar sync). Where a provider may handle PHI, we maintain a BAA with them. We never sell personal information.

Data is encrypted in transit (TLS) and at rest. Sensitive fields are additionally encrypted with per-agency keys managed in a hardware-backed key-management service. Access is role-based, logged, and reviewed; signing credentials rotate automatically. No method of transmission or storage is perfectly secure, but we design for defense in depth and least privilege.

We retain account and agency data for as long as the agency’s subscription is active, plus any period required by law or by the agency’s own healthcare record-retention obligations. Agencies can export their data and request deletion at any time; signed care documents may be retained in write-once storage where regulations require it. Contact hello@tunzly.com to make a request.

Depending on where you live, you may have rights to access, correct, export or delete personal information we hold about you. If your information was entered by a home-care agency, we may direct your request to that agency, since they control the record. We respond to verified requests within the timelines required by applicable law.

Tunzly is a business tool and is not directed to children under 16. We do not knowingly collect information from children for our own purposes.

If we make material changes, we will update the effective date above and notify agency administrators by email or an in-app notice before the changes take effect.

Tunzly · hello@tunzly.com · https://tunzly.com