The short version: on caylo.app we only collect what you type into the pilot request form. In the Caylo app and the Office, the records your staff write belong to your agency, and we handle them under a Business Associate Agreement. We never sell information, never advertise with it, and never use member information to train AI. Email hello@caylo.app with any question.
1. Who we are and what this covers
Caylo is a product of Caylo LLC (“Caylo,” “we,” “us”), an Arizona limited liability company in Phoenix, Arizona. Caylo is a phone app and an Office for Arizona Division of Developmental Disabilities (DDD) day programs. This policy covers:
- Visitors to caylo.app, including people who request a pilot.
- Staff of programs that use Caylo, on the Caylo phone app and in the Office at office.caylo.app.
It does not cover the members a program serves. Their information is protected health information under HIPAA, and the program is responsible for it. It is governed by the program’s own privacy notice and by our Business Associate Agreement (BAA) with the program. Caylo never collects information directly from members.
2. Our role under HIPAA
Caylo is a business associate of each program that uses it. We sign a BAA with the program before any member information goes into Caylo, and the BAA controls if it conflicts with this policy. If you are a member, or speak for one, and want to see, correct or get an accounting of records, contact the program. If you contact us, we will pass your request to the program.
3. What we collect
On caylo.app
| Information | Where it comes from | Why we collect it |
|---|---|---|
| Email address, program name and your role | You, on the pilot request form | To contact you about a pilot |
| Date you sent the form and your country | Added automatically when you send it | To keep requests in order and spot spam |
| Server logs (IP address, browser, pages visited, time) | Your browser, through our hosting provider | To keep the site secure and working |
Please don’t put information about the people your program supports, or any health information, into the website or an email to us.
In the Caylo app and the Office
- Account details: name, work email, role (for example DSP or director), site and account status, set up by your program.
- Sign-in details: sign-in credentials (passwords are handled by Google’s sign-in service and never seen by Caylo), the authenticator app step for the Office, approved phones, and last sign-in.
- Activity: an audit log of who viewed or changed which record and when. HIPAA requires it.
- Your program’s records: the notes, body checks, incident reports, outing details and sign-offs your staff write. These belong to the program.
- Support messages you send us. Please never include member information in them.
Caylo does not use third-party analytics, advertising or crash-reporting tools. If we ever add one, it will receive no member information and we will update this policy first.
4. How we use information
- To run Caylo for your program, keep it secure and fix problems.
- To confirm who is signing in and stop anyone who shouldn’t.
- To keep the audit trail HIPAA requires.
- To answer support requests and tell you about your account.
- To contact you about a pilot, if you asked for one.
- To meet legal duties.
We do not sell, rent or trade information. We do not use it for advertising or marketing lists.
5. AI writing help
Caylo can help staff tidy the wording of a note or report. That help runs only on Google’s Gemini models through Google Cloud Vertex AI, in the United States, under Google’s BAA. Before text is sent, Caylo leaves out member names, member IDs and dates of birth, and we never log what was written or what came back. Under Google Cloud’s terms, it is not used to train Google’s models. We never use member information to train AI. A person always reads and decides what is saved.
6. Who we share it with
- Your program, as needed to run Caylo and as the BAA requires.
- Service providers that help us run Caylo, under contract. Only Google Cloud, under its BAA, ever receives member information. The full list is on our Subprocessors page.
- Legal authorities, when the law, a valid subpoena or a court order requires it, or to protect someone’s safety.
- A buyer, if Caylo is sold. The buyer must keep to this policy, or we will tell you first.
7. How we protect it
Member information is kept only in Google Cloud services covered by Google’s BAA, in the United States, encrypted in transit and at rest. On a phone, only the day’s information is kept, encrypted, behind Caylo’s own lock, and it leaves the phone when the day ends. The Office signs out after 15 minutes without use. Access is enforced on our servers, not only in the app, and every view and change is recorded in an audit log. Our Security page explains more.
No system is perfectly secure. If member information is ever exposed, we tell the program as our BAA requires, and we tell you where Arizona law (A.R.S. § 18-552) requires.
8. How long we keep it
- Pilot requests: until we no longer offer pilots or you ask us to remove you, whichever comes first.
- Staff accounts: while the account is open and up to 30 days after it is closed. Records a person wrote stay with the program’s records, with their name, because those records must show who wrote them.
- Program records: for as long as the program’s agreement and BAA say. When a program leaves Caylo, we give it a full copy of its records, then delete ours, unless the program asks us to keep a read-only copy for it.
- Audit logs: six years, as HIPAA requires.
- Backups: removed in the normal backup cycle, within 30 days after the main copy.
9. Your choices
Email hello@caylo.app to see the information we hold about you, correct it, or have it deleted, subject to section 8. We’ll respond within 30 days. Requests about member records go to the program, as section 2 explains. We do not sell or share personal information for advertising, so there is nothing to opt out of, and we honor the Global Privacy Control signal.
10. Children
caylo.app and Caylo are for adults at work. Members do not use Caylo themselves.
11. United States only
Caylo is for use in the United States, and all information is stored here.
12. Changes
If we change this policy, we’ll post it here and update the date at the top. If a change is significant, we’ll email programs that use Caylo at least 30 days before it takes effect.
13. Contact
Caylo LLC · Phoenix, Arizona · hello@caylo.app