Caylo is a phone app and an Office for Arizona DDD day programs. This page explains, in plain language, how we protect the members whose information goes into Caylo and the programs that trust us with it.
Who we are
Caylo LLC is a Phoenix, Arizona software company. We are a business associate of every program that uses Caylo. We sign a Business Associate Agreement (BAA) before any member information goes into Caylo, and we handle it under the HIPAA Security and Privacy Rules as they apply to us.
Caylo is built with the safeguards HIPAA requires. That is not a certification, and it does not replace your program’s own compliance work. It is designed to support it.
How we protect information
- In transit. Encrypted with TLS 1.2 or higher.
- At rest. Encrypted on Google Cloud, in the United States, in services covered by Google’s BAA.
- On the phone. Only the day’s information is kept, encrypted, behind Caylo’s own Face ID or PIN lock. It leaves the phone when the day ends, when someone signs out, and when an account is closed.
- In the Office. The Office signs out after 15 minutes without use and keeps nothing in the browser once the tab is closed.
- Access. Our servers enforce who sees what. Staff see only the members they support at their site. No one sees another program’s records.
- Sign-in. Everyone has their own account, set up by their program. Directors and managers also enter an authenticator-app code to open the Office.
- Audit trail. Every view and change is recorded in a log no one can edit, and the log is reviewed every month.
- AI writing help. Runs only on Google Cloud Vertex AI under Google’s BAA. Names, member IDs and dates of birth are left out, and what is written is never logged.
- Backups. Encrypted, and test-restored before any program enters real records, then every year.
What we will never do with your information
- Sell it.
- Advertise with it.
- Use it to train AI models.
- De-identify it without your written permission.
- Put it in notifications, emails or text messages.
What we promise
- We sign a BAA with your program before any member information goes into Caylo.
- We tell you in writing about a breach without unreasonable delay, and within 5 business days of finding it.
- When you ask, or when you leave Caylo, we give you a full copy of your records and then delete ours, unless you ask us to keep a read-only copy for you.
- We review our security program every year and after any major change.
What you can ask for
If your program uses Caylo or is seriously considering it, email hello@caylo.app and we will share our Business Associate Agreement, HIPAA policies, information security policy, and summaries of our risk assessment and incident response plan. Our Subprocessors page is public.
What your staff can do
- Use a long password that isn’t used anywhere else.
- Keep the phone’s software up to date and its lock turned on.
- Report a lost phone to the program and to Caylo the same day.
- Never share an account.
- Never put member information in email, text messages, social media or any tool without a BAA.
Found a security problem?
Please tell us. Our Vulnerability Disclosure Policy explains how.