1. Scope
This Privacy Policy applies to iva-holly.com, its contact and assessment tools, and the Iva-Holly client portal (collectively, the “Site”). The Site is operated by Iva-Holly Senior Living Management LLC (“Iva-Holly,” “we,” “us,” or “our”).
2. Information we collect
Depending on how you use the Site, we may collect:
- Contact and business information, such as your name, email address, telephone number, facility, role, and service interests.
- Account information, access level, login activity, and security or audit information associated with the client portal.
- Facility operations information, contracts, reports, action plans, training records, compliance documents, and other materials submitted through the portal.
- Limited resident-related information when reasonably necessary for an authorized engagement. The client portal itself is not intended to store protected health information (“PHI”).
- Technical information such as device, browser, IP address, pages visited, and diagnostic or security events.
3. Resident data and PHI
The client portal application and its database are not used as a repository for PHI. When an authorized document containing PHI is reasonably necessary for contracted services, the portal may facilitate a secure upload to Iva-Holly’s designated Microsoft SharePoint environment. The document is stored in SharePoint rather than in the client portal application database.
Clients must upload only the minimum information reasonably necessary, must have lawful authority to disclose it, and must not use the Site in a way that violates privacy, health-information, employment, or other applicable laws. If HIPAA applies to a particular engagement, the parties’ applicable services agreement and Business Associate Agreement (“BAA”), if required, will govern PHI handling. The availability of an upload feature alone does not create a BAA or establish that every portal use is HIPAA-regulated.
4. How information is used
We may use information to provide contracted services; administer accounts and access; review documents; communicate with clients; maintain security and audit trails; improve the Site; respond to requests; comply with legal obligations; and protect residents, clients, Iva-Holly, and others.
5. How information may be shared
We may share information with authorized Iva-Holly personnel, the client organization that controls the account, and service providers that support hosting, authentication, storage, security, communications, and document processing. Documents uploaded through the portal are transferred to the designated Microsoft 365 SharePoint environment for storage; PHI is not stored in the portal application database. Providers may use information only as permitted by their agreements and applicable law.
We may also disclose information when required by law, legal process, professional obligations, or a good-faith need to protect safety, rights, systems, or property. We do not sell resident data or PHI.
6. Security and retention
We use administrative, technical, and organizational safeguards appropriate to the nature of the information, including role-based access and access-controlled systems. No internet transmission or storage system is guaranteed to be completely secure. Clients must protect credentials, assign only authorized users, promptly remove access when no longer needed, and notify us of suspected unauthorized access.
Information is retained for as long as reasonably necessary for the engagement, legal and contractual requirements, dispute resolution, security, and legitimate business records, then deleted or de-identified where appropriate. Facility owners remain responsible for maintaining official resident and regulatory records according to applicable retention requirements.
7. Your choices and requests
You may request access to, correction of, or deletion of your personal information, subject to legal, contractual, security, and record-retention obligations. Portal users should direct resident-record requests through their facility’s authorized privacy or records process.
8. Children, external links, and changes
The Site is intended for business users and is not directed to children. Links to third-party sites are governed by those parties’ policies. We may update this policy as our services, systems, or legal obligations change; the effective date above identifies the current version.
9. Contact us
Questions, privacy requests, or suspected privacy or security incidents may be sent to IH-Operations@iva-holly.com.