Privacy Policy
Last updated: July 14, 2026
Overview
Systemax is a HIPAA-compliant home care agency operations platform operated by Goldwyn Rose Consulting & Management LLC (“Systemax,” “we,” or “us”), based in Minneapolis, Minnesota. This policy explains what information we collect, how we use it, how we protect it, and your rights regarding it.
Who this policy covers
This policy applies to individuals whose information is processed through Systemax: staff of tenant home care agencies, clients receiving services, caregivers, authorized representatives, and visitors to systemax.app and app.systemax.app.
Information we collect
Account information: name, email address, role, and organizational affiliation for anyone with a Systemax account.
Protected Health Information (PHI): when a tenant home care agency uses Systemax to manage services for its clients, we process PHI on that agency's behalf under a Business Associate Agreement (BAA). PHI includes client demographics, service authorizations, visit records, care plans, and related documentation.
Usage information: logs of platform activity, including sign-in events, actions taken, and system health metrics. Used for security, auditing, and product improvement.
Communications: email you send to us, along with any third-party inbox integrations you authorize (Microsoft 365, Google Workspace) for which we act as a data processor at your direction.
How we use information
- To provide and secure the platform for agencies and their users.
- To process PHI on a tenant agency's behalf under a signed BAA.
- To maintain an audit trail of platform activity for security and regulatory purposes.
- To respond to support requests and communicate about the service.
- To detect, investigate, and prevent fraud or abuse.
We do not sell personal information. We do not use PHI for advertising or product marketing. We do not train third-party AI models on tenant data.
How we protect information
- Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
- Row-level security in the database to isolate each tenant's data.
- Separation-of-duties enforcement on financial and administrative actions.
- Tamper-evident, append-only audit logging for critical events.
- Time-boxed and consented access when Systemax staff assist a tenant.
- Vulnerability management and incident response with 60-day breach-notification tracking.
Sharing of information
We share information only as necessary to operate the service and as directed by the tenant agency:
- Subprocessors under BAA (AWS for infrastructure, Neon for managed database, and other listed vendors) that meet HIPAA requirements.
- Federal or state authorities as required by law or subpoena, with notice to the affected tenant where legally permitted.
- Third-party integrations you or your tenant admin explicitly authorize (payer clearinghouses, EVV aggregators, inbox providers).
We do not disclose PHI to any party without appropriate authorization, BAA coverage, or legal basis.
Retention
Systemax follows a documented records-retention schedule: 7 years for PHI (HIPAA baseline), 3 years for operational data, and 10 years for the audit trail. Legal holds may supersede retention. Deletion follows a documented, dry-run-verified sweep with administrative approval where required.
Your rights
If you are a Systemax user: you may request access to, correction of, or deletion of your account information by contacting your tenant administrator or Systemax support.
If you are a client of a tenant home care agency and want to exercise HIPAA rights over your Protected Health Information, please contact the agency serving you. Systemax processes that data on the agency's behalf and will support the agency in fulfilling your request.
Contact
Questions or requests regarding this policy: support@systemax.app
Goldwyn Rose Consulting & Management LLC
Minneapolis, Minnesota
United States
Changes to this policy
We may update this policy from time to time. Material changes will be communicated through the platform or by email to registered users. The “Last updated” date at the top reflects the most recent revision.