Privacy Policy

Heroes Haven LLC (“Heroes Haven,” “we,” “our,” or “us”) provides HH Command Center, a software platform designed to assist caregivers in organizing, managing, and coordinating care-related information.

This Privacy Policy describes how we collect, use, disclose, and safeguard information when you access or use the Service.

The Service is intended solely for personal, household, and caregiver use and is not a healthcare provider, medical device, or clinical system.

Heroes Haven operates under consumer protection and privacy laws enforced by the Federal Trade Commission (FTC). We are not a HIPAA-covered entity and do not represent that the Service complies with the Health Insurance Portability and Accountability Act (HIPAA).

HH Command Center functions as a Personal Health Record (PHR) platform, allowing users to store and manage health-related information for personal use. Accordingly:

• The Service is governed by FTC consumer protection laws
• The Service is subject to the FTC Health Breach Notification Rule (16 CFR Part 318)
• Heroes Haven is not a healthcare provider, insurer, or healthcare clearinghouse
• Heroes Haven does not enter into Business Associate Agreements (BAAs)

Users should not rely on the Service as a substitute for professional healthcare systems or regulated clinical infrastructure.

We collect information that you voluntarily provide, as well as certain technical and operational data necessary to provide and improve the Service.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Facilitate care coordination and organization
• Send reminders, notifications, and updates
• Improve system performance and reliability
• Maintain security and prevent unauthorized access

We do not sell personal or health-related information.

We may share information with third-party service providers necessary to operate the Service. Such providers are contractually restricted to processing data solely on our behalf and are not permitted to use your information for advertising or resale.

The third-party services we use include:

• Vercel — Vercel — Application hosting and file storage (US region).
• Railway — Railway — PostgreSQL database hosting (encrypted at rest).
• Clerk — Clerk — User authentication and session management.
• OpenAI — OpenAI — Optional AI-assisted features (OCR, translation, voice transcription). Data is not used for model training and is not retained by OpenAI. No BAA is in place; users are informed via in-app consent modals before use.
• AWS — AWS — Document OCR processing.
• Google Cloud — Google Cloud — Vision API for document processing.
• Twilio — Twilio — SMS notifications.
• Firebase (Google) — Firebase (Google) — Push notifications.
• Sentry — Sentry — Error monitoring and performance tracking. Sentry captures error logs and performance data to maintain application reliability. Data is stored in Sentry's cloud infrastructure (US region). Sentry does not use this data for advertising or sell it to third parties.
• Resend — Resend — Transactional email delivery (caregiver invitations, account notifications). Resend processes recipient email addresses and notification content solely to deliver emails on our behalf. Data handling is governed by Resend's privacy policy.
• Google Calendar — Google Calendar (optional integration) — If you choose to connect your Google Calendar account, appointment data (title, date/time, location, and notes) may be synced to your Google Calendar via Google's OAuth API. This integration is entirely opt-in and requires your explicit authorization. You may disconnect at any time in Settings. Data shared with Google is subject to Google's Privacy Policy.

We implement reasonable administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of sensitive data in transit and at rest
• Secure authentication mechanisms
• Role-based access controls
• Monitoring and logging systems

However, no method of transmission or storage is completely secure. Users are responsible for maintaining the confidentiality of their account credentials.

Active Accounts: Data is retained while your account remains active.

Cancelled Accounts: Upon cancellation, you shall retain access for thirty (30) days to export your data. After sixty (60) days of non-payment, data shall be permanently deleted.

Keep Safe Tier: Users may maintain data through a Keep Safe plan without full Service access.

Inactive Accounts: For accounts without billing activity, we may issue notifications at 12, 15, and 18 months of inactivity.

Once data is permanently deleted, it cannot be recovered. Users are solely responsible for exporting any data they wish to retain prior to deletion.

Heroes Haven does not verify the accuracy, completeness, or reliability of user-entered data.

You are solely responsible for the information you provide and any decisions made based on that information.

You may: access your data, export your data, correct inaccuracies, and request deletion.

Requests may be submitted to support@visitheroeshaven.com

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with applicable consumer privacy legislation, you may have additional rights under such laws, including:

• The right to know what personal information we collect and how it is used
• The right to request deletion of your personal information
• The right to opt out of the sale or sharing of personal information
• The right to non-discrimination for exercising your privacy rights
• The right to data portability

Heroes Haven does not sell personal information and does not share personal information for cross-context behavioral advertising purposes.

To exercise any of these rights, please contact us at support@visitheroeshaven.com. We shall respond to verified requests within the timeframes required by applicable law.

The Service is not intended to provide medical advice, diagnosis, or treatment. It is not a substitute for professional medical care.

This Service must not be relied upon in emergency or life-critical situations. In the event of a medical emergency, contact 911 or your local emergency services immediately.