NMT Mobile Privacy Notice

NMT Mobile is provided by Nullion Technologies LLC, Pittsburgh, Pennsylvania, USA. We build and run the app and the Align Care Hub services behind it. Your agency controls its own records, which we process on its behalf under a Business Associate Agreement. NMT Mobile is not provided by, or affiliated with, the State of Ohio or the Ohio Department of Developmental Disabilities.

NMT Mobile does not read your contacts, calendar, microphone, or other apps, and it does not collect advertising identifiers.

• Permission. NMT Mobile asks for location "While Using the App" only. It never asks for "Always" access.
• When. Your route is recorded only from Start trip until you Finish the trip. If you switch to another app during a trip, recording continues and your phone shows that location is in use. Your location is not recorded at any other time.
• What. Each recorded point holds the position, its accuracy, speed, heading, altitude, the time it was taken, and whether the phone reported it as simulated.
• Why. Your agency records each trip and measures each rider's miles from the route. Ohio rules allow trip miles to be measured by GPS tracking.
• Directions and arrival time. During a trip, the app sends the vehicle's current position to our servers to work out the route and arrival time to the next stop (see §6).
• On your phone. Recorded points are kept in the app's private, encrypted storage only until our servers accept them. Points that cannot be sent within 7 days are deleted unsent, and signing out deletes them all.
• On our servers. The route is stored with the trip record and is never changed afterward, so the trip's miles can always be checked. It is kept for as long as your agency must keep its trip records under Ohio and Medicaid rules (see our Privacy Policy, §6).
• Your choice. You can decline or turn off location in your phone's Settings. You can still work your trips, but the trip's miles cannot be measured from your route.

• NMT Mobile uses the camera only when you choose to take a photo for a message, an incident report, or one of your documents.
• It reads only the photo you choose from your library. No other photos are read.
• A PDF is added only when you pick one in the system's file picker.
• Photos and files are stored encrypted in Amazon Web Services (AWS) and are available to your agency. When you open one, the app shows it from memory and does not save a copy to your phone.

• At pick-up, the rider's parent, guardian, or caregiver signs on the screen; at drop-off, the person receiving the rider signs. You sign when you finish a trip. Each signature is stored as an image with the signer's name and the time.
• An incident report can hold what happened, where, injuries, the people involved, witnesses, medical follow-up, photos, files, and your drawn signature. Reports about people with developmental disabilities are sensitive health information.
• Signatures and reports are your agency's records. They are sent to your agency's office and kept under your agency's retention rules.

Google Maps. The trip map is drawn by the Google Maps SDK for iOS. To show the map, the SDK requests map images from Google, which receives your phone's network address and the map area shown. According to its own privacy disclosure, the SDK also collects a device identifier, how the map is used, and crash and performance data, for analytics and to run the map. NMT Mobile does not send Google your name, your agency, or rider details. Google's use of this data is governed by the Google Privacy Policy. We add no analytics or advertising SDK of our own.

Amazon Location Service. Our servers, not the app, use Amazon Location Service in our own AWS account, under our HIPAA Business Associate Agreement with AWS:

• Addresses to map pins. When your office saves a rider's pick-up or drop-off address, our server asks Amazon Location for its position, so the stop can be shown on the map.
• Directions and arrival time. During a trip, our server sends Amazon Location two points: the vehicle's current position and the next stop.

Each request carries only an address or two points: no name, agency, rider, or trip identifier. Routes are kept only in our server's memory for a few minutes, are never used for billing, and are never logged.

• Your agency, which uses NMT Mobile records for its trips, safety, and billing.
• Our service providers, under contracts that limit their use of the data:
  • Amazon Web Services (AWS): hosting and encrypted file storage, in the United States.
  • Amazon Location Service: map pins, directions, and arrival times (see §6).
  • Amazon SES: account emails, such as password-reset and deletion links.
  • Google: the map (see §6).
• As the law requires, as described in our Privacy Policy.

We do not sell your information, use it for advertising, or track you across other companies' apps or websites. NMT Mobile has no in-app purchases.

• Your account is kept while it is active, and deleted as described in §9.
• Trip records, routes, signatures, inspections, incident reports, and documents belong to your agency. They are kept for as long as the agency must keep them under Ohio and Medicaid rules, even after your account is deleted.
• Route points on your phone are kept for no more than 7 days unsent and are deleted when you sign out (see §3).
• Directions and arrival times are kept in server memory for a few minutes and are never stored.

• In the app: Profile → Delete account.
• On the web: Delete your NMT Mobile account (https://dodd.aligncarehub.com/api/v1/account/delete).

We email you a link to confirm; the link works for 24 hours. After you confirm, your account is deleted 30 days later, and the email lets you cancel until then. Your agency is told. Information that identifies you in your account is deleted or anonymized; records your agency must keep by law, such as your trips and reports, stay with the agency, and audit records are kept without your identity.

NMT Mobile is for adult drivers working for an agency. It is not directed to children under 13, and we do not knowingly collect information from them.

We may update this notice when NMT Mobile changes. We will revise the "Last updated" date and, for material changes, give additional notice in the app.

Nullion Technologies LLC Pittsburgh, Pennsylvania, USA Privacy: aligncarehub@gmail.com Support: aligncarehub@gmail.com

For questions about your agency's records, such as a trip or an incident report, please contact your agency.