Privacy Policy

Constellation Operations Hub — OK LTD LLC
Effective Date: March 14, 2026   |   Last Updated: March 14, 2026

1. Introduction

OK LTD LLC ("we," "us," or "our") operates the Constellation Operations Hub ("Constellation," "the App"), a healthcare operations platform serving home healthcare agencies. This Privacy Policy describes how we collect, use, store, and protect information when you use the Constellation mobile application and web platform.

Constellation processes Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA). We are committed to compliance with HIPAA, the HITECH Act, and applicable state privacy laws including the California Consumer Privacy Act (CCPA).

2. Information We Collect

2.1 Account Information

• Name, username, and contact information
• Role and organizational affiliation
• Authentication credentials (password hashes — we never store plaintext passwords)
• Two-factor authentication enrollment data

2.2 Protected Health Information (PHI)

When authorized users perform clinical operations, the App processes:

• Patient names, diagnoses, and care plans
• Clinical nursing notes and quality assessment results
• Medication records and vital signs
• AI-generated clinical analysis summaries

2.3 Operational Data

• Employee scheduling and shift records
• Messaging content between authorized staff
• Revenue and billing analytics
• Compliance tracking records

2.4 Device and Technical Information

• Device type, operating system, and app version
• Push notification tokens (if notifications are enabled)
• IP address and general location (for security and access logging)

2.5 Information We Do NOT Collect

• We do not collect data from your contacts, photos, or files unless you explicitly upload or share them within the App
• We do not use advertising trackers or share data with advertisers
• We do not sell personal information to any third party

3. How We Use Your Information

Purpose	Data Used	Legal Basis
User authentication and access control	Account credentials, 2FA tokens	Contractual necessity
Clinical note analysis and quality assurance	PHI (nursing notes, vitals, medications)	HIPAA Treatment/Operations
Staff scheduling and shift management	Employee records, schedules	Contractual necessity
Secure messaging between staff	Message content, sender/recipient	Contractual necessity
Revenue analytics and financial reporting	Billing and invoice data	Legitimate business interest
Compliance tracking and audit	Policy records, training status	Legal obligation (HIPAA)
Push notifications	Device tokens, alert preferences	User consent
Application performance and error monitoring	Technical logs, error reports	Legitimate business interest

4. Data Storage and Security

4.1 Infrastructure

All data is stored on Microsoft Azure infrastructure located in the United States:

• Database: Azure Database for PostgreSQL (encrypted at rest with AES-256)
• Application: Azure App Service with HTTPS-only enforcement
• File Storage: Azure Files and Azure Blob Storage (encrypted at rest)
• Secrets: Azure Key Vault (FIPS 140-2 Level 2 hardware security modules)

4.2 Security Measures

• All data transmitted over TLS 1.2+ encryption
• Passwords hashed with bcrypt (cost factor 12)
• Two-factor authentication (TOTP) required for all users
• JWT-based session management with automatic expiration
• Role-based access control (administrator and standard user roles)
• Account lockout after failed authentication attempts
• Audit logging of all authentication and data access events

4.3 Data Retention

• Clinical records (PHI): 7 years from date of service, per HIPAA and California state requirements
• Employee records: Duration of employment plus 6 years
• Authentication logs: 1 year
• Messaging data: Duration of active account plus 1 year

5. Third-Party Services

We use the following third-party services to operate the platform:

Service	Provider	Purpose	Data Shared
Cloud Infrastructure	Microsoft Azure	Hosting, database, storage	All platform data (encrypted)
AI Clinical Analysis	Azure OpenAI Service	Nursing note analysis	De-identified clinical text
Document Processing	Azure Document Intelligence	OCR for clinical documents	Document images
Messaging	Azure Communication Services	Staff chat	Message content, participant IDs
Application Monitoring	Azure Application Insights	Performance and error tracking	Technical telemetry (no PHI)

All third-party processors operate under Business Associate Agreements (BAAs) as required by HIPAA. We do not share data with any third party for advertising, marketing, or data brokerage purposes.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data (subject to legal retention requirements)
• Portability: Receive your data in a structured, machine-readable format
• HIPAA Rights: Access to your PHI, request amendments, receive an accounting of disclosures, and request restrictions on use — as guaranteed under 45 CFR Part 164

To exercise any of these rights, contact us using the information in Section 9.

7. Children's Privacy

Constellation is a workplace application intended for authorized healthcare professionals. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected data from a child under 13, we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes through the App or by email. The "Last Updated" date at the top of this policy indicates when it was most recently revised. Continued use of the App after changes constitutes acceptance of the updated policy.

9. Contact Us