VTCMS Privacy Policy

Quick Summary

• We collect only the information necessary to operate the Service for authorized treatment court team members.
• We do not sell your personal information or participant data.
• Sensitive data is encrypted using AES-256 encryption at the application level, in transit, and at rest.
• Access is restricted to authorized, invite-only users with role-based permissions.
• You may request deletion of your account and associated data at any time.

Information We Collect

Information You Provide

• Account Information: name, email address, phone number, work address, and role within the treatment court team.
• Participant Data: names, dates of birth, application statuses, case notes, updates, attachments, and other information entered by authorized team members about treatment court participants.
• Private Notes: personal notes created by individual team members, encrypted with a per-user key stored in the device keychain.
• Shared Notes & Messages: notes shared among team members, group messages, and coordinator communications.
• Calendar Events: scheduled court dates, meetings, and related event data.
• Continuing Education: submissions, hours, and review statuses.
• Uploaded Files: PDF and image attachments related to participants, policies, or continuing education.

Information Collected Automatically

• Device & Log Data: IP address, device type, operating system, browser type, timestamps.
• Usage Data: feature interactions, login activity, audit logs.
• Authentication Tokens: session and authentication state managed via Firebase Authentication.

Third-Party Sources

• Firebase Authentication (email link sign-in).
• Firebase Cloud Services (Firestore, Cloud Storage, Cloud Functions).
• Apple Push Notification service (APNs) for notifications.

How We Use Information

• Operate and maintain the Service for authorized treatment court personnel.
• Facilitate secure communication and information sharing among team members.
• Store and manage participant records, case notes, and related documents.
• Enforce role-based access controls and security policies.
• Generate audit logs for accountability and compliance.
• Send notifications about updates, messages, and calendar events.
• Detect abuse, unauthorized access, and security incidents.
• Comply with applicable legal obligations.

Legal bases (where applicable) include contract performance, legitimate interests, consent, and legal compliance.

How We Share Information

We do not sell personal data or participant data. We may share data:

• Among authorized team members within the same treatment court team, as permitted by their assigned roles.
• With infrastructure service providers (Google/Firebase) under contract, solely to operate the Service.
• When required by law, regulation, legal process, or governmental request.
• During a business transfer (merger, acquisition, or asset sale), with notice.
• In aggregated, de-identified form that cannot reasonably identify any individual.

We do not share participant data with any party outside of the authorized treatment court team except as required by law.

Encryption & Security

We implement multiple layers of encryption and security:

• Application-Level Encryption: Sensitive data (participant records, notes, messages, calendar events) is encrypted using AES-256 symmetric encryption before storage.
• Per-User Encryption: Private notes are encrypted with individual keys stored in the iOS Keychain. These notes are accessible only to the user who created them.
• Data in Transit: All data transmitted between the app and servers is protected by TLS/HTTPS via Firebase/Google infrastructure.
• Data at Rest: Firebase (Google Cloud) automatically encrypts all stored data using AES-256 across Firestore, Cloud Storage, and Firebase Auth.
• Access Controls: Invite-only authentication, role-based permissions, and server-side authorization enforce strict access boundaries.
• Audit Logging: Administrative actions, data access, and modifications are logged for accountability.

Data Retention & Deletion

• Data is retained for as long as necessary to operate the Service and fulfill the purposes described in this policy.
• Archived records (participants, notes, messages, calendar events) follow configurable retention rules set by the team coordinator or administrator.
• You may request account deletion at any time by contacting your team administrator or us directly.
• Upon account deletion, your personal data will be removed from active systems. Backups may persist temporarily before scheduled overwrite.
• Important: Private notes encrypted with a per-user key stored in the iOS Keychain are not recoverable if the user's Apple account or device is lost. We do not store recovery keys for per-user encrypted data.

Your Rights

Depending on your location, you may have rights including:

• Access to and correction of your personal data.
• Deletion of your account and associated data.
• Data portability (export of participant and team member data is available to authorized users).
• Objection to or restriction of certain processing.
• Right to lodge a complaint with a supervisory authority.

Cookies & Analytics

The web version of the Service may use cookies and similar technologies for authentication and session management. You can control cookies through your browser settings.

International Transfers

Your information is processed and stored using Google Cloud/Firebase infrastructure, which may be located outside your country. We implement appropriate safeguards where required.

Children's Privacy

The Service is not directed to individuals under 18. We do not knowingly collect data from minors. The Service is intended solely for authorized treatment court team members.

Changes to This Policy

We may update this Privacy Policy periodically. Continued use of the Service constitutes acceptance of updates. We will make reasonable efforts to notify users of material changes.

Contact

If you have questions about this Privacy Policy, contact us at vtcmobile@qwertycode.org.