Privacy Policy

Effective and last updated October 18, 2026

This Privacy Policy explains how VBS LLC ("VBS LLC," "we," "us") handles information on our website at warmhandoff.app (the "Site") and in the WarmHandoff application at my.warmhandoff.app (the "Service"). VBS LLC is located at 838 E High St #155, Lexington, KY 40502, and can be reached at hello@warmhandoff.app. Use of the Service is also governed by our Terms of Service.

The short version

WarmHandoff is designed never to hold patient information. When a referral is recorded, the Service stores a ZIP code, a disposition (a stage label your organization defines), and dates. There is nowhere in that part of the database to put a name, address, date of birth, phone number, email, or free text about the person referred, and any count from 1 through 10 is shown as "<11" everywhere it appears.
We do not sell personal information, and we do not use it for advertising.
The Site sets no cookies of its own and runs no analytics, advertising, or tracking scripts.
We use a small number of service providers, listed below, to host the Service and deliver email.

Information we collect

When you visit the Site

The Site does not set cookies or run analytics. Cloudflare, which hosts the Site, processes standard technical information needed to deliver and secure it, such as your IP address, browser type, and the pages requested, and may set cookies of its own that are strictly necessary for security.

When you request a demo

The "Request a Demo" form collects your name, work email, organization, and any message you choose to include. The submission is delivered to our inbox by email through our email provider. The Site does not store it in a database; we keep it as ordinary business correspondence so we can respond to you.

When your organization uses the Service

Account information. The name, email address, and role of each person your organization's administrator invites. People sign in with a one-time code sent to their email, valid for 15 minutes. We do not use or store passwords.
Referral partner information. The organizations your team works with, their addresses, and the people your team contacts there, including names, titles, phone numbers, and email addresses your team enters. We convert organization addresses into map coordinates using the U.S. Census Bureau's public geocoding service.
Activity records. The visits, calls, emails, and follow-ups your team logs, with their dates and any notes. Notes are free text written about professional contacts, and the form asks your team never to write anything about a client in them. If a team member taps "Attach my location" while logging a visit, the device's location at that moment is saved with that visit; location is never collected otherwise.
Referral records. As described above: a ZIP code, a disposition, dates, and the referring partner organization, if any. Nothing that identifies the person referred.
Technical information. Our hosting providers keep standard server logs that include IP addresses and browser information. We also use your IP address temporarily to limit repeated sign-in attempts.
Information stored on your device. So a visit can be logged without a signal, the Service saves pages and not-yet-sent submissions in your browser's storage on your device. Referral screens are never saved this way. This storage is cleared when you sign out.

How we use information

To provide, operate, maintain, and secure the Service.
To send sign-in codes, invitations, and other messages about your account.
To respond to demo requests and support questions.
To detect, investigate, and prevent abuse, security incidents, and errors.
To comply with the law and enforce our Terms of Service.

The Service does not currently send any data to an artificial intelligence provider. If we add a feature that does, we will update this policy before it launches, and information about people referred will never be sent to one.

How we share information

We do not sell or rent personal information. We share it only as follows.

Within your organization. People in your organization see information according to the role your administrator gives them. For example, managers and administrators can see each team member's logged activity.
With our service providers, who process it on our behalf and only to provide their services to us:
- Railway, which hosts the Service, its database, and its backups;
- Resend, which delivers sign-in codes, account emails, and demo request emails;
- Cloudflare, which hosts the Site and stores and delivers the map imagery the Service uses;
- the U.S. Census Bureau's public geocoding service, which receives only organization addresses, never information about anyone referred;
- our business email provider, which hosts the inbox where demo requests and correspondence arrive.
For legal reasons, when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of our customers, the public, or VBS LLC.
In a business transfer, such as a merger or sale of assets, in which case the information would remain subject to the protections in this policy.

Access by our staff

Our staff can see an organization's data only through a support session that requires a recorded reason, expires after at most 60 minutes, and logs every action taken. We keep those logs for at least two years so there is always a record of what support did and did not do.

Cookies, Do Not Track, and third-party tracking

The Site sets no cookies of its own. The Service uses one essential cookie that keeps you signed in; it lasts up to 90 days and renews as you use the Service. We use no advertising or analytics cookies on either.

We do not track you across other websites, and we do not allow third parties to collect personal information about your online activities over time or across websites through the Site or the Service. Because there is no such tracking to turn off, the Site and the Service do not change their behavior in response to Do Not Track signals or Global Privacy Control.

How long we keep information

Service data is kept while your organization's subscription is active. After a subscription ends, we delete your organization's data from our live systems within 90 days, or sooner if an administrator asks us in writing. An administrator can request an export within 30 days after the subscription ends.
Backups expire automatically on our hosting provider's rotation, within three months. They are used only to recover from a failure.
Support session logs are kept for at least two years, as described above.
Demo requests and correspondence are kept as long as they are relevant to a conversation with you, and deleted on request.
Server logs are kept on our hosting providers' standard schedules.

How we protect information

The Site and the Service are served only over encrypted connections (HTTPS). Each organization's data is kept separate from every other organization's at the database level, so one customer's account cannot read another's. Sign-in codes are single-use and expire after 15 minutes, and our staff's access is limited and logged as described above. No system is perfectly secure, but if a security incident affects your personal information, we will notify you as required by law.

Where information is stored

The Service and its database are hosted in the United States. The Site and the Service's map imagery are delivered through Cloudflare's global network.

Your choices and rights

Whatever state you live in, you can ask us to tell you what personal information we hold about you, to correct it, to delete it, or to give you a copy of it. Email hello@warmhandoff.app with your request. We will verify that the request comes from you, respond within 45 days, and tell you if we need more time and why. If we decline a request, you can reply and ask us to reconsider, and you may also contact your state attorney general.

Some information in the Service, such as a referral partner contact's name entered by one of our customers, belongs to that customer, and we process it on their behalf. If you ask us about information of that kind, we will pass your request to the customer and help them respond to it.

Children

The Site and the Service are business tools for adults. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it.

Changes to this policy

When we update this policy, we post the new version here with a new effective date. If a change is material, we will also email the administrators of every organization using the Service at least 30 days before it takes effect.

Contact us

VBS LLC
838 E High St #155
Lexington, KY 40502
hello@warmhandoff.app