LH AI LLC
Last updated: June 25, 2026
LH AI LLC ("LH AI LLC," "we," "us," or "our") provides the Lighthouse home-care management platform, including a web application and an iOS mobile application (collectively, the "Services"). This Privacy Policy explains what information we collect, how we use it, and with whom we share it.
Our Services are used by home-care agencies and their authorized users, including agency staff, caregivers, patient family members, and patients whose records are managed by the agency. Much of the information processed through the Services is Protected Health Information ("PHI") governed by the Health Insurance Portability and Accountability Act ("HIPAA"). LH AI LLC acts as a Business Associate to the home-care agencies that use our platform. Our handling of PHI is governed by our Business Associate Agreements with those agencies in addition to this Policy.
Account and identity information
Depending on your role and how your account is provisioned, we may collect:
Name, email address, phone number, and mailing or service addresses
Date of birth, sex, and other demographic identifiers
Profile photo and biographical or professional details (such as department, team, job title, credentials, certifications, languages, or skills)
Employment or organizational identifiers and relationship to a patient, where applicable
Login credentials, session tokens, and multi-factor authentication enrollment data
OAuth or single sign-on tokens when you authenticate through your organization's identity provider
An encrypted e-signature PIN and device fingerprint derived from browser or device attributes used to recognize trusted devices
Social Security Number or other government identifiers, when required for your role (stored in encrypted form)
Geocoded coordinates associated with an address you provide
Health information
On behalf of contracting agencies, we store and process health and care-related information necessary to deliver home-care services. This includes patient and care records, clinical documentation, care plans, billing and authorization data, and related identifiers as entered or generated through the Services by authorized users.
Location information (mobile application)
For Electronic Visit Verification ("EVV"), the Lighthouse iOS application may collect precise location when you clock in and clock out of a scheduled visit. While you are using the app, location may also be used to verify that you are at an authorized service location before clock-in or clock-out. Location is collected only while the app is in use (when-in-use authorization); we do not collect location continuously in the background.
We may store location associated with EVV events and reverse-geocoded address components derived from those events. Location data is used for visit verification and related operational purposes. It is not intended for navigation or situations where precise location is critical to safety, and we do not guarantee the availability, accuracy, completeness, or timeliness of location data.
Care and visit documentation (mobile application)
When you use the mobile application, you may submit clinical and operational documentation related to assigned visits, including care administration records, assessments, visit notes, attestations, and signatures.
Device and technical information (mobile application)
When you use the Lighthouse iOS application, we may collect:
Push notification device tokens and related delivery metadata
Platform identifier, app version, and notification preference settings
Whether biometric unlock (Face ID or Touch ID) is enabled in the app (we do not receive or store biometric data itself)
Device registration and session information, including last-seen timestamps
IP address and operating system version when the app communicates with our servers
Usage and session data
We collect first-party usage analytics within our own systems, including login counts, session start and end times, session duration, and feature usage. For security, compliance, and audit purposes, user activity within the Services is monitored and logged, including field-level change history for certain records.
We may also collect technical information such as IP address, browser or app client type, and operating system version when you access the Services.
Audio and uploaded content
Camera and photos (mobile application): When you submit certain requests through the iOS app, you may capture or select images using your device camera or photo library. Those images may be uploaded to our secure storage and processed to assist with data entry before you submit the request.
Microphone and audio: When authorized users enable voice dictation, audio is captured and sent for transcription.
Files and documents: Clinical documents, compliance documents, faxes, photos, signatures, and other files you or your agency upload through the Services.
Cookies and similar technologies
We do not use third-party advertising or analytics trackers, and we do not use advertising cookies. We use browser local storage and session storage to maintain your login session and remember in-app preferences.
We use the information we collect to:
Authenticate users, secure accounts, and enforce access controls (including multi-factor authentication and trusted-device recognition)
Provide scheduling, visit verification, clinical documentation, medication management, billing support, communications, and other core platform functions
Verify visits through EVV location data at clock-in and clock-out and through location checks while the mobile app is in use
Deliver operational, transactional, push, and local notifications (including reminders related to your assigned schedule)
Provide AI-assisted features described in Section 5
Maintain audit logs, investigate security incidents, prevent fraud and unauthorized access, and comply with legal and regulatory obligations
We do not sell personal information. We do not use PHI for advertising or marketing.
We share information with service providers that help us operate the Services. These providers process data on our behalf under contractual obligations to protect it and use it only to provide services to us. Categories of service providers include:
Cloud hosting, database, authentication, and file storage providers
Identity and single sign-on providers
Mapping, geocoding, and address validation providers
Speech-to-text and artificial intelligence processing providers
Transactional email and notification delivery providers
Fax transmission, receipt, and document processing providers
Workflow automation and internal operational notification providers
Public health and regulatory reference data sources (such as drug and provider identifier lookups)
We may also share information:
With the home-care agency that controls the account and the underlying records
With professional advisors (such as lawyers or auditors) under confidentiality obligations
As required by law, regulation, legal process, or governmental request
In connection with a merger, acquisition, financing, or sale of assets, subject to applicable law and contractual protections
PHI is shared only as permitted under HIPAA and the applicable Business Associate Agreement with the contracting agency.
Certain features of the Services use artificial intelligence and machine learning to support platform functionality. When you use those features, content you submit (such as text, documents, images, or audio) may be processed by third-party AI service providers on our behalf.
Outputs produced by these features are intended to assist authorized users and may contain errors or inaccuracies. They must be reviewed by qualified personnel before being relied upon for professional or operational decisions.
Data is stored in secure cloud infrastructure configured for healthcare-grade security. Sensitive fields such as Social Security Numbers and e-signature PINs are encrypted. Access to data is restricted by role and tenant isolation.
We retain information for as long as necessary to provide the Services and to meet the contracting agency's legal, clinical, billing, and regulatory retention obligations. Certain archived or deleted records may be recoverable for a limited period before permanent deletion. Transactional links such as account invitation links and password-reset links expire after a defined period (typically 48 hours for invitations and one hour for password resets).
Some profile photos and assistant attachments may be stored in locations accessible via URL to authorized users of the platform. We apply access controls to limit who can retrieve those URLs.
No method of transmission or storage is completely secure. We maintain administrative, technical, and organizational safeguards designed to protect the information we process.
We may send you operational communications related to your account or use of the Services, including email, push notifications, and (where enabled) text messages. Message and data rates may apply for text messages. You can manage push notification preferences in your device settings and may opt out of promotional communications using the unsubscribe method provided in those messages. Opting out of certain operational communications may affect your use of the Services.
Mobile device settings. You can enable or disable location services, push notifications, camera access, and photo library access through your iOS device settings. Disabling location services may prevent EVV clock-in and clock-out through the mobile application. Disabling camera or photo library access may limit certain mobile submission features; you may still be able to complete those workflows manually where the app supports it.
Access, correction, and deletion. Because most health information in the Services is controlled by the contracting home-care agency (the Covered Entity under HIPAA), requests to access, amend, or delete PHI should generally be directed to that agency. LH AI LLC will assist agencies in responding to such requests as required under our Business Associate Agreements.
Additional rights. Depending on your jurisdiction (for example, California or the European Economic Area), you may have additional privacy rights. Contact us using the information in Section 12 to submit a request. We will respond as required by applicable law.
The Services are intended for use by authorized adults who are at least 18 years of age. The Services are not directed to children for self-registration. Records relating to minor patients are maintained by the contracting agency as part of lawful care delivery.
The Services are operated from the United States. If you access the Services from outside the United States, your information may be transferred to, stored in, and processed in the United States and other countries where our service providers operate.
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy on our website and revise the "Last updated" date above. Your continued use of the Services after the effective date of an updated Policy constitutes acceptance of the changes, except where further consent is required by law.
For privacy questions or requests:
LH AI LLC
Email: support@lhnova.com