This Privacy Policy explains how PRO KPO INC (“Pro KPO,” “we,” “us,” or “our”) handles information when agencies, caregivers, clients, family users, and visitors use our websites, agency platform, portals, mobile application, ROXY features, and related services (collectively, the “Service”). An agency may control information processed in its workspace. In that situation, the agency's own privacy notices and instructions may also apply.

Depending on the features used, we may collect account and contact information such as name, email address, and phone number; account, role, device, and push notification identifiers; precise location used for authorized clock-in, clock-out, geofencing, and active-shift functions; caregiver selfies, profile photographs, identity documents, and facial-comparison results; voice commands and audio submitted to ROXY; shift confirmations, attendance events, handovers, notes, feedback, support communications, and other content a user submits; and security, audit, and operational activity records. Agencies may also place workforce, client, care, scheduling, payroll, billing, and related business records in their workspaces.

When an agency enables identity verification, the app may capture a selfie and send it with an agency-approved reference image to Amazon Web Services, Inc. (AWS Rekognition), a third-party facial-comparison service, to help confirm that the assigned caregiver is present. The mobile app asks for explicit permission before that transfer. This processing involves biometric information. A verified clock-in selfie is discarded immediately after comparison. A failed or inconclusive verification image may be retained for agency review for up to seven days and then deleted, subject to security, legal, or documented agency requirements. Reference profile images and authorized identity documents may be retained while the account or verification purpose remains active. Pro KPO does not use facial information for advertising or cross-app tracking.

With device permission, the mobile app may send precise latitude, longitude, accuracy, and timestamps for attendance, geofence validation, and authorized active-shift tracking. Active-shift location collection is designed to stop at clock-out. Users can manage device permissions in iOS settings, but disabling location may prevent attendance or EVV features from working. We do not use precise location for advertising.

We use information to authenticate users; provide scheduling, attendance, communication, care-workflow, payroll-preparation, billing, reporting, and AI features; verify identity and prevent false attendance; send service notices; respond to support and privacy requests; secure, maintain, and troubleshoot the Service; enforce agreements; and comply with applicable law. We do not sell personal information or use it for third-party behavioral advertising.

We use service providers for specific functions, including Amazon Web Services (facial comparison and infrastructure), OpenAI (Roxy AI and speech processing), Vercel (application hosting), Expo (mobile application services and push-token delivery), Google Maps Platform and OpenStreetMap services (maps, routes, tiles, and geocoding), Stripe (website subscription payment processing), Twilio (configured SMS delivery), Retell AI (agency-configured automated calling), Mailgun or Resend (configured email delivery), and When I Work (agency-configured workforce synchronization). The information shared depends on the feature the user or agency enables and may include the categories described in this policy. These providers are required to handle personal information with protections consistent with this policy and applicable contractual and legal requirements. Information may also be disclosed to the agency that manages the user's account, to authorized users in that agency workspace, when a user directs us to disclose it, to protect safety or the Service, in a business transaction, or when required by law.

When a person affirmatively opts in to the Roxy-call by Pro KPO SMS program, we use the mobile number and consent record to deliver recurring operational workforce messages, including shift offers, assignment confirmations, clock-in exceptions, and urgent coverage notifications. Message frequency varies. Message and data rates may apply. A recipient may reply HELP for help or STOP to opt out at any time.

We do not share, sell, rent, or provide mobile phone numbers or SMS opt-in consent data to third parties or affiliates for their marketing or promotional purposes. We may share information with messaging service providers only as necessary to deliver and support the requested messages, comply with law, or protect the Service. SMS consent is not transferred to third parties or affiliates for their own marketing. Consent records may include the submitted phone number, name, agency, recipient role, consent language and version, timestamp, submission source, IP address, and browser information so that we can document and honor messaging preferences.

Roxy uses OpenAI, LLC as a third-party artificial-intelligence and speech-processing provider. Before the mobile app sends personal information to OpenAI, it displays an in-app notice and requests the user's explicit permission. If permission is not given, Roxy remains off and the rest of the app remains available. A user can later withdraw permission in the mobile app under More → AI privacy & consent.

Depending on how Roxy is used, Pro KPO may send OpenAI live microphone audio, speech transcripts, typed commands, prior conversation context, and the agency records needed to answer the request. Relevant records may include caregiver names, job sites, shifts, schedules, attendance information, payroll summaries, and Roxy action results. OpenAI processes this information to transcribe speech, understand the request, generate a response, and support the requested workflow. Pro KPO may retain Roxy transcripts and action history in the agency workspace for continuity, security, and auditing.

Pro KPO does not use Roxy information for advertising or cross-app tracking. OpenAI states that information submitted through its API is not used to train or improve its models unless the API customer expressly opts in. OpenAI may retain API content in abuse-monitoring logs for up to 30 days by default, unless different approved data controls or legal requirements apply. Pro KPO requires service providers handling personal information to maintain protections consistent with this policy and applicable contractual and legal requirements. Users should avoid submitting patient diagnoses or other health information that is unnecessary for the scheduling or workforce request.

We retain information for the period needed to provide the Service, satisfy an agency's documented instructions, maintain security and audit records, resolve disputes, and meet legal, employment, billing, or regulatory obligations. Retention varies by record and agency configuration. Failed or inconclusive clock-verification selfies follow the shorter period described above unless a lawful exception applies. Backups may remain for a limited period before being overwritten.

We use administrative, technical, and organizational safeguards designed for the nature of the information handled. No system can guarantee absolute security. Users should protect their credentials and promptly report suspected unauthorized access. Agencies control roles and permissions within their workspaces and are responsible for removing access when it is no longer needed.

The Service is intended for agencies and their authorized workforce, clients, and family users. It is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 through consumer registration. An agency must have appropriate authority before placing information about a minor client in its workspace.

Depending on location and applicable law, a person may have rights to request access, correction, deletion, restriction, portability, or information about how personal information is processed, and to appeal a denied request. Some records may be exempt or must be retained. When Pro KPO processes information for an agency, we may refer the request to that agency for verification and response.

We may update this policy as the Service, vendors, or legal requirements change. We will post the updated version here with a revised effective date and provide additional notice when required.