Privacy Policy

1. Scope of this Policy

This Privacy Policy governs all data collected through the hoh2life.com marketing site, the Universal Case Management System (UCMS), the Resident Portal, Vendor Portal, Landlord Portal, Employer Portal, and any related sub-domain, mobile web experience, or partner integration surface operated by LIFE LLC (collectively, the "Platform").

The Platform serves multiple distinct user classes: residents(program participants), staff (case managers, super admins, and executive directors), vendors (landlords, employers, service providers), and the public (donors, community members, prospective partners). The categories of information we collect — and the safeguards we apply — vary by user class.

2. Information We Collect

2.1 Public Visitors

• Newsletter subscription: email address only.
• Inquiry / contact forms: name, email, organization, message body.
• Donations: name, email, mailing address, payment token (never card numbers directly — see § 4).
• Usage telemetry: IP address, user-agent, referring URL, timestamps (for security + traffic analytics).

2.2 Program Participants (Residents)

• Identity: legal name, date of birth, government ID references.
• Contact: phone, email, emergency contact.
• Program records: intake assessments, housing placements, employment history, financial-literacy paychecks, compliance milestones, milestone signatures.
• Sensitive categories (handled under § 5 HIPAA safeguards): behavioral health status, substance-use history, physical health notes, disability disclosures, faith affiliation (voluntary), survivor / trafficking history (voluntary; documented consent required).

2.3 Vendors, Landlords, Employers

• Business identity: legal entity, EIN, remittance details, W-9 records.
• Invoices and payment mirrors — no consumer PHI is routed to vendors.

2.4 Staff

• Employment identity, role assignment, MFA credentials, session telemetry, audit-log actor stamps.

3. How We Use Information

We use information only for purposes disclosed at the point of collection and for the ongoing operation of the program. Explicitly:

• Service delivery — case management, housing placement, paycheck absorption, milestone tracking.
• Care coordination — sharing minimum-necessary data with tripartite partners (Life Foundation, Engaging Minds Services, Vision 8:28) under governance agreements.
• Compliance — HIPAA, HMIS, funder audits, state licensing.
• Communication — program updates, appointment reminders, opt-in newsletter.
• Security — fraud prevention, incident response, audit-log integrity.

We do not sell personal information. We do not use participant data for behavioral advertising, machine-learning training with third parties, or profiling outside the direct scope of the care model.

4. Payment Data

Payment card details are handled directly by our PCI-DSS Level 1 processor (Stripe, Inc.). LIFE LLC receives only tokenized references and last-four digits for reconciliation. No cardholder data is stored on the Platform.

5. Protected Health Information (PHI) — HIPAA Safeguards

When the Platform receives, creates, or transmits PHI on behalf of a covered entity or through the tripartite program, we apply the technical, physical, and administrative safeguards required by the HIPAA Security Rule (45 CFR § 164.308–316). See our HIPAA Notice of Privacy Practices and Security & Compliance disclosures for the specific controls.

Covered entities working with LIFE LLC may execute a Business Associate Agreement (BAA) before any PHI is exchanged. No PHI is transmitted absent an executed BAA.

6. Data Sharing

We share information only in the following, tightly scoped scenarios:

7. Your Rights

Regardless of jurisdiction, every individual whose data we hold has the right to:

• Access — request a copy of your records.
• Correction — request that inaccurate data be corrected.
• Deletion — request erasure, subject to legal-retention obligations (HMIS + grant compliance).
• Restriction / Objection — limit certain processing, including opt-out of non-essential communications.
• Portability — receive your data in a structured, machine-readable format.
• Complaint — file a complaint with the U.S. Department of Health and Human Services (Office for Civil Rights) or your state Attorney General without retaliation.

Send all rights requests to privacy@theexchangealliance.org or the mailing address in § 12. We respond within 30 days.

8. Retention

Program participant records are retained for the duration of enrollment plus seven (7) years to satisfy HIPAA (§ 164.316(b)(2)(i)), HMIS, and federal grant audit requirements. Public-visitor telemetry is retained 90 days. Newsletter subscriptions persist until you unsubscribe.

9. Cookies & Tracking

We use strictly necessary cookies for authentication, session integrity, and CSRF defense. Analytics cookies (aggregate, non-identifiable) are opt-in through the cookie banner. We do not use advertising cookies or cross-site trackers.

10. Children's Privacy

The Platform is not directed to children under 13. Program participants under 18 are enrolled only with documented guardian consent and are subject to additional care protocols governed by state child-welfare law.

11. Changes to this Policy

Material changes to this Policy will be posted here with an updated "Last updated" date. For substantial changes affecting how we handle PHI, we will notify affected participants and covered entities in writing thirty (30) days before the change takes effect.

12. Contact

The Learning Institute for Empowerment, LLC (DBA LIFE LLC)

Operating The Exchange Alliance Platform

• Privacy Officer: privacy@theexchangealliance.org
• Compliance Officer: compliance@theexchangealliance.org
• Executive Director: William Smith · william@theexchangealliance.org
• Mailing Address: [Registered mailing address — Horry County, SC — to be finalized before live deployment]
• EIN: [XX-XXXXXXX — to be finalized before live deployment]