Privacy Policy

Apex Care Compliance, a division of Apex Growth Solutions Inc., provides workforce compliance management services to healthcare facilities. This Privacy Policy explains how we collect, use, store, protect, and disclose personal information from three groups:

• Facility Clients: Administrators, Directors of Nursing, and authorized representatives of healthcare facilities that engage our services.
• Workers: Healthcare professionals (RNs, LPNs, CNAs, HHAs, DSPs, MAs, RTs) whose compliance documentation is managed on behalf of Client facilities.
• Website Visitors: Individuals who visit apexcarecompliance.com.

• Facility identification: Legal name, license/CMS number, facility type, physical address.
• Contact information: Name, professional title, direct phone, and work email of the designated compliance contact.
• Roster information: Names, roles, and employment details of workers to be enrolled.
• Service agreement data: Signed Managed Service Agreement, BAA, and onboarding documentation.
• Payment information: Processed through secure third-party processors; not stored on Apex Care Compliance systems.

• Identity documents: Government-issued photo identification.
• Professional credentials: Licenses, certifications, license numbers, issuing boards, and expiration dates.
• Background check records: FBI criminal background, PA Act 33 Child Abuse Clearance, PA Act 34 Criminal History.
• Health documentation (PHI): TB test results, health screening records, immunization records, and physical examination results.
• CPR certifications: Issuing organization and expiration date.
• Employment history: Resume and verified work history.

When you visit apexcarecompliance.com, we may collect browser type, operating system, IP address, pages visited, time on pages, and referring URL. We do not use tracking pixels, behavioral advertising cookies, or third-party advertising networks.

Each Client's compliance data is isolated within a dedicated account environment. No facility can access another facility's worker data. Worker information submitted by one Client is never shared with, disclosed to, or made visible to any other Client.

Apex Care Compliance may engage trusted service providers bound by written data processing agreements, limited to: secure cloud storage providers, encrypted email service providers, payment processors (operating under their own PCI-DSS compliance), and background check verification services where applicable.

Apex Care Compliance may disclose personal information if required by valid legal process, court order, or a request from a government regulatory agency with jurisdiction (including Pennsylvania Department of Health or U.S. HHS). Where legally permissible, we will notify the affected Client prior to disclosure.

Apex Care Compliance acts as a Business Associate as defined under HIPAA (45 C.F.R. § 160.103) when handling PHI on behalf of Client facilities that are Covered Entities. We are subject to HIPAA's Privacy Rule and Security Rule with respect to all PHI we receive, process, or maintain.

Apex Care Compliance applies the HIPAA Minimum Necessary Standard — we use, disclose, or request only the minimum amount of PHI needed for the specific compliance management purpose.

In the event of a breach of Unsecured PHI, Apex Care Compliance will notify the affected Client facility within sixty (60) calendar days of discovery, per HIPAA Breach Notification Rule requirements (45 C.F.R. Part 164, Subpart D).

• Encryption in transit: All PHI transmitted via email is encrypted using S/MIME and TLS protocols.
• Encrypted storage: Credential documents stored in access-controlled, encrypted cloud storage with audit logging.
• Access controls: Access restricted to personnel based on job function on a minimum-necessary basis.
• Audit logging: Access to PHI and sensitive credential records is logged and auditable.
• Security reviews: Periodic reviews of data security practices and safeguards.

No data transmission or electronic storage system can be guaranteed completely secure. While we work diligently to protect your information, we cannot guarantee absolute security.

Upon termination of a Managed Service Agreement, Apex Care Compliance will return all Client and worker data in a standard exportable format within thirty (30) days, or securely destroy it and provide written certification. PHI deletion follows BAA terms.

Workers may request access to their personal information (excluding PHI, which must be requested through the employing facility). Contact jephthe@apexcarecompliance.com or your employing facility's compliance administrator.

Workers may request correction of inaccurate personal information by submitting updated documentation through their employing facility or directly to Apex Care Compliance. We will process correction requests within thirty (30) days.

Workers may request deletion of their personal information, subject to limitations: we cannot delete information required by law (including HIPAA-governed PHI), necessary for active services under a current Managed Service Agreement, or subject to a pending legal matter. We will respond within thirty (30) days.

The Apex Care Compliance website uses only essential technical cookies necessary to operate the website. We do not use:

• Third-party advertising or tracking cookies.
• Behavioral targeting or retargeting cookies.
• Social media tracking pixels.
• Cross-site tracking technologies of any kind.

Apex Care Compliance respects Do Not Track (DNT) signals from browsers.

Apex Care Compliance's services are directed exclusively to healthcare facilities and healthcare professionals. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have collected information from a minor, please contact us immediately at jephthe@apexcarecompliance.com.

This Privacy Policy is governed by the laws of the Commonwealth of Pennsylvania and applicable federal law, including HIPAA, HITECH, and the Pennsylvania Breach of Personal Information Notification Act (73 P.S. §§ 2301–2329). Any dispute shall be resolved in a court of competent jurisdiction in Lancaster County, Pennsylvania.

Pennsylvania Breach Notification: In the event of a breach involving personal information of Pennsylvania residents (excluding PHI), Apex Care Compliance will provide notice as required under Pennsylvania's data breach notification law.

Apex Care Compliance reserves the right to update this Privacy Policy at any time. When we make material changes, we will update the "Last Updated" date, notify active Client facilities by email at least thirty (30) days before the effective date, and post the updated Policy at apexcarecompliance.com/privacy.

For questions, concerns, or requests related to this Privacy Policy: