Privacy policy

Effective August 28, 2026. Last updated August 28, 2026.

Who we are and what this covers

Sevana is an operations and compliance platform for California residential care facilities for the elderly, known as RCFEs. Our customers are the facility operators. This policy covers our marketing site, the operator application, and the family portal.

Two roles matter throughout this policy. For information about our own customers and about visitors to this site, we decide what is collected and why, so we are the business responsible for it. For resident and staff records that an operator enters into Sevana, the operator decides what is collected and why. We hold and process that information on the operator’s instructions, under our contract with the operator. Under California privacy law that makes us a service provider for those records.

Sevana is a product of Souli Software Solutions, which is the controller of operator account information and the service provider for records operators enter.

What we collect

Access requests. The form at /request-access collects your facility name, your name, your email address, your phone number, your city or county, and your bed count range. The form says we use this only to reach you about Sevana, and that is what we do. We do not add you to a marketing list from it.

Account information. When a facility sets up Sevana, we collect the names, email addresses, and roles of the people who sign in, plus their sign-in activity, so we can authenticate them and show who did what.

Facility records. Operators enter the records they need to run the home: resident profiles, care plans, medication administration records, daily task and note history, incidents, staff credentials, documents, and photos. Much of this is health information about residents. It belongs to the facility and its residents, not to us.

Family portal information. An operator invites a family member or resident representative to a specific resident. The signer then chooses which information categories to authorize; every category starts off. Sevana enforces both that signed authorization and the selected categories on each request. The signer can withdraw consent at any time, which changes subsequent access.

Technical information. Running the service produces server logs and error reports. These contain request details such as timestamps, routes, and identifiers. We use them to keep the service working and to investigate problems.

Billing information. Our payment processor handles payment details for us. We see the billing contact and the status of a subscription, not full card numbers.

Why we use it

We use this information to provide the product, to authenticate people and keep accounts secure, to answer support requests, to invoice operators, to detect and fix faults, and to meet our own legal obligations. We do not sell or share personal information for cross-context behavioral advertising, and we do not use resident records to train models or to build advertising profiles.

Who we share it with

We share information with the service providers that run Sevana: sign-in, hosting, the database, file storage, transactional email, error monitoring, and billing. Each one works under a contract that limits it to processing information for us, and we keep a current list available to operators on request. We also disclose information when a law or a valid legal process requires it, and to professional advisers who are bound to keep it confidential. If Sevana is ever acquired or merged, information moves with the business and this policy travels with it until it is replaced.

Health information and email

Sevana stores protected health information for the facilities that use it. Our architecture is HIPAA-ready and our operating posture is HIPAA-required, in the words of our security policy. That is a description of how the system is built and run. It is not a certification, and no one certifies HIPAA compliance.

Our email provider does not offer a business associate agreement. Family portal invitations can include the resident name needed to identify the invitation. Clinical records and care notes are reviewed after sign-in.

Whether we sign a business associate agreement with a given operator, and on what terms, is settled in that operator’s contract.

How we protect it

Recorded audit entries are hash-chained with SHA-256 so tampering can be detected. Staff requests are scoped to the active facility; family sessions can reach only residents named in their signed authorizations. Data is encrypted in transit and at rest. Security reports go to info@sevanacare.com, and we acknowledge them within two business days.

How long we keep it

We keep account and facility records for as long as the facility has an active Sevana account. After an account closes, we keep records for the period the operator’s contract sets, then delete or de-identify them. Care records also carry retention duties that fall on the facility under California law, and we do not delete ahead of those duties.

Your rights

California residents have rights over their personal information under the California Consumer Privacy Act as amended by the California Privacy Rights Act. You can ask what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. You can ask us to limit the use of sensitive personal information. We do not sell or share personal information, so there is nothing to opt out of there. We will not treat you differently for asking.

If your information is in Sevana because a facility put it there, the facility decides those requests. Send your request to the facility. If you send it to us, we pass it to the facility and support them in answering it, which is what our service-provider role requires.

To make a request about information we hold as the responsible business, write to info@sevanacare.com. We verify who you are before we act, usually by replying to the address already on the account. An authorized agent may act for you with written permission we can check.

Children

Sevana is built for adult residential care and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child’s information reached us, write to info@sevanacare.com and we will remove it.

Changes to this policy

When we change this policy we update the effective date at the top. If a change affects how we handle personal information in a way that matters to you, we tell account holders by email before it takes effect.

Contact us

Privacy questions, requests, and security reports: info@sevanacare.com.