HIPAA notice

How patient information is protected.

Last updated September 23, 2026

Roles

• The agency is the health care provider and decides what a caregiver needs to know for a visit: name, address, care tasks, mobility, medications to be aware of, household notes.
• Rayva stores and transmits that information on the agency's behalf under a business associate agreement, and does nothing else with it. Rayva does not use patient information for matching, pricing or analytics.
• The caregiver receives it for one purpose: delivering the visit.

What a caregiver sees, and when

• Before accepting: the care type, the credential required, the time, the town, and the pay. No patient name, no address.
• After accepting: the address, the agency's contact, and the patient details the agency shared, behind Face ID or the phone's passcode.
• Every time a caregiver opens patient details, the read is logged with who, when and which visit. The agency can see that log.
• Seven days after the visit, the patient information is removed from the phone. If the caregiver gives the visit back, it's removed immediately.

Visit notes

Notes a caregiver writes during a visit belong to the agency's record. They're released to the agency when the visit is marked complete, and the agency's reading of them is logged the same way.

What Rayva does with it

• Encrypts it at rest with keys held separately from the database, and in transit everywhere.
• Limits which staff can reach it, and logs every access.
• Never shows it to another agency or caregiver, never uses it to train models, never sells it.
• Removes it when the agency closes its account, keeping only de-identified financial records.

If something goes wrong

If Rayva discovers a breach of unsecured patient information, we notify the affected agency without unreasonable delay and within the time the business associate agreement and HIPAA require, so the agency can meet its own obligations to patients.

Caregivers' obligations

• Use patient information only to deliver the visit.
• Don't photograph, copy, screenshot or share it, including with family, in group chats, or on social media.
• Report anything that looks wrong — a lost phone, a message sent to the wrong person — to the agency and to hello@getrayva.com the same day.

Patients

Rayva does not have a direct relationship with patients. Questions about your health information, your rights, or a request for your records go to your home care agency, which holds the record.

See also: Terms of service · Privacy policy · HIPAA notice. Questions: hello@getrayva.com.