Privacy Policy

TagProof is sold to organizations — the operator of a building, not the individual people who use it. The rooms, equipment, inspections, work orders, deficiencies, photos and notes in a TagProof account belong to that organization. We hold and process them on its behalf, and its administrators decide who has access.

If you use TagProof through your employer and want to see, correct or remove something in your facility’s records, start with your organization’s administrator. We will help them, and we will tell you if a request needs to go through them.

Account information. Your name, email address, and password (stored only as a secure hash by our sign-in provider), the organization and buildings you belong to, and your role.

What you put into TagProof. Work orders, problem reports, inspection results, notes, shift log entries, questions you ask the assistant, voice notes, and the photos you take or attach — of equipment, nameplates, receipts and problems. Changes are recorded with who made them and when, because a compliance record needs that history.

Photos. Photos you attach from your photo library are uploaded without their location data. The app only reads the photos you choose.

Your device, for notifications. If you allow notifications in the app, we store your device’s push token and its name (such as “Pat’s iPhone”) so we can send alerts about work assigned to you and things due today. Signing out removes it.

Billing. When an organization subscribes, payment is handled by Stripe. We receive the billing contact and subscription status. We never see or store full card numbers.

People without an account. A staff member can report a problem by scanning a code on a door or a piece of equipment, without signing in. We keep what they write and, if they choose to give one, an email address so we can tell them when it is fixed. Visitors to our public facility records can sign up for email alerts; we keep that email address and what it is watching, and every alert email has an unsubscribe link.

Searches of our user guide. When a search of the user guide finds nothing, or only a passing mention, we keep its words, to help us write the missing answer. They are kept on their own, never with your name or account. Before they are kept, we remove what we can recognize: email addresses, phone numbers, long numbers, and a name right after a title such as “Mrs.” or “Dr.” or after the word “resident”, “patient” or “tenant”. We can’t catch everything, so please don’t type names or other personal details. Your IP address is used only in scrambled form, to limit how often searches are recorded, and is deleted at the next daily clean-up. The words are deleted 90 days after anyone last searched for them, which we check daily.

Technical information. Our servers see your IP address with each request. We use it to limit abuse of public forms (such as too many reports from one address). If you send us feedback from inside the app, we keep the page you were on and your browser or device type with it.

We don’t use advertising or analytics trackers. The website sets only the cookies it needs to work: keeping you signed in, remembering the last building you opened, and completing a password reset.

TagProof is about buildings, not care. It isn’t built to hold residents’ medical records, and we ask you not to put them in it. Some notes naturally mention a resident — “call light not working in 112” or “resident must be present”. Those notes are part of your facility’s records and are protected like the rest of them.

A survey’s statement of deficiencies (the CMS-2567) can describe a resident’s care. TagProof’s record of a 2567 keeps its dates and which findings are on it, not the statement, and we ask that what you write under “What was cited?” on a finding be in your own words, without residents’ names or care details. An IDR request you save can describe what a finding states; it is kept, and only admins and foremen can read it. Edits to it that aren’t saved yet are kept in your browser until they are, and signing out clears them. The dispute check, where an admin or foreman can paste a citation to set it beside the building’s records, works only on citations about the building, and it never saves what was pasted. It turns away a health citation. It also turns away a paste when the sentences it takes out tell of a resident’s care or of something that happened to residents: for a building F-tag, any one such sentence; for a K- or E-tag, half its sentences or more, and two at least; and for a paste without that finding’s heading, any one, or text that reads as care overall. From any other citation, every sentence it finds about a particular resident is taken out before anything is sent.

Some features use an AI model, provided by Anthropic, to do work you would otherwise type: setting a report’s priority, flagging likely duplicates, reading a nameplate or receipt from a photo, drafting a shift log or a plan of correction, checking a pasted survey citation against your records, drafting an IDR request, and answering questions about your building.

• Before any text is sent to the model, we remove email addresses, phone numbers, Social Security numbers, long ID numbers, and names that follow a title or the word “resident”, “patient” or “tenant”.
• A pasted survey citation, and what a deficiency says under “What was cited?”, go through a stricter pass as well. It also removes the names it finds after a staff title such as Nurse, Staff, Director or Technician, in brackets or set off by commas beside a resident’s or staff member’s code or a title, or after a family word; initials and ages; and every sentence it finds that points to a particular resident, whether by their code in any form, as “the resident” or “a resident”, or as “she” or “he” after one, even a sentence only about their room. A sentence about residents in general, such as “all residents” or “residents on oxygen”, is kept, unless it tells of something that happened to them, such as a fall. A name on its own, with no title or code beside it, isn’t caught. A pasted citation is also trimmed to the finding itself: the form’s headers, the code text it prints or quotes, and the plan of correction are taken out where TagProof can tell them apart from the findings.
• Before a pasted citation is sent, you see exactly what the model will read, with what was removed marked, and it goes only when you confirm. Read it for any name the stricter pass missed. Up to 40 summary lines from that tag’s records go with it, and you see those first too: each check, device and room by its name, work orders by title and documents by type, the dates, results and labels, and a skipped check’s reason, with those typed words put through the same stricter pass. A record’s notes, who did it, and any reason typed for a missing photo or an N/A answer never go. If those lines change before you confirm, nothing goes until you check again. TagProof never saves the paste: it isn’t kept on your device or in your records, and leaving the page clears it.
• When an admin or foreman drafts a section of an IDR request, the model reads only the finding’s tag, with its title and summary from TagProof’s tag list, the survey’s dates, the citation’s sentences you previewed in the check, the points you ticked to argue (by the sentences and records they rest on, not their wording), and the records you picked to enclose, as summary lines: what each record is, its days, results and labels, with titles put through the same stricter pass. It’s never told what you’re asking the state for, and TagProof never adds the facility’s name, address or CCN, a record’s notes or who did it, or the figures from CMS’s file. A name typed into a work order’s title or a room’s or device’s name, or left in the sentences you previewed, can still go, so read those lines for one before you draft. TagProof doesn’t keep the paste or the draft as it came back; only the text you choose to use in the request is saved.
• The assistant answers only from the records your account can already see. It can’t reach another organization’s data.
• What the AI suggests is shown to you to check before it is saved. Anthropic processes this data to provide the service to us and doesn’t use it to train its models.

• To provide TagProof: sign you in, show and save your records, sync the app, and send the notifications you’ve allowed.
• To keep it secure and working: prevent abuse, fix problems, and answer support requests.
• To send emails you need: invitations, password resets, word that a problem you reported is fixed, and alerts you signed up for.
• To bill organizations that subscribe.
• To meet our legal obligations.

We don’t sell personal information, share it for advertising, or use it to track you across other companies’ apps and websites.

We share information only with service providers that run parts of TagProof for us, under contracts that limit them to doing that:

• Supabase — database, sign-in, and photo storage
• Vercel — hosting the website and web app
• Anthropic — the AI features described above
• Stripe — payments
• Mailgun — sending email
• Expo, Apple and Google — delivering push notifications to your device

We may also disclose information if the law requires it, to protect people’s safety, or as part of a merger or sale of our business, in which case this policy would continue to apply to it.

So TagProof works where there is no signal, the app keeps a copy of your next 30 days of work on your device, along with anything you haven’t sent yet. Signing out clears the saved copy of your records.

Compliance records are kept for as long as the organization has a TagProof account, because surveyors expect a building’s history to be complete. Removing a record in TagProof hides it rather than erasing it, so the history stays intact. When an organization closes its account, it can ask us to export its records and then delete them.

Email alert subscriptions are kept until you unsubscribe. Information used to limit abuse is kept only for the short window it is needed for.

You can ask us for a copy of the personal information we hold about you, to correct it, or to delete your account, by emailing privacy@tagproof.io. Depending on where you live, you may have other rights under local law, and we will honor them. Where the information is part of an organization’s records, we will work with that organization to respond.

On your phone you can turn off TagProof’s notifications, camera and photo access at any time in Settings. Scanning and taking photos won’t work without camera access, but the rest of the app will.

Information is encrypted in transit. Every organization’s records are separated at the database level, so one organization can’t see another’s. No system is perfectly secure; if we learn of a breach that affects your information, we will tell you as the law requires.

TagProof is a workplace tool and isn’t meant for children. We don’t knowingly collect information from anyone under 16.

If we change this policy, we will update the date at the top. If a change is significant, we will also tell account holders by email or in the app before it takes effect.

Questions or requests about privacy: privacy@tagproof.io. Busyboy Solutions LLC.