Privacy Policy

1. Introduction

BedGrid ("we," "us," or "our") operates a free web-based platform that tracks post-acute care bed availability across California. Our platform connects post-acute care facilities, hospitals, and patients/families to improve discharge planning and care placement. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services (collectively, the "Service"). By using BedGrid, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Information You Provide

• Account Registration: When you create an account, we collect your name, email address, phone number, role (facility staff, hospital staff, or family/patient), and, for facility accounts, your facility name, address, license number, and type.
• Facility Data & Bed Submissions: Facility users submit daily bed availability data including bed counts by type (male, female, hospice, isolation, custodial), clinical capabilities and limitations, diagnoses accepted or rejected, admitting status, and anticipated future availability.
• Feedback & Communications: When you submit feedback, bug reports, suggestions, or contact us, we collect the content of your message along with your contact information.
• Search Alerts: If you create search alerts, we store your filter preferences so we can notify you when matching beds become available.

Information Collected Automatically

• Cookies & Authentication: We use cookies to manage your authentication session. These are essential for the Service to function and are not used for advertising.
• Usage & Device Information: We may automatically collect information about your device, browser type, operating system, IP address, pages visited, and interactions with the Service. This information helps us maintain, improve, and secure the platform.
• Log Data: Our hosting provider (Vercel) may collect server logs including request timestamps, URLs accessed, and response codes for performance monitoring and security purposes.

3. How We Use Your Information

• Service Delivery: To operate the platform, display bed availability data to authorized users, process bed submissions, and send search alert notifications.
• Communication: To send you daily submission reminders, search alert notifications, account-related emails (password resets, verification), and important service updates.
• Improvement: To analyze usage patterns, identify issues, improve the user experience, and develop new features.
• Security & Compliance: To protect against unauthorized access, detect fraud, and comply with legal obligations.

Sensitive Personal Information

Certain data submitted through BedGrid — including clinical capabilities, accepted and rejected diagnoses, isolation needs, and other health-related facility data — may constitute sensitive personal information under the California Privacy Rights Act (CPRA). We treat this information with heightened care. It is used exclusively to operate the bed registry service (for example, to match hospitals with facilities that meet specific clinical needs) and is never used for advertising, profiling, or sold to third parties. We collect only the minimum clinical information necessary to provide the Service, and we limit access to this data to authorized hospital users and facility staff.

4. How We Share Your Information

• With Other Users: Facility bed availability data is shared with hospital users for discharge planning. A sanitized subset of facility data (facility name, type, location, bed counts, clinical capabilities) is visible to family/patient users and the general public through our public dashboard and search pages. Facility contact information (phone number, address) is displayed to help users connect with facilities directly.
• Service Providers: We use third-party services to operate BedGrid, including Vercel (hosting and deployment), Supabase (database hosting), and Resend (transactional email). These providers process data on our behalf and are contractually obligated to protect your information.
• Legal Requirements: We may disclose your information if required by law, subpoena, court order, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell, rent, or trade your personal information to third parties for marketing or advertising purposes. BedGrid is a free platform and does not monetize user data.

5. Data Retention

We retain different types of information for different periods based on how it is used:

• Account Information (name, email, role) is retained for as long as your account remains active. If you request deletion, we will remove your personal account data within 30 days.
• Bed Submission Data is retained indefinitely in aggregated or anonymized form to support historical trend analysis and public reporting. Personally identifiable submission data (such as the user who submitted it) is removed upon account deletion.
• Search Alerts & Saved Searches are retained until you delete them or close your account.
• Feedback & Support Communications are retained for up to 2 years to support service improvement and follow-up.
• Server Logs (IP addresses, request timestamps) are typically retained for 90 days by our infrastructure providers for security and performance monitoring.

Retention may be extended where required by law, to resolve disputes, or to enforce our agreements. To request deletion of your data, contact us at support@bedgrid.org.

6. Data Security

We take reasonable technical and organizational measures to protect your information. Data is transmitted over encrypted connections (HTTPS/TLS). Our database is hosted on Supabase with enterprise-grade security, including encryption at rest and in transit. Authentication credentials are hashed and never stored in plain text. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

7. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete personal information.
• Delete your account and associated personal information.
• Export your data in a portable format upon request.
• Opt out of non-essential communications.

To exercise any of these rights, please contact us at support@bedgrid.org. We will respond to your request within 30 days.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we hold about you.
• Right to Limit Use of Sensitive Information: Under CPRA, you have the right to limit our use and disclosure of sensitive personal information (such as clinical/health-related facility data) to uses that are necessary to provide the Service. We already restrict use of sensitive information in this way by default.
• Right to Opt Out of Sale: We do not sell personal information. Because we do not sell your data, there is no need to opt out of data sales.
• Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To make a CCPA/CPRA request, contact us at support@bedgrid.org.

9. Children's Privacy

BedGrid is not directed at individuals under the age of 18, and users must be at least 18 years old to create an account. We do not knowingly collect personal information from children under the age of 13. If you are a parent or guardian and believe that your child under the age of 13 has provided us with personal information, please contact us immediately at support@bedgrid.org and we will promptly delete that information from our systems.

10. Healthcare Disclaimer

BedGrid is an information platform, not a healthcare provider. We do not provide medical advice, diagnosis, or treatment recommendations. Bed availability data displayed on the platform is self-reported by participating facilities and may not reflect real-time conditions. We do not verify the accuracy of submitted data. Users should always contact facilities directly to confirm availability, services, and suitability before making care placement decisions.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you via email or a prominent notice on the Service. Your continued use of BedGrid after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: