Homebase Privacy Policy
Provider: SLRiches LLC, doing business as Sober Living Riches and Homebase ("Homebase") Contact: legal@soberlivingriches.com
This policy explains how Homebase handles personal information for its software service. It does not replace a customer's resident or patient privacy notice. When Homebase handles protected health information (PHI) for a regulated customer, it acts under the BAA and the customer's lawful instructions.
1. Information covered
Homebase may process member account and agreement information; customer-submitted information about homes, beds, applicants, residents, forms, signatures, drug tests, payments, referrals, and outcomes; connected-service identifiers and encrypted tokens; device, browser, security, audit, and diagnostic information; and support requests and communications.
An identifier is not PHI merely because it identifies a person. HIPAA protection depends on the applicable covered-entity or business-associate relationship and association with health, care, or qualifying payment information. Part 2 is evaluated separately when information identifies a person as having or having had a substance use disorder.
2. Uses
Homebase uses information to provide and secure the service; authenticate and support users; perform customer-directed workflows; create requested drafts, forms, reports, websites, and payment links; maintain audit and acceptance records; prevent abuse; recover from failures; comply with law and contracts; and improve reliability and usability using appropriately limited or de-identified information.
Homebase does not sell personal information, share it for cross-context behavioral advertising, or use PHI or Part 2 records to train general-purpose AI models.
3. Roles and disclosures
Customers determine what operational data to collect, lawful purpose, users, notices, consents, and retention. Homebase processes customer data to provide the service and acts as a business associate where the legal requirements are met. Homebase independently controls account administration, service security, billing, legal compliance, and its business records.
Homebase uses providers for cloud hosting and storage, service email, authentication, payment processing, address validation, and customer-selected integrations. Operational records are hosted on Google Cloud; not every optional integration is a Google service. A provider receives only information needed for its purpose, subject to appropriate contractual and access restrictions. A required BAA must exist before a provider receives PHI. Homebase may also disclose information when legally permitted and necessary to comply with law, protect people or the service, complete a corporate transaction subject to continuing protections, or follow the customer's lawful direction. None of these grounds expands disclosures permitted under the BAA or Part 2.
Publishing a website or opting a home into a public directory makes the selected business content accessible to the public and potentially search engines. It does not authorize publication of private resident records. The customer controls what it publishes and must obtain rights to names, images, and testimonials. Payment processors receive information needed to process the customer's payment workflow under their own policies. Connecting a mailbox authorizes the requested connection and draft functions, not the publication of mailbox credentials. Disconnecting a provider stops new use of that connection; copies already created in the provider's service remain subject to that provider's controls.
4. Security
Homebase uses administrative, physical, and technical safeguards designed to protect information, including tenant isolation, access controls, encryption, private storage, managed secrets, audit controls, backups, recovery controls, and incident procedures. Access for service administration and support is limited to authorized purposes and personnel. No system can guarantee absolute security. Report suspected issues to legal@soberlivingriches.com; do not include resident records or credentials in an ordinary email.
5. Retention and requests
Homebase retains information for the service term and as needed for security, recovery, legal obligations, disputes, and customer instructions. Customer data is returned or deleted as required by the agreement and BAA; protected backup copies expire under the documented lifecycle. Contract and compliance records may be retained for at least six years or longer when law or a legal hold requires it.
Requests involving customer-controlled resident, applicant, patient, or employee data should ordinarily go to that customer. Homebase assists with access, correction, restriction, accounting, export, or deletion obligations as required. Homebase member-account requests may be sent to legal@soberlivingriches.com and require reasonable identity verification.
6. Cookies, children, and changes
Homebase uses cookies or equivalent storage necessary for authentication, security, preferences, and operation, not third-party behavioral advertising. Blocking essential cookies may prevent sign-in. Member accounts are for adults acting in a business capacity; the service is not directed to children. Customers are responsible for any lawful authority required to enter information about minors.
7. Choices and applicable privacy rights
Depending on applicable law and Homebase's role, individuals may have rights to know or access, correct, delete, or obtain a copy of their information, and to limit certain processing or appeal a denied request. Requests can be made through the contact above, including through an authorized agent where permitted. Homebase will explain denials and available appeal routes when required. It will not unlawfully discriminate against a person for exercising privacy rights. Some information must be retained for legal obligations, security, or another lawful exception; deletion is not unconditional. Homebase does not sell or share information for targeted advertising, so there is no such sale or sharing to opt out of. Optional promotional email includes an unsubscribe method; essential security and account messages are handled separately.
8. Policy changes and service location
Homebase operates from the United States. This policy does not promise eligibility for use in every jurisdiction or replace a legally required international transfer agreement. Material changes will be communicated in the service or through the account contact. Accepted copies remain accessible in Settings. This policy is effective September 5, 2026.