Case Magic Privacy Policy

Effective date: November 14, 2026

Case Magic collects only the information needed to run the service, never sells it, and protects health information as HIPAA requires.

1. Who we are and what this policy covers

Case Magic is a web application operated by Case Magic, LLC (“Case Magic,” “we,” “us”). It helps service providers vendored by California Regional Centers manage consumer records, staff, documentation and billing.

This policy explains how we handle information when you:

visit our website or sign up for an account
use the Case Magic application on a desktop or mobile device
connect to Case Magic through our API or a sign-in provider
contact us for support

Our role with client data. Our customers (“Clients”) are the organizations that subscribe to Case Magic. Clients decide what consumer records to enter and how to use them. For that data, we act as the Client’s service provider and, where HIPAA applies, as its business associate. The Client’s own privacy practices govern those records, and we handle them only as our agreement with the Client allows.

For account, billing and website information about the people who use Case Magic, we decide how it is used, and this policy describes those practices directly.

2. Information we collect

Categories of information we collect
Category	Examples	Source
Account information	Name, work email, job title, organization, role and permissions, password hash	You or your organization’s administrator
Client records (may include PHI)	Consumer names, Unique Client Identifiers (UCIs), dates of birth, service authorizations, case notes, attendance, uploaded files in Cloud Chart	Entered or uploaded by Client staff
Billing and eBilling data	Service units, rates, invoice data, Regional Center vendor numbers, files prepared for eBilling	Generated from Client records
Subscription payment data	Billing contact, plan, payment status	You; card details are handled by our payment processor, not stored by us
Sign-in provider data	Name, email, and a unique account ID from Google or Microsoft	The provider, with your permission
Messages and announcements	In-app messages between users, read status of system announcements	You and other users in your organization
Usage and device data	IP address, browser and device type, pages and tabs opened, timestamps, error logs	Collected automatically
Audit logs	Who viewed, created, changed, exported or deleted a record, and when	Collected automatically, as HIPAA requires
Support communications	Emails, call notes, screenshots you send	You

We do not use client records for advertising, and we do not collect information from consumers directly unless a Client gives them access to the service.

3. How we use information

We use information to provide and protect the service, and for no unrelated purpose:

Run the service: create accounts, sign you in, store and display records, keep several in-app tabs open at once, and sync your work across devices.
Prepare billing: generate invoices, spreadsheets and eBilling files your organization submits to Regional Centers.
Communicate: deliver in-app messages, send announcements about new features and scheduled maintenance, and answer support requests.
Secure the service: authenticate users, detect suspicious activity, keep audit logs and investigate incidents.
Improve the service: fix errors and measure feature use, relying on usage data that does not include record contents wherever possible.
Meet legal duties: comply with HIPAA, state law, valid legal process and our contracts.

We do not sell personal information, share it for cross-context behavioral advertising, or use client records to train artificial intelligence models.

4. Protected health information and HIPAA

When a Client is a HIPAA covered entity, we sign a Business Associate Agreement (BAA) before handling its protected health information (PHI). The BAA controls if it conflicts with this policy.

Under the BAA and the HIPAA Privacy, Security and Breach Notification Rules, we:

use and disclose PHI only to provide the service, as the BAA permits, or as required by law
limit staff access to the minimum necessary for support, maintenance or security work, and log that access
apply administrative, physical and technical safeguards (see Section 8)
require any subcontractor that handles PHI to sign its own BAA with equivalent protections
report breaches of unsecured PHI to the Client without unreasonable delay, and no later than 60 days after discovery
help the Client respond to individuals’ requests to access, amend or get an accounting of disclosures of their records
return or destroy PHI when the agreement ends, where feasible

California confidentiality laws. Records of people served through Regional Centers are also confidential under the Lanterman Developmental Disabilities Services Act (Welfare and Institutions Code section 4514) and, for medical information, the Confidentiality of Medical Information Act. We handle these records consistently with those laws and the Client’s instructions.

We share information only in these situations:

Within your organization. Users in the same Client account see records, messages and files according to the roles their administrator assigns.
Regional Centers and DDS. When your organization submits billing, the eBilling files and related data go to the Regional Center or Department of Developmental Services systems your organization chooses.
Service providers. Vendors that host our servers, store backups, send email or process payments handle data on our behalf under written contracts, and under a BAA whenever PHI is involved.
Integrations you turn on. If your organization connects another application through our API, we share the data that connection is authorized to access (see Section 7).
Legal requirements. We disclose information when required by law, subpoena or court order, or to protect someone’s safety. Where allowed, we notify the affected Client first.
Business transfers. If Case Magic, LLC is merged or sold, information may transfer to the new owner, which must honor this policy and any BAA in effect.

We do not sell or rent personal information to anyone.

You can sign in with a Google or Microsoft account instead of a Case Magic password. We use the OAuth 2.0 and OpenID Connect standards for this.

We request only your name, email address and a unique account identifier.
We never see or store your Google or Microsoft password.
We do not read your email, files, calendar or contacts in those accounts.
Your organization’s administrator decides which sign-in methods are allowed and can require multi-factor authentication.

Google’s and Microsoft’s own privacy policies govern what those companies collect when you sign in with them. You can remove Case Magic’s access at any time from your Google or Microsoft account settings; you will then need another sign-in method.

7. API and third-party integrations

Case Magic offers an API so Clients can connect other systems. An organization administrator must approve each connection.

Every API client is authorized through OAuth 2.0 with scopes that limit which data it can read or change.
API traffic is encrypted in transit and recorded in the same audit logs as activity in the app.
Administrators can see and revoke active connections at any time.
A third-party application that receives PHI through the API is the Client’s responsibility to vet, including obtaining any BAA the Client needs with that vendor.

We are not responsible for how an outside application handles data after your organization authorizes it to receive that data.

8. How we protect information

We follow the HIPAA Security Rule and review our safeguards through a regular risk assessment. Our safeguards include:

Encryption: TLS 1.2 or higher for all traffic; encryption at rest for databases, uploaded files and backups.
Access control: unique user accounts, role-based permissions, optional or required multi-factor authentication, and automatic sign-out after 30 minutes of inactivity.
Separation: each Client’s data is logically separated so users can reach only their own organization’s records.
Audit logging: record views, changes, exports and sign-ins are logged and retained for at least six years.
Staff controls: background checks, HIPAA training, confidentiality agreements and least-privilege access for our team.
Resilience: encrypted backups, tested restore procedures and a written incident response plan.

No system is perfectly secure. If you believe your account or data has been compromised, contact us right away at security@casemagic.net.

9. Cookies and local storage

Case Magic uses only the cookies and browser storage needed to run the service. We do not use advertising or cross-site tracking cookies.

Cookies and storage we use
Type	Purpose	How long it lasts
Session cookie	Keeps you signed in and protects against cross-site request forgery	Until you sign out or the session expires
Preference storage	Remembers display settings and which in-app tabs you had open	Until you clear it or sign out
Sign-in state	Completes Google or Microsoft sign-in securely	Minutes

We do not store PHI in cookies or in your browser’s local storage. Blocking these cookies will prevent you from signing in. Our public website may use Google Analytics; it is never loaded inside the application.

10. How long we keep information

We keep information only as long as the service, the law or our agreements require.

Retention periods
Information	Retention
Client records and files	For the life of the subscription, then returned or deleted within 60 days of the Client’s request or contract end
Backups	Deleted on a rolling 7-day cycle
Audit logs	At least six years, as HIPAA documentation rules require
Billing and invoice records	5 years, for tax and accounting obligations
Account and support records	Up to 2 years after the account closes

Clients remain responsible for keeping consumer records as long as their own legal obligations and Regional Center contracts require. We can export a Client’s records before deletion on request.

11. Your rights and choices

If a provider holds your records. If you or your family member receive services from a Case Magic Client, that provider controls your records. Send requests to see, correct or get copies of records, or to learn who received them, to the provider directly. If you contact us, we will forward your request to the provider and help it respond.

If you use Case Magic. You can update your profile in the app, and your administrator can correct or remove your account. Depending on where you live, you may have the right to:

know what personal information we collect and how we use and share it
get a copy of your personal information
correct inaccurate information
ask us to delete your information, subject to legal and contractual exceptions
opt out of any sale or sharing for advertising (we do neither)
not be treated differently for using these rights

California residents. The California Consumer Privacy Act, as amended by the CPRA, gives you the rights listed above. Information that is PHI under HIPAA or medical information under the CMIA is handled under those laws instead. To make a request, email privacy@casemagic.net. We will confirm your identity before acting and respond within 45 days. You may use an authorized agent.

Email preferences. You can turn off optional emails in your notification settings. Security alerts and maintenance notices cannot be turned off while your account is active.

12. Children

Case Magic accounts are for adult staff of Client organizations, and we do not knowingly let anyone under 18 create one. Clients may enter records about children they serve; those records get the same protections as all other client records.

13. Accessibility

This policy and the Case Magic application are being updated to meet WCAG 2.1 Level AA. To get this policy in another format, such as large print or audio, contact us using the details below.

14. Changes to this policy

We will post any update here with a new effective date. For material changes, we will notify account administrators by email or in-app announcement at least 7 days before the change takes effect.

15. Contact us

Case Magic, LLC
6605 Grand Montecito Pkwy, Suite 100
Las Vegas, NV 89149

Privacy questions and requests: privacy@casemagic.net
Security issues: security@casemagic.net