1. Who We Are
dWell-KC ("we," "us," or "our") is a housing and case management platform operated in
Kansas City, Missouri. We provide software services to housing agencies, property
management companies, and the individuals they serve ("clients" or "tenants").
Our contact email is privacy@dwellkc.com.
2. What Information We Collect
We collect information in two ways:
- Information you provide directly — name, email address, phone number,
date of birth, Social Security Number (encrypted), government-issued ID documents,
housing history, income data, health information, and case notes.
- Information collected automatically — IP addresses, browser type,
login timestamps, pages visited within the platform, GPS coordinates during field-mode
check-ins, and usage patterns. On our public pages only (never once you sign in), we also
use analytics tools — see Cookies below.
We maintain an internal access log recording each sign-in and each page a signed-in user
visits (timestamp, IP address, and organization context), used to investigate unauthorized
access and to support HIPAA audit-control obligations. This log is visible only to
platform super-administrators and is retained indefinitely as part of our security
recordkeeping.
3. How We Use Your Information
- To provide, operate, and improve the dWell-KC platform
- To facilitate case management, housing placement, and tenancy tracking
- To verify client identity across participating organizations
- To send notifications, messages, and service updates
- To comply with legal obligations
4. Protected Health Information (PHI)
Certain data collected through dWell-KC — including diagnosis, disability status,
and medical notes — may constitute Protected Health Information under HIPAA.
- Encryption — Social Security Numbers, diagnoses and medical notes
are encrypted individually before they are stored, including SSNs entered on intake forms. All
other data is encrypted at rest by our hosting provider, and all data is encrypted in transit.
- Who can see it — a client's SSN, diagnosis, medical notes,
disabilities and domestic violence details are visible only to the administrators of the client's
primary agency and the client's case managers. Other screens show at most the last four digits of
the SSN.
- Protected agencies — when a client is served by a domestic violence
provider or a health care organization, other organizations see that agency only as
"Protected Agency," because receiving those services is itself private.
- Signing out — staff are signed out automatically after a period of
inactivity set by their organization.
We do not sell or share PHI with third parties except as required to operate the service or
comply with law. Our Security page describes these
protections in more detail.
5. HMIS Opt-In & Release of Information (ROI)
dWell-KC records three kinds of client authorization:
- HMIS Opt-In (Privacy Notice consent) — the client's agreement to have
their information entered into the regional Homeless Management Information System.
- Release of Information (ROI) — the client's authorization for their
data to be disclosed to specific organizations or organization types.
- HIPAA Release — the client's authorization for disclosure of
health information.
The legal language for the HMIS Opt-In and the ROI is written and administered by the
region's HMIS lead agency, not by dWell-KC. dWell-KC records the version of that language
presented, the method of consent (electronic, in-person, verbal, or mailed), and the date
consent was given, expires or was revoked. Clients can review and sign their releases from
their own account.
How these records are used today:
- An agency can share a client's full record with another organization (an
"access grant") once the sharing staff member certifies the HIPAA requirements; each agency can
also require a verified identity and an active ROI on file first (certified by staff when required).
- Agencies can send a referral before an ROI is signed or an identity is verified, so
people can be connected to help quickly; each agency can choose to require either one first. The
receiving agency then sees only basic identity and contact details, never case notes, HUD data or
health information, until the client signs a HIPAA release or an access grant is made.
- Without an access grant, other agencies can see only a client's basic identity:
name, aliases, contact details, current housing and agency contact.
- Revoking an ROI stops new access grants and referrals from agencies that require one. Access already granted
continues until the sharing agency revokes it, and data already lawfully shared is not withdrawn.
Data is not sent to the HMIS automatically. Agency staff export HUD-format reports from
dWell-KC and submit them to the region's HMIS themselves. Clients of domestic violence
providers are left out of other agencies' HUD reports, as required by the Violence Against
Women Act.
6. Sharing Your Information
We do not sell your personal data. As described above, we may share your
information with:
- Other organizations you authorize — agencies or property managers granted
explicit access through our access-grant system
- Service providers — companies that run parts of the platform for us:
hosting and file storage, email delivery (Resend), payments (Stripe), error monitoring (Sentry),
address-to-map lookups (OpenStreetMap Nominatim), and, on public pages only, website analytics
(Google Analytics and Microsoft Clarity)
- Legal authorities — when required by law, court order, or to protect
the safety of any person
7. Data Retention
We retain your data for as long as your account is active or as required by law.
Organizations may request deletion of client data after case closure. Deleted records
may remain in encrypted backups for up to 90 days.
8. Your Rights
Depending on your location, you may have the right to:
- Access a copy of your personal data
- Request correction of inaccurate data
- Request deletion of your data
- Object to or restrict certain processing
To exercise these rights, email privacy@dwellkc.com.
We will respond within 30 days.
9. Cookies
We use session cookies required for authentication and platform functionality.
On our public pages — such as the home, about and security pages — we use Google Analytics
and Microsoft Clarity to understand how visitors use the site. Clarity may record how you
interact with those pages. Neither tool loads once you sign in, or on any link that can show
client information, such as forms, check-ins and shared links. We do not use advertising
cookies.
10. Changes to This Policy
We may update this Privacy Policy periodically. When we do, we will update the
"Last updated" date above and notify active organizations by email. Continued use
of the platform constitutes acceptance of the revised policy.