EndPend Privacy Notice
Version 2026-10-08
This notice explains how XenoDroid, Inc. (“we”, “us”), which operates EndPend, handles information in the EndPend platform. Our website, endpend.com, has its own privacy page.
Two kinds of information
Case information. Facilities and the people they invite put information into EndPend about residents, applicants, and their families: identity and contact details, finances, documents, and notes about a Medicaid application or pending case. That information belongs to the facility. Where the facility is a HIPAA covered entity or business associate, we act as its Business Associate: we use and disclose this information only to provide EndPend to the facility, as the facility’s signed agreement and Business Associate Agreement allow, or as the law requires.
The facility, not EndPend, gives residents its HIPAA Notice of Privacy Practices and handles requests to see, copy, or correct their records. If you have a question about a resident’s information, ask the facility. We help the facility answer.
Account and usage information. We collect information about you as a user: your name, email address, organization, role, sign-in and multi-factor details, the times and devices you sign in from, and a record of the actions you take in EndPend. We use it to run and secure the Service, to keep the audit trail facilities rely on, to provide support, and to improve the product.
What we do not do
- We do not sell personal information or share it for advertising.
- We do not use case information to train artificial-intelligence models.
- We do not send case information to any artificial-intelligence service except the one named in the facility’s signed agreement, under that agreement’s protections.
Who else handles information
We use a small number of service providers to run EndPend, chiefly Amazon Web Services for hosting, storage, and approved AI processing in the United States. Each is bound by contract to protect the information and use it only for us. Where they handle health information, they are bound by a business associate agreement. A facility can ask us for the current list.
We may also disclose information when the law requires it, to protect someone’s safety, or to respond to a security incident, and we will tell the affected facility when we are allowed to.
Security
We protect information with encryption in transit and at rest, individual accounts with multi-factor sign-in, access limited by role and facility, audit logging, monitored infrastructure, and backups. No system is perfectly secure. If a security incident affects information we hold for a facility, we tell the facility as its agreement and the law require, and the facility notifies affected people where required.
How long we keep information
We keep case information for as long as the facility’s agreement says and then return or delete it as that agreement requires. We keep account and audit records for as long as needed for security, the facility’s audit trail, and legal obligations.
Your choices
To update your account details, ask your organization’s administrator. For questions about your account information, email support@xenodroid.ai. For a resident’s health information, contact the facility.
Changes
When we change this notice in a way that matters, we publish a new version with a new date, and EndPend asks you to review it when you next sign in.
Contact
XenoDroid, Inc. · support@xenodroid.ai