Privacy Policy

Last updated: November 1, 2026

This Privacy Policy explains how Compass CHW Corp, a Delaware corporation (“Compass,” “we,” or “us”) collects, uses, discloses, and protects personal information through the Compass website at joincompasschw.com, the Compass mobile and web applications, and related services (together, the “Services”). It also explains the choices and rights you have.

Compass arranges community health worker services through independent CHWs who contract with Compass, and provides a technology platform that connects Community Health Workers (“CHWs”) with Medi-Cal members and with community organizations. Our Services are intended for people in California.

Health information and HIPAA. Some of the information we handle is protected health information under the Health Insurance Portability and Accountability Act (“HIPAA”) or medical information under the California Confidentiality of Medical Information Act (“CMIA”). When community health worker services are provided to you through Compass, Compass is a health care provider covered by HIPAA because it bills Medi-Cal for those services, and Compass’s Notice of Privacy Practices, at joincompasschw.com/legal/hipaa, also applies. When Compass handles protected health information for another health care organization, such as a pharmacy or clinic, it does so as that organization’s business associate, and that organization’s Notice of Privacy Practices also applies. If this Policy and a HIPAA notice that applies to your health information conflict, the HIPAA notice controls for that information.

1. Who this Policy covers

This Policy applies to:

Members. People who use Compass to find, receive, or schedule services from a CHW, including Medi-Cal members.
CHWs. Community Health Workers who use Compass to offer services and get paid.
Organization users. Staff of food banks and pantries, pharmacies, schools, resource organizations, faith-based organizations, and other organizations that use Compass.
People on an organization’s roster. People whose information an organization or CHW enters into Compass, for example at an intake desk, an event, an RSVP form, or a QR code sign-up. Compass creates a member account for each person 18 or older entered this way, tells you how to sign in, and closes the account if you ask us. If the information matches an existing Compass account, Compass combines them into one account.
Visitors. Anyone who visits our website or contacts us.

This Policy does not cover information that an organization collects or uses outside of Compass. Each organization is responsible for its own privacy practices.

2. Information we collect

2.1 Information about members and people on a roster

Identity and contact information, such as name, date of birth, sex, phone number, email address, postal address, ZIP code, and preferred language.
Insurance information, such as medical plan and Medi-Cal Client Index Number (“CIN”).
Health and service information, such as the services you ask for, referral categories, notes a CHW records about a session, and billing records for services provided.
Session recordings, transcripts, and captions, only when you agree. With your agreement, Compass may also show live captions to your CHW during a visit, and create a draft summary and suggested follow-up items for your CHW to review.
Communications, such as messages sent through Compass, and information about masked calls and text messages, such as time and duration, and voicemails you leave for your CHW. Call audio is collected only when a call is recorded with consent.
Documents you upload, such as forms or letters you share with your CHW.
Consents, such as whether you agreed to receive text messages, to have a session recorded, to use AI tools, and to let Compass bill your health plan.
Event and attendance information, such as events you sign up for or attend.
Account information, such as login details, consents you give, and your communication preferences.

2.2 Information about CHWs

Identity and contact information.
Certification, training, and other information needed to confirm that you are eligible to provide services.
Background check results, obtained only with your written authorization.
Payment and tax information needed to pay you. You give bank account and tax details directly to our payment processor, Stripe. Compass receives payout status and the tax information needed for reporting, not your full bank account number.
Session documentation, billing records, and communications with members and organizations.
Account information and activity on the Services.

2.3 Information about organization users

Name, title, work email, and work phone.
Information about your organization, such as its type, NPI, EIN, school district, and verification documents.
Account information and a record of activity under your account.

2.4 Information collected automatically

When you use the Services, we and our service providers automatically collect device and usage information, such as IP address, device and browser type, app version, pages and screens viewed, the date and time of your visit, approximate location derived from your IP address, and error and crash reports. We collect this through cookies, software development kits, and similar technologies, as described in Section 7.

2.5 Sensitive personal information

Some information we collect is “sensitive personal information” under California law, including health information, the contents of messages sent through Compass, account login credentials, financial account information of CHWs, and taxpayer identification numbers of CHWs. We use and disclose sensitive personal information only as needed to provide the Services, to keep them secure, to comply with law, and for other purposes California law allows without a right to limit. We do not use it to infer characteristics about you.

3. Where we get information

From you, when you create an account, fill out forms, use the Services, or contact us.
From CHWs, when they document sessions, make referrals, or send messages.
From organizations, when their staff enter or upload roster information, make referrals, or record event check-ins.
From health plans and our billing partner, Pear Suite, in connection with eligibility, billing, and payment for services.
From our service providers, such as hosting, communications, and analytics vendors.
From background-check providers, for CHWs, with their written authorization.
From Google or Apple, if you choose to sign in with them or connect your calendar.
Automatically, from your device, as described in Section 2.4.

4. How we use information

We use personal information to:

Provide, operate, and maintain the Services, including accounts, referrals, messaging, masked calls, events, and rosters.
Connect members with CHWs and organizations, and help CHWs provide and document services.
Prepare claims for Medi-Cal and other covered services, which our billing partner submits, and pay CHWs.
Verify the identity, eligibility, and credentials of CHWs and organizations.
Send service messages, such as appointment reminders, confirmations, security alerts, and changes to our terms.
Provide customer support and respond to requests.
Protect the safety and security of the Services and the people who use them, and detect and prevent fraud and misuse.
Produce aggregate counts and de-identified statistics, for example to report program results to organizations.
Improve and develop the Services, using de-identified or aggregate information wherever practicable.
Comply with law, respond to legal process, and enforce our agreements.

5. How we disclose information

We disclose personal information only as described below:

To the CHWs and organizations you work with through Compass. Organizations see limited referral information, such as first name and last initial, service category, preferred language, and ZIP code, and any other details you choose to share. Organizations do not receive your phone number or email address through Compass unless you choose to share them. An organization can see roster information that it entered itself.
To health plans, the Medi-Cal program, and our billing partner, Pear Suite, to bill for and get paid for services.
To service providers that perform work for us under written contracts that limit how they may use the information. They include cloud hosting and email (Amazon Web Services), text messages and calls (Vonage), transcription and captions (AssemblyAI), AI summaries (Anthropic), payments to CHWs (Stripe), error monitoring (with member information removed before reporting), maps, background checks, and sign-in services (Google and Apple). Our service providers may use your information only to provide services to us.
For legal and safety reasons, when we believe disclosure is required by law, subpoena, or court order, except as described below for immigration enforcement, or is needed to protect the rights, property, or safety of Compass, our users, or others, as the law allows.
Immigration enforcement. We do not share personal information with immigration authorities, including U.S. Immigration and Customs Enforcement (ICE), unless a federal or California court orders us to or we receive a valid warrant signed by a judge, as California Civil Code § 56.10 requires. A request, subpoena, or administrative warrant from an immigration agency is not enough. If we receive a demand, we will review it with a lawyer, challenge it when we can, share only the minimum the order requires, and tell you unless the law forbids us. We do not ask for or record immigration status or place of birth. Compass can control only the information Compass holds; information that Medi-Cal, your health plan, or other government agencies hold is covered by their own policies.
In a business transfer, such as a merger, acquisition, financing, or sale of assets, subject to this Policy and to applicable law.
With your direction or consent.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We do not disclose personal information to third parties for their own direct-marketing purposes.

In the past 12 months, we have disclosed each category of personal information described in Section 2 for a business purpose to the categories of recipients described in this Section, as needed for the purposes in Section 4.

We share mobile numbers, text message content, and opt-in consent information only with the service providers that deliver our messages, such as our messaging provider and mobile carriers. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

6. Text messages and calls

Calls and text messages between members and CHWs go through a shared Compass phone number. Members never see a CHW’s personal phone number, and organizations do not receive your phone number through Compass. Your CHW can see the phone number on your profile to help with your care. If you agree to receive text messages from Compass CHW, we send sign-in codes, visit confirmations and reminders, and alerts that you have a new message in the Compass app. Messages your CHW sends you through Compass are delivered to your phone as text messages and contain the words your CHW wrote. Texts that Compass sends on its own, such as sign-in codes and reminders, are written to leave out health details. To create a Compass account you agree to receive calls, text messages, and emails from Compass and your Community Health Worker, because that is how your care is coordinated and your account is kept secure. Message frequency varies. Message and data rates may apply. Reply STOP at any time to stop receiving text messages, and your account stays open. Reply HELP for help.

7. Cookies and similar technologies

We use cookies and similar technologies that are needed to run the Services, keep you signed in, remember your preferences, keep the Services secure, and understand how the Services are used so we can improve them. We do not use third-party advertising cookies or allow third parties to collect information on our Services for cross-context behavioral advertising.

You can control cookies through your browser settings. If you block certain cookies, parts of the Services may not work. We do not sell or share personal information, so there is nothing to opt out of. Because there is no single standard for “Do Not Track” signals, we do not respond to them differently.

8. AI tools and automated processing

With the member’s agreement, Compass may use AI tools to transcribe a recorded session, show live captions during a visit, draft a summary, and suggest follow-up items for the CHW. A CHW reviews each draft before it becomes part of a record. AI tools are not used to make decisions about eligibility, services, or payment that produce legal or similarly significant effects without human review. Our AI service providers process this information only to provide the feature.

9. How long we keep information

We keep personal information only as long as needed for the purposes in this Policy, using these criteria:

Account information is kept while the account is active, and then for a reasonable period to resolve disputes, prevent fraud, and meet legal obligations.
Health, session, and billing records that support a Medi-Cal claim are kept for 10 years, or longer if the law requires.
Session recordings and transcripts are kept for 10 years, then permanently deleted, unless the law requires longer or the member asks us to keep them.
Roster information entered by an organization is kept while the organization uses Compass and is returned or deleted under our agreement with that organization, except where the law requires us to keep it.
CHW payment and tax records are kept for the periods tax and employment laws require.
Device and usage information is kept for as long as needed to secure and improve the Services, and then deleted or de-identified.

When we no longer need personal information, we delete it or de-identify it. Information kept to meet a legal requirement is isolated from routine use.

When you ask us to delete information, we remove it from the Services and keep a protected archive only until the retention period ends, then permanently delete it, except where the law requires us to keep it longer, such as records that support a Medi-Cal claim.

10. How we protect information

Compass applies one privacy and security program to the personal information it handles, based on the standards of the HIPAA Privacy and Security Rules. Our safeguards include encryption of information in transit, encryption of Medi-Cal CINs at rest, access limited by role, audit logging, and keeping health information out of automated text and notification content. No system is completely secure, and we cannot guarantee that information will never be accessed, used, or disclosed without authorization. If a breach affects your information, we will notify you or the organization responsible for your information as the law requires.

11. Children and minors

The Services are not directed to children under 13. We do not knowingly collect personal information online directly from a child under 13 without verifiable parental consent. If we learn that we have done so, we will delete it. If you believe a child under 13 has given us personal information, contact us at privacy@joincompasschw.com.

Compass member accounts and CHW services are for people 18 and older. A partner organization, such as a food bank, may list a person under 18 on its roster, usually as part of a parent’s or guardian’s household, so it can serve and count them. Compass does not create an account for a person under 18, does not text them, and does not refer them to a CHW. Their roster information is used only to provide the organization’s services and its aggregate counts, and is returned or deleted under our agreement with the organization. If we learn that a person under 18 has a member account, we will close it. We do not sell or share the personal information of anyone under 16.

12. Your California privacy rights

If you are a California resident, you have the following rights. We honor them whether or not the California Consumer Privacy Act (“CCPA”) applies to us, subject to exceptions in the law:

Right to know and access the personal information we have collected about you, including the categories of information, sources, purposes, and recipients, and a copy of specific pieces of information in a portable format.
Right to delete personal information we collected from you, except records the law requires us to keep, such as records that support a Medi-Cal claim.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but you may still send a request.
Right to limit use of sensitive personal information. We use sensitive personal information only for purposes that do not give rise to this right, as described in Section 2.5.
Right to non-discrimination. We will not deny you services, charge you different prices, or provide a different quality of service because you exercised your rights.

Health information exemption. Protected health information governed by HIPAA and medical information governed by CMIA are generally exempt from the CCPA. Requests about that information are handled under HIPAA and CMIA. If Compass holds your health information for an organization, we may refer your request to that organization, which is responsible for responding under HIPAA. For health information Compass holds as your community health worker services provider, our Notice of Privacy Practices explains your rights to see, correct, and get a list of disclosures of that information.

How to make a request. Email privacy@joincompasschw.com with the subject line “Privacy Request,” or write to Compass CHW Corp, Attn: Privacy Officer, 3701 Santa Rosalia Dr., Suite 1200, Los Angeles, CA 90008. Tell us which right you want to use and how to reach you.

Verification. To protect your information, we will ask you to verify your identity, usually by confirming information we already have about you. We will use the information you give us for verification only for that purpose.

Authorized agents. You may use an authorized agent to make a request for you. We may ask the agent for proof of your signed permission and may ask you to verify your identity directly with us.

Timing. We will confirm receipt of a request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you, and we may take up to 45 more days as the law allows.

Shine the Light. California Civil Code § 1798.83 lets California residents ask about disclosures of personal information to third parties for their direct-marketing purposes. We do not make those disclosures.

13. Medical information

We protect medical information as required by the CMIA and, where it applies, HIPAA. We do not use or disclose medical information except to provide the Services, as permitted or required by law, or with your written authorization. You may revoke an authorization at any time by contacting us, except to the extent we have already acted on it.

14. De-identified information

We may create de-identified information from personal information, including from patient information, using the de-identification methods in 45 CFR § 164.514(b) (the HIPAA safe harbor method or the expert determination method). We do not sell de-identified patient information. We may disclose de-identified patient information in aggregate form, for example in program reports to organizations, and only after it has been de-identified using one of those methods. We will not attempt to re-identify de-identified information, except as the law allows to test our de-identification methods.

15. Other important information

Storage. We store and process personal information in the United States.
Links to other sites. The Services may link to websites and services we do not control. This Policy does not apply to them, and we encourage you to read their privacy policies.
Accessibility and language. This Policy is available in other formats and languages on request. Contact privacy@joincompasschw.com.

16. Changes to this Policy

We review this Policy at least once a year and may update it. The “Last updated” date shows when it was last changed. If we make a material change, we will notify you through the Services or by email before the change takes effect, and we will ask for your consent where the law requires it.

17. Contact us

Compass CHW Corp, Attn: Privacy Officer, Jemal Hussein. Mail: 3701 Santa Rosalia Dr., Suite 1200, Los Angeles, CA 90008. Email: privacy@joincompasschw.com. Legal notices: legal@joincompasschw.com.