Privacy Policy
Last updated November 12, 2026
This policy explains how Evergrove Healthcare ("we") handles information through Evergrove iMessage (the "App"), a private HighLevel application that sends and receives iMessage and SMS for Evergrove Healthcare programs through Blooio. The App is used only by Evergrove Healthcare staff and the sub-accounts we operate. It is not offered to the public.
Information the App processes
To deliver messages, the App passes the following between HighLevel and Blooio:
- Contact phone numbers and, for inbound messages, the sender's name if Blooio has one.
- Message text and attachment links.
- Delivery status (sent, delivered, read, failed) and error codes.
- Which pool line a contact is on, written to the contact's iMessage Line field in HighLevel.
Because Evergrove Healthcare provides behavioral health services, messages may contain protected health information (PHI). We treat everything the App handles as PHI.
What the App stores
The App keeps as little as it can. Its own database holds only:
- HighLevel access tokens for the installed sub-account, so it can write messages into Conversations.
- Message ID pairs (Blooio ID ↔ HighLevel ID), so delivery status reaches the right message. Deleted after 30 days.
- Webhook event IDs to prevent duplicates. Deleted after 30 days.
The App does not store message text, attachments, phone numbers or contact names. These pass through in memory and are kept only in HighLevel and Blooio, the systems of record. Application logs contain IDs and error codes only.
Who processes the information
| Provider | Role |
|---|---|
| HighLevel (LeadConnector) | CRM and system of record for contacts and conversations. |
| Blooio | Sends and receives iMessage and SMS on Evergrove Healthcare's lines. |
| Google Cloud | Hosts the App's server and database in the United States. |
We use these providers only to run the App, under agreements that include business associate terms where PHI is involved. We do not sell information, share it for advertising, or use it to train AI models. The App sets no cookies and has no analytics or tracking.
How we protect it
- All traffic is encrypted in transit (HTTPS/TLS). Data at rest is encrypted by Google Cloud.
- Every request from HighLevel and Blooio is verified by cryptographic signature; unsigned or altered requests are rejected.
- The server accepts only web traffic. Administrative access goes through Google's identity-aware proxy and is limited to authorized Evergrove Healthcare staff.
- The database is not reachable from the internet. Encrypted backups are kept for 35 days, and disk snapshots for 7 days.
Retention and deletion
Message ID pairs and event IDs are deleted automatically after 30 days, and backups after 35 days. If the App is uninstalled, we delete its stored tokens within 30 days. Messages and contacts in HighLevel and Blooio follow those systems' retention settings and Evergrove Healthcare's record-retention policies.
Your rights
People we message can opt out at any time by replying STOP or asking us to stop. Patients and clients can request access to or correction of their information, or an accounting of disclosures, under HIPAA and applicable state law, through Evergrove Healthcare's Notice of Privacy Practices process.
Changes
We'll update the date at the top when this policy changes.
Contact
Privacy questions: your Evergrove Healthcare administrator.