Trailwinds Dispatch
Privacy

What we collect, and what we don’t.

Trailwinds Dispatch is a dispatch tool for hospice on-call teams. It is not a medical record. This page says plainly what it holds, for how long, and who can see it.

Last updated August 4, 2026

Two different relationships

Patient information. Your hospice decides what patient information goes into Trailwinds Dispatch and who may see it. For that information we act as a business associate under HIPAA, processing it on the hospice’s instructions and under a Business Associate Agreement. If you are a patient or family member, your hospice’s Notice of Privacy Practices governs, and requests about your records should go to them — they can reach us.

Staff information. For the nurses, triage staff, and administrators who sign in, we hold account details and — while on call — location. That part is about you rather than a patient, so the rest of this page explains it directly.

What the app holds about patients

Only what dispatch needs: name, address, facility and room, an optional note for the visiting nurse, the visit type and priority, and the timestamps of the visit. There is no charting, no clinical documentation, no diagnoses, and no billing data — Trailwinds Dispatch is not an EMR and does not try to be one.

Patient information never appears in a push notification, a log line, a URL, an error message, or an analytics event. A notification says a visit is waiting and nothing more; the details load only inside an authenticated, role-checked session.

Nurse location, in plain terms

While a nurse is on duty or on call, the app reports their position roughly every 5 to 10 minutes, including in the background. Triage sees it so a visit can go to whoever is genuinely closest, and so nobody is sent across a county when a colleague is minutes away.

Location is reported only while on duty or on call. It stops when a nurse goes off duty. The app shows the current sharing state on screen at all times rather than hiding it in settings, and iOS also shows its own indicator. Position history is deleted after 60 days.

A nurse’s location is visible to their own triage and administrative staff. It is not sold, not shared with advertisers, and not used to evaluate anyone outside the dispatch decisions it exists for.

Where patient geography goes

Addresses have to become coordinates for maps, drive times, and turn-by-turn directions. All of that runs through Amazon Web Services under a Business Associate Agreement — geocoding, routing, drive-time estimates, spoken directions, and map tiles.

We deliberately do not hand patient addresses or coordinates to Google or Apple maps services, and the app does not open a third-party maps app with a patient’s address. Navigation happens inside the app so the address stays inside the agreements that cover it.

Who we rely on

We keep the list short, and every provider that can touch patient information is covered by a Business Associate Agreement:

  • Convex — the database and application backend, under BAA.
  • Amazon Web Services — geocoding, routing, map tiles, and spoken navigation, under BAA.
  • WorkOS — sign-in and identity. Holds work email and name; no patient data.
  • Resend — sends sign-in codes and account email. No patient data.
  • Apple Push Notification service, via Expo — carries only a visit identifier and its urgency. No names, no addresses.

We use no advertising networks and no third-party analytics or tracking software. The apps contain no advertising SDKs. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Sign-in and devices

Access is invitation-only: an address must already be on a hospice’s roster before it can sign in. First sign-in on a new device is confirmed with a code emailed to that address. Sessions end after 12 hours regardless of activity, and the app locks itself after 15 minutes of inactivity.

If a device is enrolled for Face ID or Touch ID, a token is stored in that device’s secure hardware and can be revoked by signing out, changing your password, or by an administrator. Biometric data itself never leaves the device and is never sent to us — iOS only tells the app whether the check passed.

Records of access

Every patient search, every time a visit’s details are opened, and every export is written to an append-only audit log: who, what, and when. Entries are never edited or deleted and are retained for six years. Your hospice can ask us for its own audit records at any time.

If Trailwinds staff need to enter a facility to provide support, that access is recorded the same way and attributed to the individual, and it is disclosable to that hospice on request.

How long things stay

  • Nurse position history — 60 days, then deleted automatically.
  • Audit records — six years, append-only.
  • Patient and visit records — for as long as the hospice’s account is active, and returned or deleted on request when it ends, as the BAA requires.
  • Waitlist enquiries from this website — name, work email, facility, and contact details, kept until we have finished talking, then deleted on request.

Your choices

Staff can correct their own name, credential, and phone in the app. Location sharing can be turned off in iOS Settings at any time — dispatch will show that sharing is off, and visits can still be assigned by hand.

For patient information, requests to see, correct, or delete records go to your hospice, which holds the record and instructs us. For staff information, or anything this page does not answer, write to us and a person will reply.

Children

Trailwinds Dispatch is a workplace tool for hospice staff. It is not directed at children and we do not knowingly collect information from anyone under 18 as a user of the software.

Changes and contact

If this policy changes in a way that matters, we will say so here and date it, and tell the hospices using the product rather than relying on you to notice.

Questions, requests, or anything that looks wrong: privacy@trailwindsdispatch.com.