Privacy

Effective 9 October 2026.

Who this is

This site is operated under the name Soft Home Global, from the address at the bottom of this page. The terms page says more about who that name legally belongs to.

What this website collects, and why

Forms. Booking a call, requesting the free AR audit, the contact form, a partner reservation, a job application, and the calculator and self-assessment tools’ “email me this result” box all send us what you typed into them — typically your name, company, email, and, if you give one, a phone number and a free-text message. We use it to reply to you, to staff the work you asked about, and for nothing else: it is not sold, rented, or shared with a third party, and it is not fed into an advertising platform. Every free-text field is screened on arrival and the submission is refused, with a message saying why, if it looks like it contains a patient name, date of birth, medical record number, Social Security number or similar — see “What this website is not for” below.

A phone number is not, by itself, permission to be called by an automated voice. The booking, free AR audit and contact forms carry a separate checkbox next to the phone field, unticked by default and never required, that says exactly what you are agreeing to. We record that you agreed only if you ticked it, together with the exact wording that was on the screen when you did, the time, and the IP address you ticked it from — kept for this one purpose, because it is the record that lets you (or anyone) check later exactly what you were asked. Leaving the box unticked still submits the form; your number simply is not called by anything other than a person. You can withdraw this permission at any time by saying so on a call or by writing to us, and we will not call that number again for any reason.

The free AR audit’s exports. The two files you attach (an aged AR summary and a denial report) are read on our server before they are stored: a file with a patient name, date of birth, medical record number, member ID, account number or claim number in a column heading, or that we detect inside the file, is refused — nothing is stored for it — and so are PDFs and pictures, because nobody here can check what is inside a scan. What we do keep, for a stored file, is dollars and counts by payer, age bucket or denial reason: never claim-level detail. Whatever you send is deleted after 30 days, whether or not the audit has been sent back to you yet.

Phone calls. If you call us, or we call you, we keep the number, the time and length of the call and what was agreed. Where an automated assistant takes part, the call is transcribed and the transcript is kept with the call record so a person can follow it up; a recording may also be kept where one is made. The assistant says so at the start of a call you place to us, and again if you ask whether you are speaking to a machine.

Live chat. If you use the chat widget, we keep what you type, the name and email you give (if any), and the page you were on, so the conversation can be answered and so a missed chat can be followed up. The same patient-data screen applies.

Pageviews and the click heat-map. This site runs no advertising trackers and loads no third-party analytics beacon. It keeps its own measurements, on its own server: which page was opened, how far down it was scrolled, how many seconds it was actually in front of you, and the position and a short label of anything you clicked (for example, button "Book twenty minutes instead"). For a box you can type or paste into — a text field, a text area, a dropdown, or an editable area — that label is always the field’s name (its type and its caption), never what you typed or pasted into it: this measurement reads the name of the field you clicked, and nothing that was inside it. On the booking, audit and contact forms it also notes how far you got — the form came into view, you started it, you sent it, and whether it went through — as those words alone, never what you entered. And it keeps the country your browser’s clock is set to, as one word (for example “United States”), worked out from the time-zone setting your browser reports; the time-zone name itself is not kept, and nothing finer than a country ever is. It is not a recording — no screen is captured and the path your mouse takes between clicks is not stored. None of it identifies you: there is no cookie behind it, no IP address is stored against it, and the visitor identifier is a keyed hash of your IP address and browser that is regenerated every midnight, so the same person on two days is two unconnected rows.

If we email you. An email we send as part of an outbound campaign — never a reply to something you sent us — carries a tracking pixel and rewrites its links through a redirect, both on this domain, so we can tell whether the email was likely opened and which link, if any, was followed. Neither tells us anything you typed; they record that the message was fetched (which can also happen automatically, for instance when some mail providers pre-scan a message, and we flag those cases where we can tell) and which of our own links was clicked. You can stop receiving these by replying “stop” to any of them, or by writing to us — see “Your choices” below.

Free tools. The staffing calculator, the denial code lookup, the AR aging analyzer and the self-assessment record only the anonymous numbers you enter (for example, a role and a seat count) so we know which tools are actually used — never your name or email, unless you use the tool’s own “email me this result” box, which sends your email, company (if given) and the result shown, the same way any other form on this site does. The AR aging analyzer is the one exception worth naming on its own: the spreadsheet you drop into it is read inside your own browser tab and never leaves it — nothing is uploaded, because that tool exists specifically for a file with patient account numbers in it that should never be sent anywhere.

Advertising and analytics tags

This site can load Google Ads, Google Analytics and the Meta Pixel. Each one loads only once we have switched it on for this deployment; when it is off, none of them loads, sets a cookie, or is told anything about your visit. When one is switched on, it works the way that company’s own privacy policy describes, sees the pages you visit on this site the way any site’s analytics tag does, and — only when a form is actually submitted successfully, never on a click or an abandoned form — is told which kind of conversion happened (a booking, an enquiry, an audit request, a job application) and, where we have one, a dollar value. It is never told your name, email, phone number or what you wrote.

Separately, if you arrive from a paid ad or a tagged link, the click identifier and campaign name are kept in your own browser’s storage for up to 90 days so that, if you later submit a form, we can tell which campaign produced it. Unlike the paragraph this replaces used to claim, this IS sent — with the form, and only with the form — because attributing a submission to a campaign is the only reason it is kept at all. Clearing your browser’s site data for this domain removes it.

Cookies

This site sets no tracking or advertising cookies of its own. It sets one cookie if you sign in: a signed session cookie for the client portal, and another for staff using the operations console. Both exist only to keep you signed in, are marked HttpOnly and SameSite=Strict so no other site can read them, and expire on their own. A visitor who never signs in receives no cookie from us at all. A tag switched on under “Advertising and analytics tags” above may set its own cookies while it is on; see that company’s own policy for what those do. The typeface is served from this website itself, so reading a page makes no request to Google or any other font provider.

Who processes this information

Work performed for a client happens inside that client’s own systems (see “Client data” below) and never touches the vendors on this list. For the website itself:

• Railway hosts this website and its database.
• Cloudflare R2 stores the files this site keeps outside its database — the free AR audit’s exports and files shared inside the operations console — when that storage is turned on; otherwise the same files stay inside the database itself. Cloudflare never receives a decryption key that lets it read the files on its own, and the bucket has no public access.
• Resend and Brevo can be used to send the alert that tells us a lead came in (a booking, an enquiry, a job application), by email, from this server directly. Telegram can carry the same alert as a message to a phone. All three are off unless we have switched one on, and none of the three ever receives anything you typed freehand — the alert is built from the who/what/when/where fields only, never your message, your note or your cover letter.
• Telnyx carries a phone call placed or received by this company. An automated voice takes part in a call when you ring our published number, and in a call we place only to a number we have recorded prior express written consent for, as described above. During such a call, Deepgram converts speech to text and text to speech under our own account with them, and the words of the conversation are sent to a third-party language-model provider, through its API, to generate the assistant’s side of it (Telnyx’s own assistant takes over only if that service is unavailable).

None of the vendors above has a Business Associate Agreement with us, and none of them is meant to ever receive protected health information — see the next section and 16_COMPLIANCE.md, the internal document that governs this.

What this website is not for

Do not send protected health information through any form, upload, or chat on this site. It is not an appropriate channel for it; a submission that looks like it contains a patient identifier is refused before it is stored, and if one nonetheless reaches us we delete it on discovery and tell you. Patient information is only ever handled inside a client’s own system, under a signed Business Associate Agreement, on the terms set out on the security page.

Client data

Work performed for a client happens inside that client’s own systems through a named login they issue. We do not export, copy, warehouse or retain client data. When an engagement ends we confirm in writing that we hold nothing.

How long we keep things

A booking, an enquiry, or a job application is kept for as long as we might reasonably follow up on it, and deleted on request (see “Your requests” below). The free AR audit’s uploaded files are the one thing on this site deleted automatically, without being asked: after 30 days, whether or not the audit has been completed. TCPA consent records are kept for as long as the permission stands (up to a year, renewed if you book or ask again) or until you withdraw it, whichever comes first, and a withdrawal is kept indefinitely because it is the record that stops a future call. Pageview and click measurement rows are not tied to your identity — see above — and are kept for reporting; we have not set an automatic deletion date for them because there is no way to look one up by who you are in the first place.

Your choices

• Calls: leave the consent checkbox unticked, or tell us at any time — on a call or by email — to stop, and we will not call that number again, by any means, for any reason.
• Email: reply “stop”, use the opt-out link, or write to us, and an outbound address is suppressed permanently.
• Your data: write to ops@softhomeglobal.com to ask what we hold about you, to correct it, or to have it deleted, and it will be actioned.
• Cookies and local storage: nothing above requires a cookie to work for a visitor who never signs in, and clearing your browser’s site data for this domain removes the campaign-attribution value described above.

Changes to this notice

We correct this page whenever what the site actually does changes, rather than leaving an old description standing. The effective date at the top is the last time that happened.

Your requests

Write to ops@softhomeglobal.com to ask what we hold about you or to have it deleted, and it will be actioned.

Soft Home Global, Kl 234, Ground Floor, Near Gulshan Abad Gate, Main Adyala Road, Rawalpindi 46000, Pakistan