1Scope and Our Role
This Privacy Policy explains how eFMLA, Inc. ("eFMLA," "we," "us," or "our") handles personal information in connection with the ADA Companion website, platform, account administration, support, demo requests,.
Important distinction: For information submitted to ADA Companion by an employer or other customer about its employees, applicants, or workforce, the customer generally determines why the information is collected and how it is used. In that context, eFMLA acts as a service provider or processor on the customer's behalf. Requests about those workforce records should normally be directed first to the employer or organization that controls the record.
For information we collect directly for our own business purposes—such as website inquiries, account administration, security logs, and communications—we may act as the business or controller, as those terms are used under applicable privacy laws.
2Information We Collect
Information you provide directly
- Contact and demo information: name, work email, telephone number, organization, job-related information, approximate number of full-time equivalents (FTEs), whether the organization is a current eFMLA customer, and the content of your inquiry.
- Account information: name, work email, organization, role, login and authentication information, and account preferences.
- Support and communications: messages, support requests, meeting notes, and other information you choose to provide.
Customer-controlled workforce data
When a customer uses ADA Companion to administer workplace accommodation matters, the platform may process employee or applicant information supplied by that customer or an authorized user. Depending on the case, this may include identifiers, employment information, accommodation requests, communications, case notes, work restrictions, provider documentation, and medical or disability-related information.
Because accommodation records may contain sensitive medical information, they are handled as confidential workforce records and are subject to customer access controls and applicable legal requirements.
Information collected automatically
- IP address, browser and device information
- Login, authentication, session, and security events
- Pages or features used, timestamps, and diagnostic information
- Audit events associated with access, changes, exports, and administrative activity
Sources of information
We may receive information directly from you; from the customer organization that provides your account or uses ADA Companion; from authorized administrators and users; from your device or browser; and from service providers that support hosting, authentication, communications, security, and related platform functions.
3How We Use Information
We use personal information only for legitimate business and service purposes, including to:
- Provide, operate, maintain, and support ADA Companion and its features
- Create and administer accounts, authenticate users, and enforce permissions
- Process accommodation case information as directed by our customers
- Provide workflow assistance
- Respond to demo requests, support requests, and other communications
- Maintain audit, security, diagnostic, and fraud-prevention records
- Improve reliability, usability, accessibility, and performance
- Comply with contracts, law, legal process, and regulatory obligations
- Protect the rights, safety, security, and integrity of users, customers, eFMLA, and the Services
We do not use customer-controlled accommodation or medical information for advertising. We do not use Customer Data to train third-party foundation models unless the customer expressly agrees and the applicable customer agreement permits that use.
4ADA and Sensitive Workforce Information
ADA accommodation matters can involve confidential medical information. ADA Companion is designed so that sensitive medical documentation can be kept separate from ordinary personnel information and access can be limited to authorized users based on role and need.
Customers remain responsible for determining what information they are legally permitted to request, collect, use, disclose, and retain in an accommodation matter, and for configuring access appropriately for their workforce and policies.
Do not submit employee medical information, accommodation documentation, Social Security numbers, or other sensitive workforce information through the public Request a Demo or general contact form. Sensitive case information should be entered only through the authenticated ADA Companion application.
HIPAA may apply in some customer environments depending on the parties and the data involved. If a Business Associate Agreement or other specialized data-protection agreement is legally required for a particular customer relationship, it must be addressed separately in the applicable customer agreement; this Privacy Policy does not itself create such an agreement.
5How We Disclose Information
We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use personal information for targeted advertising.
We may disclose information to the following categories of recipients when reasonably necessary:
- Service providers and processors: hosting, infrastructure, authentication, security, email and communications, support, data storage, backup, monitoring, and technology providers that perform services for us under contractual restrictions.
- Customer organizations: authorized administrators and users of the organization that controls a workforce record.
- Professional advisers: legal, accounting, insurance, security, and other professional advisers where appropriate.
- Legal and safety recipients: courts, regulators, government authorities, law enforcement, or others when disclosure is required by law or reasonably necessary to protect rights, safety, or security.
- Business transactions: a successor or prospective successor in connection with a merger, financing, acquisition, reorganization, or sale of all or part of our business, subject to appropriate confidentiality protections.
We require service providers that process personal information on our behalf to use it only for authorized purposes and to protect it appropriately.
6Cookies, Sessions, and Tracking
ADA Companion may use cookies or similar technologies that are necessary for login, session management, security, preferences, and core website functionality. The production application may also generate server logs and security telemetry needed to operate and protect the service.
We do not currently use personal information for targeted advertising or sell or share personal information for cross-context behavioral advertising. If we later introduce non-essential analytics, advertising, or other tracking technologies that materially change these practices, we will update this notice and provide any choices required by applicable law.
Where applicable, we will honor legally recognized browser-based opt-out signals for practices to which those signals apply. Because we do not currently sell personal information or use it for targeted advertising, such signals do not change those practices today.
7Data Security and Incident Response
We maintain administrative, technical, and physical safeguards designed to protect personal information in light of its sensitivity and the nature of the Services. Production safeguards include encrypted network connections, encryption of stored sensitive data, authenticated access, role-based permissions, session controls, audit logging, backups, and restricted administrative access.
No security measure can guarantee absolute security. We maintain processes for investigating suspected security incidents and will provide legally required notices to customers, affected individuals, regulators, or others when applicable.
8Data Retention and Deletion
We retain information only for as long as reasonably necessary for the purposes described in this Policy, to provide the Services, meet contractual commitments, maintain security and audit records, resolve disputes, and comply with legal, accounting, or regulatory requirements.
Customer-controlled workforce data is retained, returned, deleted, or de-identified in accordance with the applicable customer agreement, customer instructions, legal requirements, and our backup and disaster-recovery processes. Backup copies may remain for a limited period until overwritten through normal retention cycles.
When information is no longer required, we take reasonable steps to delete, destroy, or de-identify it.
9Privacy Rights and Requests
Depending on your state or other applicable law, you may have rights to request access to, correction of, deletion of, or a portable copy of certain personal information, and in some cases to opt out of certain processing or limit the use of sensitive personal information.
To submit a privacy request relating to information eFMLA controls, email support@adacompanion.com. We may need to verify your identity before completing a request. We will not discriminate against you for exercising an applicable privacy right.
If we deny a request and applicable law gives you a right to appeal, you may appeal by replying to our decision or emailing the same address with the subject line Privacy Appeal. We will review the appeal and respond as required by applicable law.
If your request concerns workforce information that we process on behalf of your employer or another customer, we may direct the request to that customer because the customer controls the record and determines how applicable rights are handled.
10Additional U.S. State Privacy Information
Some U.S. state privacy laws require additional disclosures for covered businesses. Where those laws apply to eFMLA, this Policy is intended to describe the categories of personal information we process, the purposes of processing, the categories of recipients, and the methods available to exercise applicable rights.
California: We do not sell personal information or share it for cross-context behavioral advertising. California residents may have rights to know, access, correct, delete, and, where applicable, limit the use or disclosure of sensitive personal information. Some workforce information may be subject to separate rules and customer responsibilities.
Virginia and other states: Residents of states with comprehensive privacy laws may have rights to access, correct, delete, obtain a portable copy of certain information, and opt out of targeted advertising, sale, or certain profiling where those practices occur and the law applies.
11Children's Privacy
The public ADA Companion website and commercial Services are not directed to children. We do not knowingly collect personal information directly from children under 13 through the public website. If we learn that we collected such information directly from a child in a manner that violates applicable law, we will take appropriate steps to delete it.
This section does not prohibit an authorized customer from processing lawful workforce records relating to a minor employee or applicant when permitted by applicable law and the customer's policies.
12Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we make changes, we will update the date shown on this page. If a change materially affects how we use personal information, we will provide additional notice when required by law or appropriate under the circumstances.
We will not retroactively use previously collected personal information for materially different purposes merely by changing this Policy where applicable law requires additional notice or consent.
13Contact Us
Questions or privacy requests may be sent to: