Abrite FMS

DRAFT — not yet reviewed by legal counsel. Do not rely on this as a final or compliance-approved policy.

Privacy Policy

Last updated: [DATE]

1. Who we are

Abrite FMS is operated by Brighter Vibes LLC, a state-vendored Financial Management Services (FMS) provider (Service Code 490) for California's Self-Determination Program (SDP). We act as a bill-payer / fiscal agent, managing Medicaid funds on behalf of program participants and their regional centers.

2. Information we collect

  • Participant information: name, contact details, regional center ID, budget and spending records, invoices, and related documentation submitted for payment.
  • Vendor information: business details, contact information, W-9 and banking details on file, exclusion screening records.
  • Staff account information: name and email address via Google sign-in, for authorized personnel only.

3. How we use this information

We use this information to verify and pay vendor invoices from participant budgets, generate monthly expenditure reports, maintain audit-grade financial records for regional center review, and comply with state and program requirements.

4. How we store and protect it

Participant and financial data is stored in Supabase (Postgres) with row-level security enabled. Every create, update, and delete action is recorded in an audit log with the acting staff member, timestamp, and change details. We do not store participant data in browser local storage.

5. Third parties we share data with

  • Supabase — database, authentication, and file storage
  • Google — staff sign-in (OAuth)
  • Ramp and Melio — payment processing
  • QuickBooks Online — accounting records
  • Resend — transactional email (statements, notifications)
  • Regional centers, as required for program oversight

6. Data retention

[PLACEHOLDER — retention period to be specified per state and regional center recordkeeping requirements.]

7. Your rights

California residents may have rights under the CCPA regarding access to and deletion of personal information. Because this system maintains audit-grade financial records required for regulatory and fiduciary purposes, some records may be exempt from deletion requests while retention obligations apply. [PLACEHOLDER — confirm exact scope with counsel.]

8. Contact

Questions about this policy: support@abritefms.com