CFMS Privacy Policy
CFMS Privacy Policy
Effective Date: 2026
This Privacy Policy describes how Cambrian Financial Management Services ("CFMS," "we," "us," or
"our") collects, uses, discloses, and protects information in connection with our website,
applications, and fiscal management services (collectively, the "Service"), provided in support of
California's Self-Determination Program (SDP). By accessing or using the Service, you agree to the
practices described in this Privacy Policy.
This Privacy Policy applies to participants, their authorized representatives and Independent
Facilitators, Personal Attendants/caregivers, vendors, and other individuals who interact with the
Service ("Users," "you").
CFMS does not sell Personal Information of any kind.
A note on health information. Some information CFMS handles relates to participants of a state
disability services program. To the extent CFMS holds protected health information subject to the
Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), that information is governed
by a separate HIPAA Notice of Privacy Practices, available upon request by contacting us using the
information below.
1. Information We Collect
We collect the following categories of information, depending on your role as a participant,
representative, Personal Attendant, or vendor:
Identifiers. Name, mailing address, email address, phone number, date of birth, and, where required
for tax or background-check purposes, Social Security number or Federal Employer Identification
Number.
Precise Geolocation Data. When a Personal Attendant clocks in or out of a shift, we collect the
precise geolocation of the device used, as required by federal Electronic Visit Verification (EVV)
law (the 21st Century Cures Act) and applicable state regulations. This data is used solely to
verify that services were delivered at the authorized location and time, and is not used for
advertising, marketing, or any purpose unrelated to service verification and payment processing.
Financial and Payment Information. Information necessary to process payments to vendors and
Personal Attendants, including invoice and billing detail, pay rates, hours worked, and mileage
submitted for reimbursement. CFMS does not collect or store bank account, routing, or direct
deposit/ACH information, or payment card numbers — that information is collected and held directly
by our payment processors (Paychex and Bill.com), described in Section 3 below.
Employment- and Service-Related Information. Work history, service codes, professional licenses or
certifications, background check results (for Personal Attendants and vendors), and related
onboarding documentation.
Program and Budget Information. Information related to a participant's approved spending plan,
authorized budget, and the services and vendors associated with that budget, as required to
administer the Self-Determination Program.
Usage and Device Information. IP address, browser type, device identifiers, and information about
how you interact with the Service, collected automatically to maintain security and improve
functionality.
2. How We Use Information
We use the information described above to:
• Process payments owed to vendors and Personal Attendants;
• Verify that services were delivered as authorized, including through EVV geolocation data;
• Administer participant budgets and spending plans in compliance with Self-Determination Program
requirements;
• Facilitate required tax reporting and background checks for Personal Attendants and vendors;
• Comply with applicable federal and California state law, including reporting obligations to
Regional Centers and the California Department of Developmental Services (DDS);
• Maintain the security, integrity, and proper functioning of the Service;
• Respond to inquiries and provide customer support;
• Fulfill any other purpose for which the information was collected.
We do not use participant, vendor, or Personal Attendant information for advertising or marketing
purposes unrelated to the Service.
3. How We Share Information
CFMS does not sell, rent, or trade your Personal Information. We share information only as
necessary to operate the Service and meet our legal obligations, including with:
• Paychex, for payroll processing for Personal Attendants — Paychex collects and holds any direct
deposit/bank account information directly from Personal Attendants;
• Bill.com, for vendor bill payment and ACH processing — Bill.com collects and holds any bank
account/ACH information directly from vendors;
• SignNow, for secure electronic signature and document management;
• Regional Centers and the California Department of Developmental Services, as required for program
administration, audit, and compliance;
• Service providers who perform functions on our behalf (such as hosting, identity verification, or
background-check services), under agreements requiring them to protect your information and use it
only to perform the services requested;
• Government or law enforcement agencies, where required to comply with a subpoena, court order, or
other legal process, or to protect the rights, property, or safety of CFMS, our Users, or others.
Each third party listed above is contractually limited to using your information only as necessary
to provide their specific service to CFMS.
4. Minors
The Self-Determination Program serves individuals of all ages, and some participants are minors
whose accounts are managed by a parent or legal guardian. This Service is not directed at
soliciting information directly from children, and any information relating to a minor participant
is provided and managed by their parent, legal guardian, or authorized representative.
5. Data Security
We maintain administrative, technical, and physical safeguards designed to protect your
information, including encryption of sensitive information in transit and access limited to
personnel who need it to perform their job functions. We are committed to continuously
strengthening these safeguards to keep your information secure.
6. Data Retention
We retain Personal Information for as long as necessary to fulfill the purposes described in this
Privacy Policy, and as required by applicable law — including, where HIPAA applies, a minimum six
(6)-year retention period, and any applicable California DDS or Regional Center audit-retention
requirements.
7. Notice for California Residents
This section applies to California residents ("Consumers") under the California Consumer Privacy
Act ("CCPA") and California Privacy Rights Act ("CPRA"). It does not apply to protected health
information governed by HIPAA or the California Confidentiality of Medical Information Act, which
is addressed separately.
Categories of Personal Information We Collect
Your Rights
California residents have the right to:
• Know what Personal Information we collect, use, and disclose;
• Delete Personal Information we hold about you, subject to legal exceptions;
• Correct inaccurate Personal Information;
• Limit the use of Sensitive Personal Information (including precise geolocation) to what is
necessary to provide the services you request — which is already how we use it;
• Opt out of the sale or sharing of Personal Information — CFMS does not sell or share Personal
Information as defined by the CPRA;
• Non-discrimination for exercising any of these rights.
How to Exercise Your Rights
Submit a verifiable request by contacting us using the information in Section 9 below. We will
confirm receipt within 10 business days and respond within 45 calendar days (extendable by an
additional 45 days when necessary, with notice to you). You may designate an authorized agent to
submit a request on your behalf, subject to verification requirements.
8. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted with a new
effective date. Significant changes will be communicated through the Service or by email where
appropriate.
9. Contact Us
Questions or requests regarding this Privacy Policy, or to exercise any of the rights described
above, can be directed to:
Email: IT@cfms1.com Toll-Free: 888-509-9929
Local: 562-969-7777
