COGENCY Member Agency Portal pilot terms and privacy notice

1. What the portal is for

The portal is for agency-level work by COGENCY member agencies: finding and tracking funding opportunities, planning and preparing grant applications, reviewing aggregate quality-improvement measures, and working with other member agencies and COGENCY staff.

Use it only for your agency's work and only within the role COGENCY gave you. Do not use it for personal matters, for clinical care, or for any work for an organization that is not a COGENCY member agency.

2. No client information (no PHI)

The portal is not a clinical or client record system and is not covered by a business associate agreement. Never enter protected health information or anything that identifies a client.

• Do not enter client names, initials tied to a case, dates of birth, addresses, phone numbers, email addresses, Medicaid or insurance numbers, medical record numbers, case numbers, photos, or any other detail that could identify a client.
• Do not upload client records, case notes, intake forms, incident reports, or files exported from an EHR or care-management system.
• Use aggregate numbers only (for example, "we served 1,240 adults last year"). Small counts that could point to a person should be left out.
• The portal screens some text and uploads for identifiers and refuses what it finds, but the screen is a safety net, not permission. You remain responsible for what you enter.
• If you enter client information by mistake, stop, do not copy it elsewhere, and tell the incident contact (section 8) the same day so it can be removed.

3. AI assistance and human review

Some features use an AI model (Anthropic's Claude) to extract requirements from solicitations, pull facts from documents you add to your agency's evidence vault, and draft application sections.

• AI-assisted outputs are working drafts. A person at your agency must check every output against the funder's official instructions and your agency's approved sources before it is used or submitted.
• The portal never submits anything to a funder. Submission is always done by your agency, outside the portal.
• Text sent to the AI model is processed by Anthropic under its standard commercial API terms. COGENCY does not have a zero-data-retention agreement with Anthropic. Under the standard terms Anthropic deletes API inputs and outputs within 30 days (with limited safety and legal exceptions) and does not train on them by default.
• Never upload client records or any client information to the evidence vault or paste it into an AI feature.

4. Forum and Network Pursuits conduct

The forum and Network Pursuits are shared with staff from other member agencies and COGENCY. Keep posts professional, accurate and about agency-level work.

• No client information, no personal contact details of clients or third parties, no confidential funder information you are not allowed to share, and no harassment, discrimination or advertising.
• You can correct or remove your own posts. A removed post becomes a content-free tombstone: the title and text are cleared and only a note that it was removed remains visible.
• Any member can report a post, reply or pursuit update to COGENCY. COGENCY moderators review reports and may hide, pin, or remove content that breaks these terms. Moderator removals also leave a content-free tombstone.
• COGENCY keeps the prior text of an edited or removed post in an admin-only history so that moderation decisions can be reviewed. That history is not shown to members.

5. Authorized users and role duties

Accounts are personal and by invitation only. Do not share your sign-in, and do not let anyone else use your session.

• Members: use the portal for your own agency's work and follow these terms.
• Agency admins: invite only current staff of your agency who need access, give them the lowest role that works, and remove people promptly when they leave or change jobs.
• COGENCY admins: manage agencies and roles, moderate community content, and respond to incidents. COGENCY admins can see every agency's portal for support and network work.
• Everyone: tell the incident contact (section 8) at once if you think your account, a colleague's account, or any data in the portal has been misused or exposed.

6. Access changes and revocation

• COGENCY or your agency admin can change your role or remove your access at any time, for example when you leave your agency, when your agency leaves the pilot, or if these terms are broken.
• Removal ends your sessions; your next page or request is refused.
• Content you created for your agency stays with your agency's workspace after you leave, unless your agency asks for it to be deleted under section 7.

7. Retention and deletion

This is the proposed pilot schedule. Purges are run by COGENCY (not yet automated) and recorded in the release log.

8. Incident and support contact

For support, to report a suspected incident or exposure of information, or to report a mistake such as client information entered by accident, contact Mohsin Sardar at msardar@cogencyipa.com. Mohsin Sardar is the incident and support contact for the pilot.

9. Privacy notice

What COGENCY collects about you: your name, work email, agency and role (from your invitation), sign-in and session records kept by our sign-in provider, and an audit trail of actions you take in the portal (who, what, when and the outcome, never the content you wrote). When you accept these terms COGENCY records your user id, the policy version and the time (UTC).

What your agency stores: grant work, profiles, documents and posts that you and your colleagues enter. This is agency information, not client information.

Why: to run the portal, keep it secure, support member agencies, and measure the pilot. COGENCY does not sell your information or use it for advertising.

Who sees it: people at your agency with portal access, COGENCY admins, other member agencies for content you post in shared spaces (forum and Network Pursuits), and the service providers in section 10, only to provide their service.

Your choices: you can ask the contact in section 8 for a copy of your account information or to correct or delete it, subject to the retention schedule in section 7.

10. Service providers

The portal runs on these providers. None of them has a business associate agreement with COGENCY, which is another reason client information must never be entered.

11. Pilot term and termination

• The pilot runs from November 16, 2026 to February 26, 2027, for five COGENCY member agencies (Lower Eastside Service Center, Transitional Services for New York, Educational Alliance, Association to Benefit Children, and VIP Community Services), unless COGENCY extends or ends it earlier.
• COGENCY may change these terms. A new version is shown to you at your next sign-in and must be accepted before you can continue.
• COGENCY may suspend or end the pilot, or an agency's or person's access, at any time. Your agency may leave the pilot at any time by telling the contact in section 8.
• When the pilot ends, agency data is kept or deleted as described in section 7; COGENCY will tell agencies in advance how to export their work.