Your information goes where you send it, and nowhere else.

This is what we collect, why, who can see it, how long we keep it, and how to get it corrected or removed. It covers the website and the CarePair app for iPhone and Android. It is written to be read. Health information has its own page too, our Consumer Health Data Privacy Policy. This version took effect November 6, 2026 and replaces the version effective October 29, 2026.

Effective November 6, 2026. Questions: hello@thecardinalgroup.org.

01Who we are

CarePair Technologies LLC runs CarePair and is responsible for your information. Cardinal Care Advisors LLC, a partner firm under common ownership, provides the Cardinal services.

CarePair is run by CarePair Technologies LLC ("we", "us"), a New York limited liability company based in Buffalo. We hold your information and are responsible for it under this policy. CarePair may refer you to partner firms. Placement concierge, Homeward by Cardinal, and discharge planning are provided, contracted, and billed by Cardinal Care Advisors LLC ("Cardinal"), a separate company under common ownership with us, in parts of Western New York. Cardinal sees your case only when you apply for one of its services or a hospital or facility refers a patient to it, as the sharing section says. Cardinal uses CarePair under this same policy and under a written agreement with us that binds it to the same safeguards, and each company answers to you for what it does with your information. No partner firm, community, or provider receives your information for its own marketing.

This policy covers trycarepair.com, the CarePair app for iPhone and Android, and the services Cardinal delivers through them: the free tools, placement concierge, Homeward by Cardinal, and discharge planning. It is written in plain language on purpose. If something here is unclear, email us and we will explain it, then fix the wording.

02What we collect, and why

We collect only what the next step needs, and each item below says why we ask for it.

If a community does not need something at the inquiry stage, we do not ask for it at the inquiry stage. The list is long because it is complete.

Your account: your name, email address, and a password we store only as a one-way hash. If you turn on texts, your mobile number, the date you agreed, and the date the number was confirmed. If you turn on two-step sign-in, its secret, encrypted. Why: to sign you in and reach you.
The person you care for: name, date of birth, city, county, and ZIP code, your relationship to them, a short care summary in your words, how care would be paid for, and your answers on the Start page and in the care guide, stored as answer keys rather than free text. Why: to match care needs to communities and providers and to build one application. We ask for your consent before we collect this kind of health information.
How you found us, if you choose to tell us. Why: to know which outreach helps families.
How you reached CarePair: the campaign tags on the link that brought you (such as utm_source, utm_medium, and utm_campaign), the website you came from (its name only, such as google.com), the CarePair page you first landed on (without anything after a question mark), and the time of that visit. We keep them in two cookies (see Cookies) and copy them onto your account when you sign up. Anything that looks like an email address is dropped. Why: to learn how people found us. They are never sent to PostHog or anyone else.
Care documents you upload: care directives such as a health care proxy, a power of attorney, or a MOLST or DNR form; application packets; and, only after a community offers a bed, the financial details you choose to share with that one community, as amounts and ranges. Physician forms pass through to the communities you choose and are purged after delivery; we keep a record that they were sent, not the form. Why: communities need them to make an admission decision.
Messages, calendar items, reminders, notes, journal entries, starred communities, tour notes, the providers on your care team list, and feedback you give after a move. Why: so you, your care circle, your advisor, and the communities you chose see the same next step.
Concierge applications: your answers (who needs care, where they live now, timing, care needs, budget and income as ranges, payer, and who decides) and the advisor's note from the review call. Why: to decide whether we can help and to start the work if we can. If we cannot accept your application, it stays on your case under the case schedule below, and you can ask us to delete it.
Homeward: the home address we visit, the answers and photos from the Home Readiness Assessment, notes from calls and home visits, the Homeward plan and its goals, the providers on your care team, the vendor jobs Cardinal arranges for you, and records of staff time (who, when, how long, and what it was for). Why: to deliver the plan and to bill time accurately.
Discharge planning records from a hospital or facility: the referral (name, date of birth, unit, the planner, the expected discharge date, a needs summary, and a family contact), and only these files: a face sheet with Social Security, Medicare, Medicaid, and insurance numbers blacked out; equipment and service orders from the care team; therapy home safety recommendations; a PRI or SCREEN the facility completed, which we only pass along; and a health care proxy or power of attorney. Why: to plan the non-clinical side of leaving with the providers and communities the patient chooses.
Signatures: for every agreement signed in CarePair, the exact text signed, the name typed, the date and time, the network address and browser, and, for a patient authorization, who signed and in what capacity (the patient, a health care agent, an agent under a power of attorney that covers health matters, a court-appointed guardian, or a surrogate the facility identified under the Family Health Care Decisions Act). Why: that is the signed record, and we show it back to you.
Your agreement to these documents: the version, the date and time, the network address, the browser or app you used (web, iPhone, or Android), the exact words next to each box you ticked, and a fingerprint (a SHA-256 hash) of the full text you agreed to. Why: to prove what you agreed to and when.
Billing, for paid services: who pays (a family member, or a hospital or facility), the plan or tier, the amounts, time records, and whether a month was invoiced or a payment went through. We never see or store card numbers, security codes, or bank details; those go from your browser straight to Stripe. Why: to charge what was agreed and nothing more.
If you use the CarePair app and allow notifications: a code for each phone (a push token), which kind of phone it is, the app version, and when the app last checked in. Why: to send a notice to the right phone. The app section below has the details.
Records of use: which account did what and when, including the network address it came from, and the date and version of the terms you agreed to. Why: this audit log is how we can show you who saw your information.
If you write to us outside your account: the email and place you leave on the waitlist for a new area, the address you send a guide to, and what you put in a bug report (your name, email, what you wrote, the page, and your browser). Why: to do the one thing you asked.

03What we refuse to collect

There are things we will not take, even if you try to give them to us.

We do not accept Social Security numbers; Medicare, Medicaid, or insurance ID numbers; driver's licenses or photo IDs; insurance cards; card or bank account numbers; financial statements; long-term care policy documents; full charts, histories and physicals, or progress notes; psychiatric or substance use treatment records, including records covered by 42 CFR Part 2; or HIV information. We do not collect your precise location, biometric information, or the contacts or calendar on your phone.

The upload forms do not offer those document types. The application form refuses text that looks like an account number. The referral upload for hospitals refuses file names that look like charts or ID cards and text shaped like a Social Security or Medicare number, and the planner confirms the numbers are blacked out before sending. If something reaches us anyway, we delete it and tell the sender. If a community needs an account number after it offers you a bed, you give it to that community directly; CarePair does not store it.

04Health information

Much of what you enter is health information. We ask before we collect it, and we protect all of it the same way whether or not HIPAA technically applies to a given record.

Your own information, entered by you or your care circle, is governed by this policy, by our Consumer Health Data Privacy Policy, by New York law including the SHIELD Act, by the consumer health data laws of states such as Washington, Nevada, and Connecticut where they apply, and by the agreements you sign with us. We protect it with encryption in transit and at rest, a separate encryption key for each document and sensitive field, role- and row-level access checks on every action, and an append-only audit log of every access.

When a hospital or skilled nursing facility refers a patient for discharge planning, Cardinal acts as that facility's business associate under HIPAA. Before the facility sends any patient record, it signs a business associate agreement and a services agreement with Cardinal, and the patient, or their authorized representative, signs an authorization for Cardinal's work. The facility stays responsible for its own use of what it receives. Face sheets and orders are encrypted, every read and write is logged, planners can upload them but cannot download them again, and the files are never shown to families or to communities. Staff copy onto the case only the facts the work needs.

A community or care organization that is covered by HIPAA and wants a business associate agreement for its use of CarePair can ask for one, and we sign it.

We do not call ourselves HIPAA compliant as a badge. HIPAA is not a certificate anyone issues. This page and our Compliance page say what we actually do, and you can check it.

We never complete New York's PRI or SCREEN assessments; we only pass along one a facility completed. We do not diagnose, and we do not give medical, legal, or financial advice.

05How it is shared

Everyone who can see something in CarePair can see it because you, or someone you authorized, chose to share it with them, and every view is logged.

The communities and providers you choose to apply to or message: that application, the documents you chose to attach, and your messages with them. Each send happens only when you press the button to send it. Their access to attached files closes when they decline, when you withdraw, when your case closes, 30 days after they answer, or 45 days after sending if they never answer. The application text stays so the record makes sense; only the files close.
The people you invite to your care circle, at the level you give them. Journal entries are visible to the whole circle; your advisor sees a journal entry only when you share that entry.
Cardinal, our partner firm: its advisors and coordinators, and the staff who support them, when you apply for concierge or Homeward, to review the application; once you are accepted; and when a patient is referred for discharge planning. Tour ratings and notes go to your advisor and never to the community.
A hospital or facility that referred a patient for discharge planning: the status of the planning, the readiness checklist, the to-dos Cardinal chooses to show it, its own messages with Cardinal, and a short home readiness summary that says which fixes were done, never the answers or photos. If it pays for the service, a monthly billing report that lists each patient by name with the time spent. If the patient continues with Cardinal after discharge, for Homeward or a placement, that case keeps the referral and the facility's login can still see its status and checklist in the same limited way. The facility never sees your messages with Cardinal, your journal, your application packets, your financial details, or your documents.
Home care agencies, equipment suppliers, and other providers that you, or the patient or their representative, choose: only what they need to answer or serve you. A Homeward vendor first receives the kind of job and the town; it receives your name, street address, and phone only after you approve its quote.
If a family member pays for Homeward or discharge planning, that person sees the fees and time records for the service they pay for. If a hospital or facility pays, see the bullet above.
Our vendors, which act only on our instructions, under written agreements that require them to protect it, with business associate agreements where they touch health information: Amazon Web Services for hosting, the database, file storage, encryption keys, and text messages; Resend for email, which carries a step and a link and never health details; Google Workspace for our staff's email and calendar; Stripe for payments, which receives from us only the payer's email address, an opaque reference, and the product, plus whatever the payer types on Stripe's own checkout page; PostHog for analytics, as the next section describes; and Apple Push Notification service and Google's Firebase Cloud Messaging for app notifications, which carry only the short line you see under Updates. The full list, and what each one sees, is on our Compliance page.
Anyone the law requires, such as in response to a valid court order or subpoena. We give the minimum the order requires, and we tell you unless we are legally barred from doing so.
A company that takes over CarePair, if that ever happens, under this policy, and only after we tell you.
Never sold, never rented, never given to a data broker, never used for advertising by us or by anyone else, never used to train an AI model, and never fed to an AI tool. No advertising or tracking pixels run on CarePair, and no one else collects information about what you do on CarePair to follow you across other sites or apps over time.

06Analytics

We use PostHog on public pages only, through our own address, to see where people get stuck, and it never receives your name or anything you type.

Since October 29, 2026, the public pages of trycarepair.com send PostHog which pages are viewed and a few named steps, such as starting sign-up or opening a guide. The requests go to an address on our own domain, and our server forwards them without your cookies, without the page you came from, and without your network address. PostHog's own setting to discard IP addresses is on as well. There is no automatic capture of clicks, no session recording, no heatmaps, no surveys, and no feature flags, and every web address is stripped of its query string. Pages reached by a private link (a signing page, a community's response page, an unsubscribe link, the patient referral form) send nothing.

Signed-in pages send nothing today, and the server sends nothing about your account. That changes only after PostHog signs a business associate agreement with us. When it does, we will update this policy and the Compliance page before turning it on. This is what would change: signed-in pages would report which screens are used, with record ids replaced by a placeholder; and the server would report a few milestones (an account created, an email confirmed, an application submitted, a decision made, a payment completed) under your internal account number. Even then PostHog would never receive your name, email, phone, address, town, county, ZIP code, anything you type, your answers, document names, or the name of any community tied to you, and when you close your account we would ask PostHog to delete what it holds about you.

The CarePair app has no analytics, advertising, or crash-reporting code of its own. It shows the same pages as the website, so the public pages it opens (help, the directory, these legal pages) send the same page views described above, and its signed-in screens send nothing today.

If your browser sends Global Privacy Control or Do Not Track, analytics does not load at all. Inside your account, we understand how CarePair is working from our own counts and timings, which do not leave our servers.

07Cookies and local storage

We set a sign-in cookie, a few small preference cookies, two cookies that remember how you found us, and one analytics cookie on the public site. There are no advertising cookies, and nothing here follows you to other sites.

Here is every one of them:

A session cookie that keeps you signed in, and a short-lived cookie that carries you through two-step sign-in. Both are marked httpOnly and secure, so scripts cannot read them and they travel only over encrypted connections.
For staff and community logins, a preference cookie that remembers which organization they are viewing, and a five-minute cookie that shows a staff member a connector link once.
Two first-party cookies that remember how you found us: cp_ft, set once on your first visit, and cp_lt, set again whenever you arrive from a link with campaign tags. Each holds the campaign tags (utm source, medium, campaign, content, and term), the website you came from (its name only), the CarePair page you landed on (without anything after a question mark), and the time of the visit. Anything that looks like an email address is dropped. Both last 90 days, are httpOnly so scripts cannot read them, and are read only by our own server, which copies them onto your account when you sign up. They are never sent to PostHog or anyone else. In the CarePair app they are set only when you open a link that carries campaign tags.
On the public site only, PostHog sets one cookie on our domain, plus an entry in your browser's local storage, so it can tell that two page views came from the same browser. It is not shared with any other site, and it is not set at all if your browser sends Global Privacy Control or Do Not Track.
Your browser also keeps a few preferences locally and never sends them to us: light or dark mode, and whether you dismissed the getting-started card.
The booking page for business partners (/book) loads a scheduling widget from Cal.com, which sets its own cookies on that page only. Families do not use that page.
There is no cookie banner because there is nothing to opt out of: nothing here builds an advertising profile or tracks you across sites, and analytics honors your browser's privacy signal instead of asking you to click one.

08The CarePair app

The app for iPhone and Android is the same CarePair, and this policy covers it. A few phone features are off until you turn them on.

The CarePair app shows the same CarePair you use on the web, and everything in this policy applies to it. A few things work only on a phone, and each is off until you turn it on.

Notifications. If you allow them, the app gives us a code for your phone so we can send a notice. Notices travel through Apple Push Notification service on iPhone or Google's Firebase Cloud Messaging on Android. Each one carries the same short line you see under Updates, such as a community answered, and a link into the app. It never carries your care summary, your answers, or a document. Turn notifications off at any time in your phone's settings. We delete the code when you sign out on that phone, when you close your account, when Apple or Google tells us it no longer works, or after 270 days without the app checking in.
Face ID, Touch ID, or fingerprint unlock. Off until you turn it on under Settings, On this phone. Your phone checks your face or fingerprint itself, and the switch is kept on the phone. We never receive or store biometric information.
Offline documents. If you press Keep on this phone on the Documents page, the app saves a copy of your documents on your phone, encrypted with a key kept in your phone's secure storage (the iPhone Keychain or the Android Keystore) for that phone only. The copies are kept out of iCloud and Android backups. Signing out, or a session that ends, removes them and the key, and you can remove them at any time under Settings. Anyone who can unlock your phone and the app can see what CarePair shows on it, so keep a passcode on your phone.
Camera and photos. The camera is used only when you choose to take a picture of a form to save to your documents. Your photo library is used only when you choose an existing photo to file there, or when you ask to save a photo to it.
What the app does not do. It does not ask for your location, your contacts, or your calendar, and it has no advertising, analytics, or crash-reporting code of its own.
The app stores. Apple and Google collect what their stores collect when you download the app, under their own privacy policies. We do not receive your store account. The privacy labels in each store describe the same practices as this page.

09Text messages

Texts are off unless you turn them on and confirm a code, and they only ever say that something happened.

Texts are off unless you turn them on in Settings or at sign-up, give a mobile number, and confirm a six-digit code. We record the date you agreed and the date the number was confirmed. Texting is still being set up: until our toll-free number is verified, no text is sent, and the option in Settings will not complete. Once it is on, texts come from the toll-free number shown in Settings, sent through Amazon Web Services. They are short: a community answered, your advisor or coordinator wrote, a tour is confirmed, an appointment is tomorrow, or a document was asked for, with a link to the app. A text may name the community or the time; it never carries your care summary, your answers, a document, or the text of a message. Reply STOP at any time to end them and HELP for help. Message and data rates may apply. Non-urgent texts are held overnight unless you turn quiet hours off. We never send marketing texts. The full program terms are in the Messaging program section below.

10How long we keep it

We keep records for as long as you, the law, or a later dispute would need them, and these are the periods.

This is the schedule in our written retention policy. Where a period is longer than you might expect, it is because New York and federal record-keeping rules for health and financial records run six to seven years, and we would rather tell you that than guess short.

Case records (needs, applications, messages, tours, outcomes, concierge applications, Homeward plans and visit notes): six years after the case closes, then destroyed. A closed case stays reachable to you until then.
Physician forms in transit: until the chosen community retrieves them or the confirmation window closes, and never later than 45 days after upload, when the purge job removes them. A record that they were sent is kept.
Face sheets, orders, and therapy recommendations from a hospital or facility: deleted 14 days after the discharge planning case closes, and never kept more than 60 days after upload. If no one signs the patient authorization, deleted 30 days after the referral. We keep a record that the file existed (its type, dates, and who sent it), not the file.
Signed agreements and authorizations: six years after the agreement ends, the period HIPAA sets for its documentation. The record of your agreement to these documents is kept the same way.
Billing and time records for paid services: seven years, for tax and accounting.
Restricted values such as Social Security numbers and account numbers: not stored. Hospitals and facilities are told to black them out before sending anything.
Your account after a closure request: 30 days of grace, then the account is locked and your name, email, phone, password, and two-step secret are removed so the row no longer identifies you. Case records follow the case schedule. Your PostHog record, if one exists, is deleted.
App notification codes: deleted as the app section says, and never kept more than 270 days without the app checking in.
The audit log: at least six years, never edited.
Email and text logs: who was sent what and whether it sent, never the body, in production. Verification codes: ten minutes. Rate-limit counters and in-app notifications: days to weeks.
Database backups: 14 days. Old versions of files: 90 days after replacement.

11Your rights and choices

You can see, download, correct, and delete most of it yourself under Settings. We answer everything else within 45 days, and you can appeal.

Most of this you can do yourself under Settings, on the web or in the app: download everything we hold about you and the person you care for as one archive, correct anything that is wrong, turn texts and email updates on or off, and close your account. For anything else, email hello@thecardinalgroup.org from the address on your account, or write to your advisor or coordinator in the app. We confirm who you are, then answer within 45 days. If we need more time, we tell you why within those 45 days and take at most 45 more. None of it costs anything, and we never treat you differently for asking. A guardian, conservator, or other authorized agent may ask for you.

See what we hold about you and the person you care for, and get a copy, including a list of every company and person we shared it with. Physician forms are not in it: they pass through and are not stored.
Correct anything that is wrong.
Withdraw an application, close a case, or remove a care circle member at any time in the app.
Withdraw your consent to our use of health information, by email or by closing your account. We then stop collecting it and delete what the law lets us delete, as the Consumer Health Data Privacy Policy explains.
Close your account and ask us to delete what the law lets us delete. We also tell the vendors and the people we shared it with to delete it. Records kept for the periods above stay locked and unused until they are destroyed.
Ask who has seen your information. The audit log exists to answer that.
Take back a discharge planning authorization at any time by telling Cardinal in writing or by phone. It stops future sharing; it does not undo sharing that already happened.
Cancel a Homeward plan under Manage billing, by telling your coordinator, or by email, as the Homeward services agreement describes.
Withdraw your consent to electronic records (see the Terms of Service).
If a hospital or facility referred you and you have no CarePair account, make any of these requests by email or phone, or through the facility. Where HIPAA puts the duty on the facility, we pass the request to it and help it answer.
Appeal. If we turn down a request, we tell you why. You can appeal by replying to that answer, or by emailing hello@thecardinalgroup.org with the word "appeal". Someone who did not make the first decision reviews it and answers in writing within 45 days. If we still say no, we tell you how to contact your state's Attorney General.
Complain. Tell us first and we will try to put it right. You can also contact your state's Attorney General, such as the New York Attorney General, or, for health information covered by HIPAA, the Office for Civil Rights at the Department of Health and Human Services. We never retaliate for a complaint.

12Where you live

Some state laws protect health information no matter how small the company is. Wherever you live, you get the same rights, and we honor your browser's privacy signal.

CarePair is open to families anywhere in the United States. Some state laws protect health information no matter how small the company is. Washington's My Health My Data Act, Nevada's consumer health data law, and Connecticut's data privacy law, which covers health information, are among them. Our Consumer Health Data Privacy Policy says what consumer health data we collect, why, where it comes from, who receives it, and how to use your rights under those laws.

We collect health information only with your consent, and only to do what you ask CarePair to do. We share it only with the people and places you choose, or as this policy says. We never sell it, and we never set up a virtual boundary around a place where health care is given (a geofence) to send you messages or ads, or to collect information about you.

Wherever you live, and whether or not your state's law requires it of a company our size, you get the rights in this policy: access, correction, deletion, a portable copy, withdrawal of consent, an appeal, and no sale or sharing of personal information for advertising. We do not sell personal information, we do not share it for cross-context behavioral advertising, we do not use it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. We treat Global Privacy Control as an opt-out.

13Children

CarePair is not for anyone under 18.

We do not knowingly collect information from a child. The person you are caring for must be an adult, or someone you have legal authority to act for. If you believe a child has given us information, email us and we will remove it.

14How we protect it

Encrypted, logged, and as little as possible. The details are on our Security page and our Compliance page; the short version:

No system is perfectly secure, and we cannot promise that information will never be reached without permission. What we promise is the safeguards on this page, and that we will tell you quickly if something goes wrong.
Encrypted in transit (TLS 1.2 or better) and at rest. Every document and sensitive field carries its own key, wrapped by a master key in AWS Key Management Service that never leaves it.
Financial details are collected only after a bed is offered, sent to one community, and never travel with a first application.
Every access to health information is written to an append-only audit log: who, what, which fields, when, from where.
Only the people at CarePair and Cardinal whose work needs it can reach health information, and each of them is bound to keep it confidential.
Staff, community, and partner logins use two-step sign-in and time out after 30 minutes without activity. Families can turn two-step on too. You can see and end your own sessions under Settings.
Discharge planning work starts only after the facility's agreements and the patient's authorization are signed. Before that, Cardinal only receives the referral and sets up signing.
We keep as little as we can. Physician forms pass through and are purged. Face sheets and orders are deleted within weeks. Account numbers are not stored.
Demonstrations and testing use made-up families that are flagged as such and left out of every real count. We never use a real family's information for a demo, for training, or to try a new feature. Our source code and its automated tests hold synthetic data only.
CarePair's database and files live in Amazon's us-east-1 region, in the United States, under a business associate agreement with Amazon.

15If something goes wrong

If something goes wrong, we tell you quickly and in plain language, and we never let a vendor's notice stand in for ours.

If we learn that your information was accessed or disclosed in a way this policy does not allow, we contain it first, write down what happened promptly, work out who was affected from the audit log, and then tell you without unreasonable delay.

Under New York's SHIELD Act we notify affected New York residents in the most expedient time possible, and the New York Attorney General, the Department of State, and the State Police; if more than 5,000 New York residents are affected, the consumer reporting agencies too. We notify residents of other states as their laws require.

Where health information covered by HIPAA is involved, we notify the people affected no later than 60 days after discovery, and the Department of Health and Human Services on HIPAA's schedule. When we hold information as a hospital or facility's business associate, we tell that facility the same day we learn of it, and the facility notifies the patient under HIPAA; we still notify under the SHIELD Act where it applies.

Where the Federal Trade Commission's Health Breach Notification Rule (16 CFR Part 318) applies to health information we hold, a breach includes an unauthorized disclosure, not only a hack. We notify you without unreasonable delay and no later than 60 calendar days after we discover it. We notify the Federal Trade Commission at the same time when 500 or more people are affected, and otherwise within 60 days after the end of that calendar year. When 500 or more residents of one state are affected, we also notify prominent news outlets there.

Our notice goes by email to the address on your account, together with a notice in CarePair or a text, or by mail. It says, in plain words, what happened and when, the date we found out, what kinds of information were involved, the full name of anyone who received it without permission, what you can do to protect yourself, and what we are doing about it. It also gives at least two ways to reach us, such as email, phone, a web page, or a message in the app.

We intend to beat every one of those deadlines, and we keep a written record of every incident.

16Business contacts

If you work at a community, a provider, a hospital, or a vendor, we hold your work contact details to run the directory and the network.

For business contacts we keep your name, title, work email and phone, which organization you belong to, the listing facts your organization gave us, notes and dates of our calls and emails with you, the agreements your organization signed, and, for Homeward vendors, the insurance certificate you sent. Directory facts come from public state registries and from the businesses themselves. If you email our team, the date, subject line, and addresses of that email may be logged on your organization's record in our outreach tool; the body is never read or stored. Our staff may use an AI assistant connected to that outreach tool; it reaches business records only and has no path to families, patients, cases, or documents. You can ask us to correct or remove your contact details at any time. Facts about an organization that come from public records stay, because they are public.

18Messaging program terms

The CarePair messaging program sends the account and care notices you opted into, and nothing else.

1. The messaging program sends account and care notices you opted into: that something happened in CarePair, with a link to the app. We do not send marketing texts. We send only what you explicitly signed up to receive through our opt-in process. Messages are sent from the toll-free number shown in Settings once texting is available.

2. You can cancel the SMS service at any time. Text STOP to the number you received messages from. We will send one message to confirm that you have been unsubscribed, and after that you will receive no more texts from us. To join again, turn texts back on in Settings and confirm a code, and we will start sending them again.

3. If you are having trouble with the messaging program, reply HELP for assistance, or email hello@thecardinalgroup.org.

4. Carriers are not liable for delayed or undelivered messages.

5. Message and data rates may apply for messages sent to you from us and from you to us. Message frequency varies with what happens on your case. Questions about your text or data plan belong with your wireless provider.

6. Questions about privacy are answered in the rest of this page, or email hello@thecardinalgroup.org.

19Changes to this policy

When this policy changes, we update the date at the top, and for anything that matters we ask you to agree again.

This version took effect November 6, 2026 and replaces the version effective October 29, 2026. What changed: the CarePair app for iPhone and Android is described, with notifications, Face ID and fingerprint unlock, offline documents, and the camera; Apple and Google are listed for notifications; the cookies that remember how you found us are listed; we now ask separately before collecting health information, and the consumer health data laws of Washington, Nevada, and Connecticut are described, with a new Consumer Health Data Privacy Policy; the statement that state privacy laws do not apply to us was removed; requests are answered within 45 days, with an appeal; the breach section covers the Federal Trade Commission's Health Breach Notification Rule; and the record of your agreement now includes your browser or app, the exact words you saw, and a fingerprint of the text.

When we change this policy we update the effective date at the top. If a change would let us collect a new kind of health information or use it for a new purpose, we ask for your consent first. For anything else that changes what we collect or who can see it, we ask you to read a short summary and agree again the next time you sign in. We keep a copy of every version as it was shown, and you can ask us for any of them.

20Contact

Email hello@thecardinalgroup.org. Our Privacy Officer reads that inbox.

CarePair Technologies LLC, 228 Park Ave S PMB 923759, New York, New York 10003-1502. hello@thecardinalgroup.org. (716) 300-2769. For placement concierge, Homeward, and discharge planning: Cardinal Care Advisors LLC, same address, email, and phone. The Privacy Officer answers requests about your information for both companies, including requests about discharge planning records that came from a hospital or facility.