Your information goes where you send it, and nowhere else.

01Who we are

CarePair is operated by The Cardinal Group, LLC in Buffalo, New York. We built it so a family can organize care for someone they love and apply to senior living communities without repeating themselves. Cardinal Care Advisors, part of the same company, are the people who answer your messages inside the app.

This policy covers trycarepair.com and the CarePair application. It is written in plain language on purpose. If something here is unclear, email us and we will explain it, then fix the wording.

02What we collect

We collect only what the next step needs. Each item below has a purpose and a stage; if a community does not need something at the inquiry stage, we do not ask for it at the inquiry stage.

• Your account: your name, email address, a password we store only as a one-way hash, and, if you choose texts, your mobile number and the date you agreed.
• The person you are caring for: name, date of birth, city and county, your relationship to them, a short care summary in your words, and how care would be paid for.
• Applications: the answers you and your advisor enter on the application forms a community requires, and the list of communities you send them to.
• Documents you upload: insurance cards, forms, and, only after a community offers a bed, financial statements you choose to share with that one community.
• Physician forms: forms a doctor completes pass through CarePair to the communities you choose and are purged after delivery. We keep a record that they were sent, not the form.
• Messages, calendar items, and notes between you, your care circle, your advisor, and communities.
• Your journal: dated notes you write about how things are going. They stay with your care circle unless you share a specific entry with your advisor.
• Communities you star and the notes you keep on them, how a tour went in your words, who in your family handles what, and the providers you add to a care team list.
• Records of use: which account did what and when, including the network address it came from. This audit log is how we can show you who saw your information.
• Feedback you give after a placement, if you choose to give it.

03How we use it

We use your information to run the service you asked for and for nothing else.

• To match care needs to communities, build one application, and send it to the communities you pick.
• To let your advisor, your care circle, and the communities you chose see the same next step.
• To send you the notifications you turned on: a response arrived, your advisor wrote, a tour is tomorrow. Email subjects and texts never carry health details; they say something happened and point you to the app.
• To keep the service safe: sign-in protection, rate limits, and the audit log.
• To understand how CarePair is working, using counts and timings that do not identify a person.

04What we never do

Some lines do not move.

• We do not sell your information, or anyone's.
• We do not use your information, or the person you care for, for advertising, and we do not let anyone else.
• We do not run third-party advertising or tracking pixels on CarePair.
• We do not complete New York's PRI or SCREEN assessments, and we do not give medical or legal advice. Those come from clinicians and lawyers.
• We do not charge families, and we never charge a fee tied to a resident whose care is paid by a government program.

05Who can see your information

Everyone who can see something in CarePair can see it because you, or someone you authorized, chose to share it with them. Every view is logged.

• You and the people you invite to your care circle, at the level you give them. Journal entries are visible to the whole circle.
• Your advisor sees a journal entry only when you share that entry. Tour ratings and notes go to your advisor and never to the community.
• Cardinal Care Advisors assigned to your case, and the staff who support them.
• The communities you send an application to: they see that application, the documents you chose to attach, and your messages with them. Their access to attached files closes after they decline, after you withdraw, after your case closes, or 30 days after their answer.
• A hospital or care team that referred you, if you came to CarePair through one, for the case they referred.
• Service providers that run the infrastructure under written agreements that require them to protect health information: hosting and database, file storage and encryption keys, and email delivery. We list them for you on request.
• Anyone the law requires, such as in response to a valid court order. We will tell you unless we are legally barred from doing so.

06Text messages

Texts are off unless you turn them on in Settings and give a mobile number. We record the date you agreed. Texts are short, say only that something happened, and end with a link to the app and how to stop. Reply STOP at any time. Message and data rates may apply. Non-urgent texts are held between 9pm and 8am Eastern unless you turn quiet hours off.

07How we protect it

Security is described in more detail on our Security page. The short version:

• Encrypted in transit and at rest. Sensitive fields and every document carry their own encryption key on top of that.
• Financial details are collected only after a bed is offered, sent to one community, and never travel with a first application.
• Every access to health information is written to an append-only audit log.
• Staff sign in with two-step verification. Families can turn it on too.
• We keep as little as we can. Physician forms pass through and are purged. Account numbers are not stored.

08How long we keep it

We keep your case for as long as you have an account and for the period New York and federal record-keeping rules require after a placement, so that you, a community, or a regulator can reconstruct what happened. Physician forms in transit are purged after delivery or within days if never delivered. Rate-limit counters are dropped daily. Audit records are kept for the retention period because they exist to protect you.

When you ask us to close your account, we stop using your information, remove it from active systems within 30 days, and keep only what the retention rules require, locked down.

09Your choices and rights

Email hello@thecardinalgroup.org from the address on your account, or write to your advisor in the app, and we will act within 30 days.

• See what we hold about you and the person you care for.
• Correct anything that is wrong. Most of it you can edit yourself.
• Get a copy of your documents and application answers.
• Withdraw an application, close a case, remove a care circle member, or turn off texts and email at any time in the app.
• Close your account and ask us to delete what the law lets us delete.
• Ask who has seen your information. The audit log exists to answer that.

10Children

CarePair is for adults organizing care for adults. We do not knowingly collect information from anyone under 18, and the person you are caring for must be an adult or someone you have legal authority to act for.

11Cookies and local storage

We set one cookie to keep you signed in. Your browser also keeps a few preferences locally, such as whether you dismissed the getting-started card. There are no advertising cookies and no third-party analytics scripts. The booking page for facility and hospital partners loads a scheduling widget from Cal.com, which sets its own cookies on that page only.

12If something goes wrong

If we learn that your information was accessed or disclosed in a way this policy does not allow, we will tell you without unreasonable delay, in plain language, with what happened, what we did, and what you can do. New York's SHIELD Act and federal health privacy rules set the outer deadlines; we intend to beat them.

13Changes to this policy

When we change this policy we update the effective date at the top and, for anything that changes what we collect or who can see it, we tell you in the app before it takes effect. Old versions are available on request.