Your health information, and your rights over it.

01What we collect

Health information is anything that could show something about a person's physical or mental health, or that they are looking for care. In CarePair, that is most of what a family enters about the person they care for.

CarePair Technologies LLC ("we", "us") runs CarePair and collects these kinds of consumer health data:

• Care needs: the care summary in your words, the level of care you are looking for, conditions you choose to mention, and your answers on the Start page and in the care guide.
• That you are looking for care: the communities and providers you search for, save, apply to, tour, or message, and your notes and ratings after a tour.
• Documents: care directives such as a health care proxy, a power of attorney, or a MOLST or DNR form; physician forms on their way to a community; application packets; and photos of forms you take with the app.
• Calendar items and reminders, such as a medical appointment, and journal entries and messages that mention health.
• If you use Homeward: the answers and photos from the Home Readiness Assessment, notes from calls and home visits, and the Homeward plan.
• If a hospital or facility refers a patient for discharge planning: the referral and the limited records it sends, such as a face sheet with identification numbers blacked out, equipment and service orders, therapy home safety recommendations, and a PRI or SCREEN the facility completed.

02Why we collect it, and how we use it

Only to do what you ask CarePair to do, and to keep it safe.

We use consumer health data to: keep one profile for the person you care for; match care needs to communities and providers; build and send the applications you choose to send; keep your documents, calendar, and reminders; carry your messages; run the services you sign up for, such as Homeward; keep the audit log of who saw what; keep CarePair secure; and keep the records the law requires. We do not sell it, we do not use it for advertising, we do not use it to train AI, and we do not use it for any other purpose without asking you first.

03Where it comes from

From you and the people you work with on care.

• You, and the members of your care circle.
• The person you care for, if they use CarePair themselves.
• A hospital or skilled nursing facility that refers a patient for discharge planning.
• Communities, providers, advisors, and coordinators who write to you in CarePair, and staff notes about the work they do for you.

04Who receives it

Only the people and places you choose, the companies that run CarePair for us, and anyone the law requires.

We share consumer health data only when you ask us to by taking the action that sends it, such as pressing Send on an application, inviting someone to your care circle, sending a message, or applying for a service, or when the law requires it. These are the kinds of people and companies that can receive it, and what each receives:

• Senior living communities and home care providers you choose to apply to or message: the application, the documents you attach, and your messages with them.
• The members of your care circle you invite, at the level you give them.
• Our affiliate Cardinal Care Advisors LLC ("Cardinal"), a company under common ownership with us: only when you apply for one of its services or are accepted for one, or when a hospital or facility refers a patient to it.
• A hospital or facility that referred a patient: the status of the planning, the checklist, and a short readiness summary, never your messages or documents.
• A family member who pays for a service: the fees and time records for that service.
• Companies that run CarePair for us and act only on our instructions, under written contracts: Amazon Web Services (hosting, storage, encryption keys, and texts), Resend (email, which never carries health details), Google Workspace (our staff's email and calendar), and Apple Push Notification service and Google Firebase Cloud Messaging (app notices, which carry only the short line you see under Updates).
• Anyone the law requires, such as a court with a valid order. We give the minimum and tell you unless the law bars it.

05Your consent

We ask for your consent before we collect health information, separately from the Terms, and you can withdraw it at any time.

When you create an account, or the first time you sign in after this page took effect, we ask you to tick a box that agrees to our collecting and using health information as this page describes. It is separate from agreeing to the Terms of Service, and we keep a record of the words you saw and when you agreed. If we ever want to collect a new kind of health information, or use or share it for a new purpose, we ask again first.

You can withdraw your consent at any time by emailing hello@thecardinalgroup.org from the address on your account, or by closing your account under Settings. When you withdraw it, we stop collecting health information from you and delete what the law lets us delete, as the next section says. CarePair cannot run its care tools without health information, so withdrawing consent means your account can no longer use them.

06Your rights, and how to use them

You can ask what we hold, get a copy, correct it, delete it, withdraw consent, and appeal, all free.

Most of this you can do yourself under Settings: download everything we hold as one archive, correct what is wrong, and close your account. For anything else, email hello@thecardinalgroup.org, call (716) 300-2769, or write to CarePair Technologies LLC, 228 Park Ave S PMB 923759, New York, New York 10003-1502. You do not need an account to ask. We confirm who you are before we act, and a guardian, conservator, or other authorized agent may ask for you.

• Confirm whether we collect, share, or sell your health information (we never sell it), see it, and get a copy, with a list of every company and person we shared it with and how to reach them.
• Correct information that is wrong.
• Delete it. We delete it from CarePair, from our backups within six months (our backups last 14 days), and we tell every company and person we shared it with to delete it too. Some records the law requires us to keep, such as signed agreements and the audit log; we keep those locked and unused for the period in the Privacy Policy, and we tell you which ones.
• Withdraw your consent, as the section above says.
• Get an answer within 45 days. If we need more time, we tell you why within those 45 days and take at most 45 more. Asking is free.
• Appeal. If we turn down a request, we tell you why. Reply to that answer or email hello@thecardinalgroup.org with the word "appeal". Someone who did not make the first decision reviews it and answers in writing within 45 days. If we still say no, we tell you how to contact your state's Attorney General, such as the Washington Attorney General at atg.wa.gov.

07What we never do

No sale, no geofencing, and no tracking across sites.

• We never sell consumer health data.
• We never set up a virtual boundary around a place where health care is given (a geofence), and the app never asks for your location.
• No one else collects information about what you do on CarePair to follow you across other sites or apps over time.
• Only the people at CarePair and Cardinal whose work needs it can reach your health information, and each of them must keep it confidential.

08Changes to this page

We tell you before anything here changes in a way that matters.

This version took effect November 6, 2026. When this page changes in a way that matters, we update the date above, tell you by email or in CarePair, and ask you to agree again the next time you sign in. We ask for new consent before collecting a new kind of health information or using it for a new purpose.