1.Who we are and our two roles
Cara Technologies, Inc. (“Cara,” “we,” “us”) runs the website at caramedical.com and offers two kinds of products. Our role, and the rules that apply to your information, depend on which one you use.
The Cara platform for medical practices
Medical practices use the Cara platform to run their patient portal, scheduling, forms, and messaging, and to connect with their electronic health record (EHR) systems such as athenahealth and Canvas. When we handle patient information for a practice, the practice is the “covered entity” under HIPAA (the US health privacy law) and controls that information. Cara acts as the practice’s “business associate,” which means we process that information only on the practice’s behalf and under a business associate agreement (BAA) with the practice. If you are a patient of a practice that uses Cara, the practice’s own notice of privacy practices explains how it uses your information, and you should contact the practice with requests about it.
The Cara mobile app
The Cara app is a chat-first health assistant with a personal health vault that you control. When you use the app, you have a direct relationship with Cara, and this Privacy Policy describes how we handle your information. If you choose to connect a practice you already see, information that comes from that practice may also be covered by the practice’s own privacy notice and by HIPAA.
This policy also covers information we collect through our website, such as when you contact us or request an introduction.
2.Information we collect
Account information
Your name, email address, phone number, and the sign in method you choose (an emailed code, Sign in with Apple, or Sign in with Google).
Health information you provide
Facts you tell Cara in chat, such as your weight, medicines, allergies, conditions, and goals, and the reminders (we call them “nudges”) you set up.
Documents and photos you upload
Photos or PDFs of lab reports, visit summaries, and other documents. The app reads the text in them automatically so it can add the information to your health vault.
Information from sources you connect
- Apple Health and devices: health and fitness data you choose to share, such as steps, weight, or heart rate.
- Practices you already see: records and messages from a practice you link, after you confirm with a one time code.
- Google account (optional): see Google user data.
- Microsoft account (optional): see Microsoft account data.
Caregiver information
If you manage someone’s care through a verified caregiver link, we collect the information needed to set up and verify that link.
Device and app information
Your device type, operating system, app version, push notification token, and technical logs and error reports we use to keep the app working. Error reports are scrubbed of health information before they are sent to our error monitoring provider.
Anonymous usage counts
We count app installs and general activity in an anonymous, aggregated way. We do not use third party advertising trackers in the app.
Website and contact information
If you contact us or fill out a form on our website, we collect what you send us, such as your name, work email, organization, and message.
Website analytics and cookies
Our website (caramedical.com) uses Google Analytics, a service from Google, to understand how visitors use the site. Google Analytics sets cookies in your browser and collects information such as the pages you visit, the links and buttons you click, the site that referred you, your browser and device type, and your approximate location. We use this information only to understand and improve the website. Google Analytics runs on our website only, not in the Cara app, and we do not send it health information.
You can block or delete cookies in your browser settings, or turn off Google Analytics on every site by installing the Google Analytics opt-out browser add-on. You can read how Google uses this information at policies.google.com/technologies/partner-sites.
3.How we use information
We use information to:
- Provide the app and the platform, including answering your questions, organizing your health vault, and showing your records.
- Send the reminders and messages you ask for, by push or SMS.
- Connect with the practices and accounts you choose, and show you information from them.
- Verify your identity and keep your account secure.
- Find and fix problems, prevent fraud and abuse, and improve the reliability of our services.
- Respond to you when you contact us.
- Meet our legal obligations.
We do not use your health information for advertising, and we do not sell it. For the Cara platform, we use patient information only as our BAA with the practice allows.
4.How AI is used with your information
Cara uses AI models to understand your messages, read uploaded documents, and write answers. To do this, relevant parts of your information are sent to our AI model providers, Anthropic and OpenAI. Both process this information for us under business associate agreements.
- We have a zero data retention arrangement with Anthropic, which means Anthropic does not store the content we send after it returns a response.
- No clinician reviews your chats with Cara unless you are using a service provided by a practice.
AI answers are general information, not medical advice. See our Terms of Service for more.
6.Google user data
You can choose to connect your Google account to the Cara app. This is optional, and you pick what to connect.
What we access and why
- Gmail (read only): we read messages only from the health related senders you choose (for example, your pharmacy, lab, or clinic), so Cara can find appointments, results, and other health information and add it to your vault. We cannot send, delete, or change your email.
- Google Calendar: so Cara can see and help you manage health appointments.
- Google Contacts: so Cara can recognize your care team and the people you name, such as a doctor or caregiver.
We use Google user data only to provide and improve the features you turned on. We do not use it for advertising, we do not sell it, and we do not use it to train AI models. We do not transfer it to others except as needed to provide those features (for example, to our hosting and AI providers under the terms described above), to comply with law, or as part of a business transfer.
People at Cara do not read your Google data, except when you give us permission (for example, to help with a support request), when needed for security (such as investigating abuse), or when required by law.
You can read the Google API Services User Data Policy on Google’s site.
How to disconnect
You can disconnect Google at any time in the Cara app settings, or remove Cara’s access at myaccount.google.com/permissions. When you disconnect, we stop accessing your Google data. You can also ask us to delete information we already imported (see Your privacy rights).
7.Microsoft account data
You can choose to connect your Microsoft account (personal, work, or school) to the Cara app. This is optional.
What we access and why
- Outlook mail (read): we read messages only from the health related senders you choose, so Cara can find appointments, results, and other health information and add it to your vault.
- Calendars: so Cara can see and help you manage health appointments.
- Contacts: so Cara can recognize your care team and the people you name.
We handle Microsoft account data the same way as Google data: only to provide the features you turned on, never for advertising, and never sold. People at Cara do not read it, except with your permission, for security, or when required by law.
How to disconnect
You can disconnect Microsoft at any time in the Cara app settings, or remove Cara’s access at account.microsoft.com/privacy/app-access (personal accounts) or myapps.microsoft.com (work or school accounts).
8.Apple Health data
If you connect Apple Health, you choose which types of data Cara can read, and you can change this at any time in the iOS Health app or Settings.
- We use Apple Health data only to provide Cara’s health features to you, such as tracking trends and reminders.
- We never use Apple Health data for advertising or marketing, and we never sell it.
- We do not share Apple Health data with third parties, except service providers that help us run Cara, or as you direct (for example, when you share it with a practice you connected).
9.Consumer health data
Some state laws, such as the Washington My Health My Data Act and similar laws in other states, give extra protections to “consumer health data,” meaning personal information that relates to your past, present, or future physical or mental health. This section explains how we handle it in the Cara app. It does not apply to information we handle for practices under HIPAA.
Categories we collect
- Health conditions, symptoms, medicines, allergies, and goals you share
- Measurements such as weight and data from Apple Health and devices
- Lab results, records, and documents you upload or import
- Appointments and messages from practices you connect
- Health related email, calendar, and contact information you connect
Why we collect it
To provide the features you ask for: answering your questions, keeping your health vault, sending reminders, and connecting with your practices. We also use it to keep the service secure and to meet legal requirements.
Where it comes from
From you, from your device and Apple Health, from practices you connect, and from Google or Microsoft accounts you connect.
Who we share it with
The practices and people you authorize, and the service providers listed in How we share information. We do not sell consumer health data.
Your rights
You can confirm whether we collect your consumer health data, see it, get a list of the third parties we share it with, delete it, and withdraw your consent at any time. You can download your data in the app (“Download my data”), delete your account in the app, or send us a privacy request at hello@caramedical.com. If we deny your request, you can appeal by replying to our response.
10.Your privacy rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct information that is wrong
- Delete your information
- Get a copy of your information in a portable format
- Opt out of the “sale” or “sharing” of your information, or its use for targeted advertising. We do not sell or share your information in these ways.
We will not treat you differently for using these rights. In the app, you can download your data and delete your account yourself. For anything else, email us at hello@caramedical.com. We may need to verify your identity first. An authorized agent may make a request for you where the law allows.
If you are a patient of a practice that uses the Cara platform, please send requests about your practice records to the practice. We will help the practice respond.
11.How long we keep information
We keep your information while your account is open and as long as needed to provide the service. When you delete your account in the app, we delete or de-identify your Cara app data, and we disconnect your linked practices and connected accounts.
Some exceptions apply. Records a practice keeps in its own chart are governed by that practice. We may also keep some records for as long as the law requires, or as needed to resolve disputes, prevent fraud, and enforce our agreements.
12.How we protect information
We encrypt information in transit and at rest, limit access to the people and systems that need it, and keep audit logs of access. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authorities of a breach as the law requires. You can read more on our Security page. Please report security issues to security@caramedical.com.
You can help by keeping your devices and email account secure, since sign in codes are sent there.
13.Children
The Cara app is for adults 18 and older. We do not knowingly collect information from anyone under 18 through the app. If you believe a child has given us information, contact us and we will delete it. A caregiver can manage another person’s care only through a verified caregiver link.
14.Where information is stored
Cara is based in the United States, and we store and process information in the United States. If you use Cara from outside the United States, your information will be transferred to and processed in the United States.
15.Changes to this policy
We may update this policy from time to time. We will change the “Last updated” date above, and if a change is significant, we will tell you in the app or by email before it takes effect. Where the law requires your consent for a change, we will ask for it.
16.Contact us
Questions or requests about privacy:
- Email: hello@caramedical.com
- Security issues: security@caramedical.com
Cara Technologies, Inc.