Privacy Policy

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Services.

If you use Carestamp through a home-care agency, private family, care-management organization, supported-living provider, or another organization (a “Customer”), that Customer controls its Carestamp workspace and the information entered into it. In that situation, Carestamp generally processes information on the Customer’s documented instructions and under the applicable agreement with that Customer.

If you are a care recipient, caregiver, family member, or other individual whose information was entered by a Customer, please direct privacy requests first to the Customer that manages the relevant Carestamp workspace. We will assist Customers with valid requests as required by applicable law and our contractual obligations.

We may collect the following categories of information.

Account and profile information. This may include your name, email address, phone number, role, organization name, username, password or authentication credentials, profile photograph, notification preferences, and account status.

Organization and billing information. For Customers and authorized administrators, this may include organization address, business contact information, subscription plan, billing contact information, invoices, and payment-related information. Payments are processed through Stripe. Carestamp does not store full payment-card numbers.

Care and visit documentation. Customers may enter or upload information needed to operate and document care visits. Depending on the Customer’s configuration and the services provided, this may include:

• Care recipient and caregiver names and contact information
• Service addresses and approved visit locations
• Visit schedules, assignments, clock-in and clock-out records, and worked time
• Location-confirmation information captured during permitted clock-in or clock-out events, including device-reported location, accuracy, distance from an approved location, and connectivity status
• Care-plan tasks, visit notes, non-clinical observations, incident or concern reports, and attachments
• Emergency-contact and authorized-family-contact information
• Family-safe visit summaries, messages, and requests
• Audit-history and time-correction information

Customers are responsible for ensuring they have a lawful basis and any required authority or consent to enter, share, and manage this information through Carestamp.

Device, log, and usage information. When you access the Services, we may automatically collect information such as IP address, device type, operating system, browser type, app version, device or session identifiers, dates and times of access, pages or features used, error reports, and security-related logs.

Communications and support information. If you contact us, request a demonstration, submit feedback, or communicate with support, we may collect the information included in your message and records of our communications with you.

Website technologies. Our website and Services may use cookies, local storage, and similar technologies to keep you signed in, remember preferences, protect the Services, understand performance, and improve the user experience. You can control cookies through your browser settings, although disabling certain cookies may affect functionality.

We use personal information to:

• Provide, maintain, secure, and improve the Services
• Create and administer accounts and organization workspaces
• Process subscriptions, billing, and payment-related requests
• Authenticate users and enforce role-based access controls
• Provide scheduling, attendance, location-confirmation, documentation, reporting, messaging, and family-update features
• Send service-related notices, security alerts, account messages, and support communications
• Detect, investigate, prevent, and respond to fraud, misuse, security incidents, and violations of our agreements
• Monitor reliability, troubleshoot problems, and improve product performance
• Comply with legal obligations and enforce our legal rights
• Create aggregated or de-identified information that does not reasonably identify an individual

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

We may disclose personal information only as described below.

Within a Customer workspace. Information is available to authorized users according to the permissions and settings established by the Customer. For example, an agency administrator may be able to review visit records, while a caregiver may only access assigned visits and the minimum client information needed for care. Family members and authorized representatives only receive information that the Customer has chosen and authorized for family sharing. Internal agency notes, unapproved incident details, caregiver performance information, payroll data, and other restricted information are not intended for automatic family disclosure.

Service providers. We may share information with service providers that help us operate the Services, such as hosting, storage, payment processing, customer support, security, communications, and technical infrastructure providers. These providers may access information only as needed to perform services for us and are contractually required to protect it.

Legal, safety, and business reasons. We may disclose information when we reasonably believe disclosure is necessary to comply with law, legal process, or a lawful government request; protect the rights, privacy, safety, or property of Carestamp, our Customers, users, or others; investigate suspected fraud or security issues; or enforce our agreements.

Business transactions. If Carestamp is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

With your direction or consent. We may disclose information when you or the relevant Customer directs us to do so or gives valid consent.

Carestamp supports non-medical home-care operations and documentation. The Services are not designed to provide medical advice, diagnoses, treatment decisions, emergency response, or medication-administration verification.

A Customer controls the care-related information it submits to Carestamp. Carestamp processes that information to provide the Services and does not use Customer Content for targeted advertising.

Carestamp does not claim that use of the Services alone makes a Customer compliant with HIPAA, Massachusetts privacy law, EVV requirements, Medicaid requirements, or any other legal or regulatory standard. If a Customer requires a business associate agreement or other privacy-related agreement, that arrangement must be separately executed and will govern where applicable.

Carestamp may collect location information only when a user or Customer enables a location-dependent feature, such as location-confirmed clock-in or clock-out. Location information may include device-reported coordinates, accuracy, distance from an approved service location, timestamp, and whether the event occurred while offline.

Carestamp is not intended to provide continuous background location tracking unless a Customer later enables a lawful, disclosed feature. Users should review their device settings to understand and control location permissions. Disabling location access may limit certain attendance or verification features.

We retain personal information for as long as reasonably necessary to provide the Services, meet our legal and contractual obligations, resolve disputes, enforce agreements, maintain security, and preserve required audit and historical records.

A Customer may close an account or request export of its information in accordance with its agreement with Carestamp. Account closure does not automatically require deletion of records that we must retain for legal, security, audit, billing, fraud-prevention, or legitimate business purposes.

When information is no longer required, we will delete, anonymize, or securely de-identify it in accordance with our retention practices and applicable law.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These measures may include encryption in transit, access controls, authentication safeguards, audit logging, role-based permissions, secure development practices, and monitoring.

No system is completely secure. You are responsible for maintaining the confidentiality of your login credentials, using strong passwords, protecting your device, and notifying us promptly of suspected unauthorized access.

Depending on where you live and applicable law, you may have rights to:

• Request access to personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of personal information, subject to applicable exceptions
• Request information about how we collect, use, and disclose personal information
• Opt out of certain processing where applicable
• Appeal a decision regarding a privacy request where applicable
• Receive equal service and pricing even if you exercise an applicable privacy right

To submit a request, email legal@mycarestamp.com with the subject line “Privacy Request.” Please provide your name, the email address associated with your Carestamp account, your relationship to Carestamp, the organization connected to your request if applicable, and the specific request you are making. We may need to verify your identity before fulfilling a request. If you submit a request through an authorized agent, we may request proof of authorization and identity verification.

If your information is controlled by a Carestamp Customer, we may refer your request to that Customer because it is best positioned to review, verify, and respond to the request.

If the California Consumer Privacy Act, as amended (“CCPA”), applies to Carestamp, California residents may have rights to know, access, correct, delete, and limit certain uses of personal information, as well as the right to opt out of the sale or sharing of personal information and the right not to be discriminated against for exercising those rights.

Carestamp does not sell personal information and does not share personal information for cross-context behavioral advertising. We therefore do not provide a “Do Not Sell or Share My Personal Information” link.

Carestamp may collect the categories of personal information described in Section 2 and use or disclose them for the business and commercial purposes described in Sections 3 and 4. We retain personal information as described in Section 7.

Carestamp is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 through the Services. If you believe a child has provided personal information directly to Carestamp without appropriate authorization, contact us at legal@mycarestamp.com. We will take appropriate steps to investigate and address the issue.

The Services may contain links to third-party websites or services. This Privacy Policy does not apply to those third parties. Their privacy practices are governed by their own policies, and we encourage you to review them before providing information.

Carestamp is operated from the United States. If you access the Services from outside the United States, you understand that your information may be processed and stored in the United States and other locations where Carestamp or its service providers operate. Those locations may have privacy laws that differ from those in your country.

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on https://mycarestamp.com and update the Effective Date above. Where required by law, we will provide additional notice or obtain consent. Your continued use of the Services after an updated Privacy Policy becomes effective means you acknowledge the updated policy to the extent permitted by law.

For questions, concerns, or privacy requests, contact:

Kavuma Technologies LLC.
316 New Boston St #1377
Woburn, MA

Email: legal@mycarestamp.com
Website: https://mycarestamp.com