Privacy Policy

This Privacy Policy explains how CareAIFlow ("CareAIFlow," "we," "us," or "our") handles information when you visit our marketing website, request a demo, or use the CareAIFlow / CareConnect AFH platform (the "Services").

CareAIFlow is built for Washington State Adult Family Homes (AFHs) and related care operations. Because the platform may process sensitive operational and resident-related information, we take privacy and security seriously. This Policy is informational and does not replace a signed customer agreement or any Business Associate Agreement that may apply.

This Policy applies to:

• Visitors to our public website (including contact and demo requests)
• Organization owners, administrators, and staff who use the platform
• Individuals whose information is entered into the platform by an AFH customer (for example, residents or contacts), where we act as a service provider to that customer

For resident and care data, the AFH customer is typically the controller of that information. CareAIFlow processes it to provide the Services they subscribe to.

Depending on how you interact with CareAIFlow, we may collect:

• Account & profile data: name, email, phone, role, organization details, authentication credentials (stored as secure hashes), and profile settings
• Organization & facility data: business name, facility details, license-related fields, capacity settings, and configuration preferences
• Operational & care data entered by customers: resident profiles, documents, forms, notes, medication records (where enabled), incidents, care plans, appointments, compliance items, and related uploads
• Billing data: subscription plan, invoices, and payment processing details handled through our payment provider (we do not store full card numbers on our servers)
• Communications: messages you send us, support requests, and transactional emails
• Technical data: IP address, device/browser information, approximate location derived from IP for security audit logs, and usage logs needed to operate and secure the Services
• Visitor / facility sign-in data (where a customer enables those features): visitor name and optional contact details

We use information to:

• Provide, maintain, and improve the Services
• Authenticate users and manage access by role and organization
• Process subscriptions and related billing
• Deliver product features such as document storage, forms, e-signature workflows, notifications, and AI-assisted document or form analysis where enabled
• Provide customer support and respond to inquiries
• Protect security, prevent abuse, and maintain audit trails
• Comply with law and enforce our Terms of Service

We do not sell personal information. We do not use resident care content for advertising.

Some CareAIFlow features use artificial intelligence or document analysis tools to help extract, structure, or draft operational content (for example, form assistance or care-plan document workflows). When those features are used, relevant document or form content may be processed by subprocessors solely to provide that functionality.

AI outputs can contain errors. Customers remain responsible for reviewing clinical, compliance, and operational accuracy before relying on any AI-assisted result.

We may share information with:

• Service providers / subprocessors that help us run the platform (for example: cloud hosting and file storage, email delivery, payment processing, e-signature providers, push notifications, and AI/document analysis vendors)
• Your organization's authorized users according to roles and permissions you configure
• Professional advisors or authorities when required by law, legal process, or to protect rights and safety
• Successors in connection with a merger, acquisition, or asset transfer, subject to appropriate protections

We require service providers to use information only to perform services for us and to protect it appropriately.

We use administrative, technical, and organizational measures designed to protect information, including access controls, encrypted transport, encrypted storage for files where configured, audit logging of sensitive access events, and multi-tenant separation by organization.

No method of transmission or storage is 100% secure. Customers should also protect their own accounts (strong passwords, careful staff access, and device security).

Marketing statements such as "HIPAA aligned" describe our design approach and should not be read as a certification or legal guarantee. Formal compliance obligations are addressed in customer agreements where applicable.

We retain information for as long as needed to provide the Services, meet legal/accounting requirements, resolve disputes, and enforce agreements. Customer-controlled care records are retained according to the customer's subscription and account status, subject to backup and legal hold requirements.

Account users can update certain profile information in the product. Organization admins control staff access and much of the data entered for their AFH.

If you are a resident or individual whose data was entered by an AFH customer, please contact that AFH first. We can assist the customer with access, correction, or deletion requests where appropriate and legally permitted.

Website visitors may contact us to update or delete demo-request information we hold about them, subject to legitimate retention needs.

Our marketing site and product may use cookies, local browser storage, or similar technologies for essential functions such as authentication sessions, security, and remembering preferences. The application typically stores access credentials in browser storage to keep you signed in.

We do not operate a separate advertising cookie program on the marketing site as of the effective date of this Policy. Third-party embeds or analytics, if added later, will be reflected in an updated Policy.

The Services are designed for AFH operators and professional users, not for children under 13 to use directly. We do not knowingly collect personal information from children under 13 through our marketing site.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the effective date. Material changes may also be communicated through the product or email where appropriate.

For privacy questions or requests, contact CareAIFlow through our Contact page and include "Privacy Request" in your message.

Related documents: Terms of Service · Compliance & Security