We care about privacy because our customers work with some of the most personal information there is. This policy explains, in plain language, what CareDots collects, why, who helps us, and the choices you have. Questions are always welcome at [email protected].
1. Who we are
CareDots (“CareDots,” “we” and “us”) provides a HIPAA-ready care-management platform for clinics. It includes NurseDot (for care teams), DoctorDot (for clinicians) and PatientDot (for patients), and the website at caredots.space. You can reach us at [email protected].
2. What this policy covers
This policy covers information we collect about visitors to our website, and about the people who create accounts and use our apps, such as clinic staff, clinicians and patients. It also covers how we handle information in the apps in general.
Customer Data and PHI are different. When a clinic uses CareDots, the clinic decides what patient and health information goes into the platform (“Customer Data,” which can include protected health information, or “PHI”). We process that information on the clinic’s behalf under a Business Associate Agreement. For that information, the clinic is the one responsible for the choices about it, and the clinic’s own privacy notice applies. If you are a patient and want to see, correct or delete your health information, please contact your clinic first. We will help the clinic respond.
3. What we collect
Information you give us
- Account information: your name, work email, role, organization, phone number, password or passkey, and settings.
- Demo and contact requests: your email address, and your team size and number of patients if you choose to give them.
- Billing information: billing contact and plan details. Card details are collected by our payment processor, not stored by us.
- Communications: messages you send us for support or feedback.
- Customer Data: whatever your clinic and its users put into the apps, which can include patient records, notes, recordings, transcripts, messages and device readings. See section 2.
Information collected as you use the apps
- Usage information: which features are used, and when, so we can run, support and improve the service.
- Device and log information: device type, browser, operating system, IP address, and error and security logs.
- Audit logs: a record of who did what in an account, for security and accountability.
Cookies and similar technologies
Our website does not use advertising or analytics tools, and does not set tracking cookies. It stores one small preference in your browser (your light or dark theme choice), which stays on your device. The website loads its typefaces from Google Fonts, so Google receives your IP address and browser details when a page loads, as it would for any site that does this.
Our apps use browser storage and similar technology only where needed to keep you signed in, protect your account, and remember your settings. Our apps do not use advertising cookies.
4. How we use information
- to provide, operate, secure and support the service;
- to create and manage accounts, and to bill for the service;
- to respond to demo requests, questions and support needs;
- to send service messages, such as secure notices, security alerts and changes to our terms;
- to understand how the service is used, fix problems and improve it;
- to detect, prevent and investigate fraud, abuse and security incidents;
- to meet our legal obligations and enforce our terms.
We do not sell personal information. We do not use PHI for advertising or marketing. We do not share it except with the service providers that help us run the service, as described below, or as the law requires.
5. AI processing
Parts of CareDots use AI, for example to draft notes from conversations, summarize records, flag patients for review and prepare messages. To do this, relevant information, which can include Customer Data, is sent to AI model providers that process it for us. We only send what is needed for the feature being used. We require our AI providers to protect that information and, for PHI, to do so under appropriate agreements, and we do not allow them to use it to train their general models. AI results are drafts: a person at the clinic reviews them and decides what to do. Some voice features may read only non-patient text aloud until the provider is covered by the right agreement.
6. Service providers
We use trusted companies to help us run CareDots. They may process information only for us, to provide their service, and under agreements that require them to protect it. For PHI, we use providers that agree to appropriate safeguards, and we limit what we send them. The kinds of providers we use are:
- Cloud hosting and databases, such as Railway and Cloudflare;
- AI model providers and AI voice and transcription services, such as Anthropic and Deepgram;
- Communications and telephony for calls, texts and push notifications, such as Twilio;
- Payment processing, such as Stripe;
- Email delivery, such as Resend. We use email for secure notices and do not put PHI in emails;
- File storage and monitoring, such as Cloudinary, plus search and similar tools that help the service work.
These examples may change. We may update our service providers from time to time, and when we do we will keep to the same standards. We may also share information when the law requires it, to protect people’s safety or rights, or as part of a merger, sale or reorganization of CareDots (with notice where required).
7. Data security
We protect information with encryption in transit and at rest, access controls that limit who can see what, and audit logs. We limit access to people who need it and review our practices as the product grows. No system is perfectly secure, and we cannot promise absolute security. If we learn of a breach that affects you, we will tell the affected customer as the law and our agreements require.
8. How long we keep information
We keep account and billing information for as long as the account is active and afterwards as needed for legal, tax, security and accounting reasons. Customer Data is kept for as long as the clinic uses CareDots. After the account ends, we make it available to the clinic for export for 30 days and then delete or de-identify it as described in the Business Associate Agreement, unless the law requires us to keep it. Backups expire on a fixed schedule. Website requests, such as demo requests, are kept as long as needed to follow up and to run our business.
9. Your choices and rights
You can ask us to access, correct or delete the personal information we hold about you, to give you a copy, or to stop using it in a way you no longer want. You can update most account details yourself in the app. Depending on where you live, including some US states, you may also have rights to know what we collect, to opt out of the sale or sharing of personal information (we do not sell it), and to not be treated unfairly for using these rights.
To use a right, write to [email protected]. We may need to confirm who you are. We will answer within the time the law requires. If you disagree with our answer, you may appeal by replying to us, and you may also contact your state attorney general. For PHI, rights are exercised through your clinic, as described in section 2. You can stop receiving non-essential emails by following the instructions in them; we may still send secure account and service notices.
10. Children
CareDots is not directed to children under 13, and we do not knowingly collect information from them in the product. Patients under 18 use PatientDot through a parent or guardian, as the clinic directs. If you believe a child under 13 has given us information, please tell us and we will delete it.
11. Where information is processed
CareDots is hosted in the United States, and information is processed there. If you use the service from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.
12. Changes to this policy
We may update this policy as the product and the law change. When we make an important change, we will tell you, for example by email or a notice in the service, and update the date at the top of this page.
13. Contact us
Questions, requests or concerns about privacy: [email protected]. For how we handle the service overall, please see our Terms of Service.