Care Companion PRO

CARE COMPANION PRO PRIVACY POLICY

Effective Date: July 17, 2026 • Operated by Spatara AI

This Privacy Policy explains how Spatara AI collects, uses, discloses, and protects personal information in connection with the Care Companion PRO platform. Care Companion PRO exists to help families coordinate care for an aging loved one. That means the information in it is unusually personal: it concerns health, medication, daily life, family relationships, and, often, a person who is not the one typing. We have written this policy to say plainly what happens to that information.

This Privacy Policy also serves as our Consumer Health Data Privacy Policy for the purposes of the Washington My Health My Data Act, the Nevada consumer health data privacy law, and comparable state laws. Section 6 and Section 22 contain the disclosures those laws require.

Last updated: 17 July 2026 | Effective: 17 July 2026

1. Scope of This Policy

1.1 This Policy applies to personal information we process through www.carecompanionpro.com, the Care Companion PRO web platform, any Care Companion PRO mobile application we may release, and our related emails, notifications, and support communications (together, the "Service").

1.2 This Policy applies to information about: account holders and invited care team members ("you"); the aging individual who is the subject of a care profile (a "Loved One"); and any other person whose information a user chooses to enter, such as an emergency contact or a clinician.

1.3 This Policy does not apply to third party websites, applications, or services that we do not control, even where we link to them, and does not apply to the internal practices of any employer, health plan, or care organization through which you may have learned about the Service.

1.4 Capitalized terms not defined here have the meanings given in our Terms of Use. This Policy is incorporated into, and forms part of, our Terms of Use.

2. Who We Are and How to Contact Us

2.1 Spatara AI, a LLC organized under the laws of Florida and located at 8915 NE 9^th Ave Miami, FL, is the controller of the personal information described in this Policy, and is the "regulated entity", "controller", or "business" for the purposes of applicable state privacy laws.

2.2 You can reach us as follows:

Privacy and rights requests: support@carecompanionpro.com
Security matters, including suspected unauthorized access: support@carecompanionpro.com
General support: support@carecompanionpro.com
Postal mail: Spatara AI LLC, Attn: Privacy, 8915 NE 9th Ave, Miami, FL 33138

2.3 If you have a disability and need this Policy in an alternative accessible format, contact us at support@carecompanionpro.com and we will provide one at no charge.

3. Summary of Key Points

This summary is for orientation only. The full text of each Section controls.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not use consumer health data for advertising, and we do not permit our advertising or analytics vendors to receive it. See Section 14.
HIPAA does not apply to us. We are not a covered entity or, for the consumer plans, a business associate. We do not describe the Service as "HIPAA compliant". See Section 4.
Most of what you enter is consumer health data, including conditions, allergies, medications, care notes, documents, and wellness check-ins. We collect it only with your consent and only to provide the Service. See Section 6.
Your inputs to AI features are sent to third party AI model providers who process them on our behalf under contract. We do not use your personal information, and we do not permit those providers to use it, to train generative AI models. See Section 11.
Anyone you invite into a Care Circle can see the information in it. That disclosure is made by you, and we cannot undo it. See Section 13.2.
You can access, correct, delete, and export your information, regardless of the state you live in. See Section 20.
If your unsecured health information is breached, we will tell you, as the FTC Health Breach Notification Rule requires. See Section 19.

4. Our HIPAA Status: An Important Clarification

4.1 The Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA") do not apply to Care Companion PRO. HIPAA regulates health plans, health care clearinghouses, most health care providers, and their business associates. Spatara AI is none of those things. It is a consumer software company.

4.2 Consequently, information you enter into the Service is not "protected health information" under HIPAA, and HIPAA's rules, rights, and remedies do not attach to it. We do not claim to be "HIPAA compliant" and you should be sceptical of any consumer application that does.

4.3 This does not mean your information is unprotected. It is protected by:

the commitments we make in this Policy and in our Terms of Use, which are enforceable against us;
Section 5 of the Federal Trade Commission Act, which prohibits unfair or deceptive practices and under which our statements in this Policy are binding representations;
the FTC Health Breach Notification Rule, which applies to vendors of personal health records that are not covered by HIPAA and requires us to notify you and the Federal Trade Commission of a breach of unsecured identifiable health information, including an unauthorized disclosure and not only a security intrusion (see Section 19);
state consumer health data laws, including the Washington My Health My Data Act, the Nevada consumer health data privacy law, and the Connecticut Data Privacy Act (see Section 22); and
state comprehensive privacy laws, including the California Consumer Privacy Act (see Sections 21 and 23).

4.4 If a health care provider, health plan, or other covered entity wishes to use the Service in a capacity that would make us a business associate, that requires a separate written agreement with us. The consumer Subscription Plans are not offered on that basis. See Section 7.5 of our Terms of Use, and contact support@carecompanionpro.com.

5. Categories of Personal Information We Collect

5.1 Information you provide directly

Account and identifiers: name, email address, password (stored only in hashed form), account settings, and, if you provide it, a telephone number and profile photograph.
Loved One Profile information: the Loved One's name or preferred name, age or date of birth, conditions, allergies, care preferences, and other details a user chooses to record.
Medication information: medication names, schedules, and refill timing that users enter.
Appointments, tasks, and calendar entries: including the name and specialty of a clinician, the location of a visit, and its purpose.
Care Notes: free text observations and logs.
Documents: files that users upload, which commonly include discharge papers, insurance letters, and care instructions, and which may contain extensive information about a Loved One.
Family updates and messages: content shared among Members.
Emergency information: conditions, allergies, and emergency contacts compiled for the emergency information card.
Wellness check-ins: self-reported entries such as mood, sleep, and meals.
Community content: posts, comments, group memberships, and reactions, where you use community features.
Communications with us: support tickets, emails, and any information you choose to include in them.

5.2 Payment information. Payments are processed by our third party payment processor. We receive confirmation of payment, the subscription purchased, billing contact details, and limited card metadata such as the last four digits, card brand, and expiry. We do not receive or store your full payment card number.

5.3 Information collected automatically. See Section 8.

5.4 Sensitive information. Much of the above is sensitive personal information under state law and consumer health data under state consumer health data laws. See Section 6.

6. Consumer Health Data

6.1 What we treat as consumer health data

We treat the following as consumer health data, meaning personal information linked or reasonably linkable to a consumer that identifies their past, present, or future physical or mental health status:

conditions, diagnoses, symptoms, and allergies recorded in a Loved One Profile;
medications, medication schedules, and refill information;
appointments and tasks that reveal a health condition, a treatment, or a health care provider;
Care Notes and family updates that describe health, symptoms, treatment, or care needs;
the contents of uploaded documents such as discharge papers, care plans, and insurance correspondence;
emergency information card content;
wellness check-in entries, including mood, sleep, and meals; and
any inference we could draw from the above about a person's health status.

6.2 Purposes for collecting consumer health data

We collect consumer health data only for the following purposes, and for no other:

to display it back to you and to the Members you have invited, which is the core function of the Service;
to generate the reminders, calendar entries, and notifications you configure;
to produce AI-assisted summaries, suggested tasks, appointment preparation prompts, document organization, and draft family updates, at your instruction (see Section 11);
to store, back up, and secure it;
to provide support that you request; and
to comply with law and to establish, exercise, or defend legal claims.

6.3 Purposes for which we do not collect or use consumer health data

advertising or marketing of any kind, including targeted or interest-based advertising and audience building;
sale to any person, for any consideration;
training, fine-tuning, or improving any generative artificial intelligence model, whether ours or a third party's;
profiling in furtherance of decisions that produce legal or similarly significant effects; or
any secondary purpose that we have not disclosed to you and obtained your consent for.

6.4 Consent. We collect consumer health data only with your consent, given at the point of collection, freely and unambiguously, following disclosure of the purposes in Section 6.2. Consent is not a condition of using functions that do not need the data, and we do not obtain consent by means of any deceptive design. You may withdraw consent at any time by writing to support@carecompanionpro.com or by deleting the relevant data or your account. Withdrawal is prospective, and we will stop processing within a reasonable time. Withdrawal may make parts of the Service unusable.

6.5 We do not sell consumer health data. Under the Washington My Health My Data Act and the Nevada consumer health data privacy law, a "sale" is an exchange of consumer health data for monetary or other valuable consideration. We do not engage in any such exchange, and therefore we do not seek, and will not seek, the separate written authorization those laws require for a sale. If we ever intended to sell consumer health data, we would first obtain a signed, valid authorization that meets every statutory requirement, and you would be free to refuse.

6.6 No geofencing. We do not implement, and will not implement, a geofence around any health care facility, provider, pharmacy, or similar location for any purpose, including to identify or track consumers, to collect consumer health data, or to send notifications or advertisements relating to consumer health data.

6.7 Who can access consumer health data within our organization. Access is limited to personnel with a specific operational need, is granted on the principle of least privilege, is subject to authentication controls, and is logged. Our processors are bound by the restrictions in Section 15.

6.8 Your rights in consumer health data. See Sections 20 and 22.

7. Information You Provide About Other People

7.1 This Service is built around entering information about someone else. In most cases the Loved One is not the person using the Service, and may be unable, for reasons of health, to speak for themselves about their privacy.

7.2 We rely on you. When you enter information about a Loved One, an emergency contact, a clinician, or any other person, you represent to us that you have the authority to do so and that you have informed that person, or their legal representative, that their information will be stored by us, processed by our service providers, made visible to the Members you invite, and processed by AI features. Section 6 of our Terms of Use sets out these representations in full. We do not verify authority, and we cannot obtain consent from a Loved One on your behalf.

7.3 Please enter only what caregiving actually requires. Do not enter Social Security numbers, financial account or payment card numbers, government identification numbers, credentials for other services, or information about a person's life that has no bearing on their care.

7.4 Rights of Loved Ones and other third parties. A Loved One, or their legal representative, may contact support@carecompanionpro.com to exercise rights in relation to their information, including access, correction, and deletion. We will respond in accordance with applicable law. Because the Account Owner controls the Care Circle, we may need to contact them to give effect to a request, and doing so may reveal that a request was made. Where a request would require us to alter or delete another person's records, or where competing claims of authority exist, we may decline to act until the matter is resolved between the parties or by a court, and we will tell you why.

8. Information Collected Automatically

8.1 When you use the Service we automatically collect:

Device and connection data: IP address, browser type and version, operating system, device identifiers, language, and time zone.
Usage data: pages and features accessed, actions taken, timestamps, referring pages, session duration, and, at a feature level, the number of AI feature uses, in order to apply your plan allowance.
Security and diagnostic data: authentication events, error and crash logs, and records used to detect and prevent fraud and abuse.

8.2 Precise location. We do not collect precise geolocation data. We may infer an approximate region from an IP address for security and fraud prevention.

8.3 Cookies and similar technologies. See Section 16 and our Cookie Policy.

8.4 Analytics inside the authenticated product. Where we use analytics within the signed-in product, we configure it so that the content of Care Notes, documents, medications, check-in entries, and messages is not transmitted to the analytics provider. Analytics vendors act as our service providers or processors and are contractually prohibited from using the information for their own purposes.

8.5 No advertising or marketing trackers on health-related pages. We do not deploy advertising, marketing attribution, or social media pixels on authenticated pages of the Service, including any page relating to medications, care notes, documents, wellness check-ins, or AI features. This is a deliberate design decision. The Federal Trade Commission has treated the transmission of health information to advertising platforms through such trackers as an unauthorized disclosure and a breach under the Health Breach Notification Rule, and we do not do it.

8.6 Do Not Track and Global Privacy Control. Browsers send differing and non-standardized Do Not Track signals, and we do not respond to them. We do honour the Global Privacy Control and other recognized universal opt-out mechanisms as a valid opt out of sale and of sharing for cross-context behavioural advertising, where applicable law so provides. Because we do not sell or share, the practical effect is limited, but the signal is respected.

9. Information We Receive from Third Parties

9.1 From other users. If someone invites you to a Care Circle, we receive your name and email address or telephone number from them. If a Member records information about you, we receive it from them.

9.2 From our payment processor. Payment confirmations and the limited card metadata described in Section 5.2.

9.3 From service providers. Security, fraud prevention, deliverability, and infrastructure information from the vendors described in Section 15.

9.4 We do not purchase personal information from data brokers, we do not obtain personal information from social media platforms, and we do not enrich or append your profile with information acquired from third parties.

10. How We Use Personal Information

10.1 We use personal information for the following purposes:

To provide the Service: to create and maintain accounts and Care Circles, to display information to Members, to run reminders and notifications, to store documents, and to operate the features you use.
To operate AI features at your instruction: as described in Section 11.
To take payment: to process subscriptions, renewals, refunds, and to prevent payment fraud.
To communicate with you: to send transactional, administrative, security, and billing messages, and to respond to support requests. These are necessary to the Service and cannot be declined while you hold an account.
To secure the Service: to authenticate users, to detect and investigate fraud, abuse, and unauthorized access, and to enforce our Terms of Use and Community Guidelines.
To maintain and improve the Service: to diagnose faults, to understand which features are used, and to develop new features. We use aggregated or de-identified data for this wherever it is adequate, and we do not use the content of Care Notes, documents, medications, messages, or check-ins for product analytics.
To send marketing communications: only about our own services, only to account holders, and only in a manner consistent with law. Every marketing email contains an unsubscribe link, which we honour promptly. We never use consumer health data to target marketing, and we never build marketing audiences or segments from health information.
To comply with law and to protect rights: to meet legal and regulatory obligations, to respond to lawful requests, and to establish, exercise, or defend legal claims.

10.2 We do not use personal information to train generative artificial intelligence models. See Section 11.4.

10.3 We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, and we do not make any automated decision about you that has such an effect. The AI features generate text at your request; they do not make decisions about you, and no human or automated review of your information determines your access to anything.

11. AI Features and How Your Information Is Processed

11.1 What happens. When you invoke an AI feature, the input you select, which may include Care Notes, document text, medication and appointment details, and other Loved One information, is transmitted from our systems to a third party artificial intelligence model provider, which processes it and returns generated text to us, which we display to you. This transmission is necessary for the feature to function.

11.2 Contractual protections. Our AI model providers act as our service providers or processors. Our agreements with them require that they:

process the information only to provide the service to us, and for no purpose of their own;
not use the information to train, fine-tune, or improve any model;
not sell it, not share it, and not disclose it except as we direct or as law requires;
apply appropriate technical and organizational security measures;
retain it only for the period necessary and delete it thereafter; and
bind their own subcontractors to equivalent terms.

11.3 Retention by providers. Model providers may retain inputs and outputs for a limited period for abuse monitoring and to meet their legal obligations, after which they are deleted. We seek zero or minimal retention terms where they are available.

11.4 No training on your data. We do not use your personal information, your Care Notes, your documents, your messages, your wellness check-ins, or any Loved One's information to train, fine-tune, or develop any generative artificial intelligence model, and we do not permit our providers to do so. If we ever wished to change this, we would seek your separate, opt-in consent first, and refusing would not degrade your Service.

11.5 Human review. We do not routinely read AI inputs or outputs. Our personnel may access them only in narrow circumstances: where you ask us to for support, where it is strictly necessary to investigate a security incident or a credible report of abuse or unlawful use, or where law requires it. Such access is limited, logged, and role-restricted.

11.6 Your control. AI features are optional. You choose whether to invoke them and what to submit. If you would prefer that a note or document never be processed by a model provider, do not run an AI feature on it. Please do not enter into an AI feature anything you would not want processed under the terms described above.

11.7 Nature of the AI features. The AI features are organizational and communication aids only. They do not provide medical, legal, financial, or insurance advice, do not diagnose, do not recommend treatment, and do not provide therapy, counseling, or mental or behavioral health care. They are not companion or emotional support tools and are not designed to meet a user's social needs. Output is generated by software, not by a human, and may be inaccurate. It must be verified before it is relied on. Our AI and Health Disclaimer and Section 9 of our Terms of Use govern the AI features.

11.8 Wellness check-ins are not analysed. We do not score, interpret, evaluate, or detect emotional or mental state from wellness check-in entries, and we do not use them to draw conclusions about any person's mental health. They are stored and displayed as a personal log.

12. Consent and Authorizations

12.1 Consent to collect consumer health data. We obtain your consent, separately from your acceptance of our Terms of Use, before collecting consumer health data, having first disclosed the purposes in Section 6.2. Consent is freely given, specific, informed, and unambiguous, is not bundled with unrelated permissions, and is not obtained through any deceptive design pattern.

12.2 No authorization for sale. Because we do not sell consumer health data, we do not seek an authorization to sell. Section 6.5 applies.

12.3 Withdrawal. You may withdraw any consent at any time by writing to support@carecompanionpro.com, by changing the relevant setting where one is provided, or by deleting the data or your account. We will give effect to a withdrawal within a reasonable time and, in any event, within the time required by applicable law, and we will instruct our processors accordingly. Withdrawal does not affect processing carried out before it.

12.4 Marketing consent. Marketing communications are separate from consent to process consumer health data and can be declined without any effect on the Service.

13. How We Disclose Personal Information

13.1 We disclose personal information only as set out below.

13.2 To Members of your Care Circle. This is the most consequential disclosure and it is made by you, not by us. When you invite a person into a Care Circle, the information in it becomes visible to them at their permission level. We cannot retrieve information from a person who has already seen it, and we cannot control what they do with it. Invite carefully, assign the least access appropriate to the role, and remove Members whose involvement has ended.

13.3 To our service providers and processors, in the categories listed in Section 15, who act only on our documented instructions.

13.4 To community users, where you post in a community area. See Section 16 of our Terms of Use and our Community Guidelines. Do not post identifying details about a Loved One.

13.5 For legal reasons. We may disclose personal information where we reasonably believe it is required to comply with a law, regulation, subpoena, warrant, court order, or other lawful request from a public authority, or to establish, exercise, or defend legal claims. We take these seriously. Our practice is to require lawful process, to construe requests narrowly, to object to overbroad or improper demands, and, unless we are legally prohibited or there is an immediate risk to life, to notify you before disclosing your information so that you have an opportunity to object.

13.6 To protect people. We may disclose personal information where we believe in good faith that it is necessary to prevent imminent death or serious physical injury, or to detect and address fraud, security, or technical issues. This is not a monitoring commitment. We do not review Care Circle content and we will not detect an emergency. In an emergency, call 911.

13.7 In a corporate transaction. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or substantially all of our assets, personal information may be transferred, subject to the recipient being bound by commitments no less protective than those in this Policy, and subject to your rights under state law where applicable. We will notify you before any transfer that would result in materially different handling of your information, and will give you an opportunity to delete your account first.

13.8 We do not disclose personal information to advertisers, advertising networks, data brokers, or social media platforms.

14. No Sale; No Sharing for Cross-Context Behavioural Advertising

14.1 We do not sell personal information, and we have not sold personal information in the preceding twelve (12) months, as "sell" is defined in the California Consumer Privacy Act and comparable state laws, or in the Washington My Health My Data Act and the Nevada consumer health data privacy law.

14.2 We do not share personal information for cross-context behavioural advertising, and we have not done so in the preceding twelve (12) months, as "share" is defined in the California Consumer Privacy Act. We do not engage in targeted advertising as that term is defined in other state privacy laws.

14.3 We do not sell or share the personal information of minors, and we have no actual knowledge of selling or sharing the personal information of any consumer under sixteen (16) years of age. The Service is not directed to minors. See Section 24.

14.4 Because we neither sell nor share, there is nothing for you to opt out of in that respect. We nevertheless honour the Global Privacy Control, as described in Section 8.6, and we present the disclosures required by state law in Sections 21 to 23.

14.5 If we ever changed this position, we would update this Policy, give you advance notice, and, for consumer health data, obtain the separate signed authorization that state law requires before any sale. You would never be opted in by default.

15. Service Providers and Sub-Processors

15.1 We use the following categories of service providers, each of which processes personal information only as necessary to perform its function for us:

Cloud hosting, storage, and infrastructure providers, which host the Service and store your information.
Artificial intelligence model providers, which process AI feature inputs and return generated text. See Section 11.
Payment processing providers, which take payment and handle card data directly.
Communications providers, which deliver transactional email, notifications, and any text messages.
Product analytics and error monitoring providers, configured as described in Section 8.4.
Customer support tooling providers.
Security, fraud prevention, and bot mitigation providers.
Professional advisers, including lawyers, auditors, and insurers, where necessary.

15.2 Contractual requirements. Each provider is engaged under a written contract that: limits processing to our documented instructions and the specified business purpose; prohibits selling, sharing, retaining, or using the information for the provider's own purposes, including model training; requires appropriate security measures; requires deletion or return of the information at the end of the engagement; requires assistance with your rights requests and with breach notification; permits us to take reasonable and appropriate steps to confirm compliance; and requires equivalent terms to be imposed on any subcontractor.

15.3 Selection. We assess a provider's security posture, data handling terms, and, for consumer health data, its ability to meet the restrictions in Section 6 before we engage it.

15.4 Current list. A current list of the specific service providers that process personal information for the Service is available on request from support@carecompanionpro.com, and we will provide it free of charge.

16. Cookies and Similar Technologies

16.1 We use cookies and similar technologies that are strictly necessary to operate the Service, including for authentication, session management, load balancing, security, and remembering your preferences. These cannot be switched off without breaking the Service.

16.2 We may use limited analytics cookies to understand aggregate usage of our public marketing pages and to diagnose faults. Where consent is required by applicable law, we obtain it before setting non-essential cookies, and you can withdraw it at any time.

16.3 We do not use advertising cookies, retargeting tags, marketing attribution pixels, or social media trackers on authenticated pages of the Service. See Section 8.5.

16.4 Full details, including how to control cookies through your browser, are set out in our Cookie Policy.

17. Data Retention

17.1 We retain personal information only for as long as is reasonably necessary for the purposes for which it was collected, and no longer, applying the following criteria: the duration of your account; the operational need to keep a caregiving record usable over time; any legal, tax, accounting, or regulatory requirement; the need to resolve disputes, enforce our agreements, and defend legal claims; and security and fraud prevention needs.

17.2 Indicative periods:

Account, Care Circle, and content data: for as long as your account is active. On deletion of an item, we remove it from active systems promptly and in any event within 30 days.
Account deletion: on deletion of your account we delete or de-identify your personal information within 30 days, subject to the exceptions in Section 17.3.
Backups: deleted information may persist in encrypted backups until they are overwritten in the ordinary course, within 90 days. Restored backups are re-processed for deletion.
Billing and tax records: retained for the period required by law, which is typically 7 years.
Security and access logs: typically 12 months.
Support communications: typically 24 months after the matter is closed.

17.3 Exceptions. We may retain information for longer where required by law, where it is subject to a litigation hold or a regulatory or law enforcement request, or where necessary to establish, exercise, or defend a legal claim or to prevent fraud or abuse. We will retain only what is necessary for that purpose and will delete it when the purpose ends.

17.4 Shared content. Content you contributed to a Care Circle that is owned or controlled by another Account Owner, and content you posted in a community area, may remain in the Service after you leave or delete your account. We will de-identify your contributions where technically feasible on request.

17.5 De-identified and aggregated data. We may retain and use de-identified or aggregated data indefinitely. Where we do, we maintain it in de-identified form, do not attempt to reidentify it except to test the effectiveness of de-identification as permitted by law, and contractually prohibit reidentification by recipients.

18. Data Security

18.1 We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction, appropriate to the volume and sensitivity of the information and to the risk of harm.

18.2 Our measures include: encryption of data in transit using current TLS and encryption of data at rest; hashing of passwords using a modern algorithm; access control on the principle of least privilege, with role-based permissions, authentication requirements for personnel, and logging of access to production systems; network and application security controls; secure development practices and dependency management; logging and monitoring for anomalous activity; a documented incident response plan; background-appropriate personnel vetting and confidentiality obligations; regular review of our security posture; and contractual security requirements on our processors.

18.3 What you should do. Use a strong, unique password. Enable multi-factor authentication where we offer it. Sign out on shared devices. Invite Members carefully and at the least access appropriate. Tell us immediately at support@carecompanionpro.com if you suspect unauthorized access.

18.4 No system is perfectly secure. We cannot and do not guarantee that personal information will never be accessed, disclosed, altered, or destroyed in breach of our safeguards. What we can and do commit to is that we will maintain reasonable safeguards, that we will investigate promptly, and that we will tell you if a breach occurs. See Section 19.

19. Breach Notification

19.1 The FTC Health Breach Notification Rule applies to us, because the Service is a vendor of personal health records that is not covered by HIPAA. Under that Rule, a breach is not limited to a hacking incident: an unauthorized disclosure of your identifiable health information is itself a breach, whether or not it results from a security failure.

19.2 If a breach of security involving unsecured identifiable health information occurs, we will notify affected individuals without unreasonable delay and in no case later than sixty (60) calendar days after discovery, by email and, where required, by additional means. The notice will contain what the Rule requires, including the date of the breach and of its discovery, the categories of information involved, the identity of any third party that acquired the information where known, the steps we are taking, what you can do to protect yourself, and how to contact us.

19.3 We will notify the Federal Trade Commission. If the breach affects five hundred (500) or more individuals, we will do so at the same time as we notify individuals, promptly and in no case later than sixty (60) calendar days after discovery, and we will notify prominent media outlets where the Rule requires it. Breaches affecting fewer than five hundred individuals will be logged and reported to the Commission annually as the Rule requires.

19.4 We will also comply with every applicable state data breach notification law, and with our contractual obligations to notify any partner organization.

19.5 We will not delay notification in order to manage reputational consequences. If we are asked by law enforcement to delay, we will do so only to the extent and for the period that the law permits.

20. Your Privacy Rights

20.1 We extend the following rights to every user of the Service, regardless of the state in which you live and regardless of whether a law requires it. Where a state law gives you a right that is broader than the one below, that law controls and we will honour it.

Right to know and access: to confirm whether we process your personal information, and to obtain a copy of it, together with the categories collected, the sources, the purposes, and the categories of recipients.
Right to correct: to have inaccurate personal information corrected, taking into account the nature and purpose of the processing.
Right to delete: to have your personal information deleted, subject to the exceptions in Section 17.3 and to the limits in Section 20.5.
Right to data portability: to receive your personal information in a portable, readily usable, structured, and machine readable format, and, where technically feasible, to have it transmitted to another controller.
Right to withdraw consent: including consent to the processing of consumer health data, as described in Section 12.3.
Right to opt out of sale, sharing, targeted advertising, and profiling with legal or similarly significant effects: which we do not carry out in any event.
Right to limit the use of sensitive personal information: which we do not use beyond the purposes permitted by law and disclosed in Section 6.2 in any event.
Right against retaliation: we will not deny you the Service, charge you a different price, provide a different level of quality, or otherwise discriminate against you for exercising a privacy right. We do not operate financial incentive programs.

20.2 How to exercise your rights. Use the controls in your account settings where available, or write to support@carecompanionpro.com with the subject line "Privacy Request". You may also write to us at the postal address in Section 2.

20.3 Verification. To protect you, we will verify your identity before acting. Ordinarily we will do this by confirming control of the email address associated with the account, and, for sensitive requests, by asking for additional information matching what we already hold. We will not ask you for more information than is necessary, and any information you provide for verification will be used only for that purpose and then deleted. If we cannot verify you, we will tell you why.

20.4 Timing. We will acknowledge your request promptly and respond within forty-five (45) days. Where a request is complex or numerous, we may extend by a further forty-five (45) days and will tell you why within the initial period. Responses are free of charge, except that we may charge a reasonable fee or decline a request that is manifestly unfounded, excessive, or repetitive, and will explain our reasoning.

20.5 Limits on deletion. We may be unable to delete information where an exception in Section 17.3 applies, where the information belongs to a Care Circle controlled by another Account Owner, or where deletion would require us to alter another person's records. Where we decline a request in whole or in part, we will tell you which exception applies and will delete or restrict everything we can.

20.6 Authorized agents. You may use an authorized agent, who must provide written, signed permission from you or a valid power of attorney. We may contact you to confirm the authority and to verify your identity directly.

20.7 Appeals. If we decline a request, you may appeal by writing to support@carecompanionpro.com with the subject line "Privacy Appeal" within a reasonable period. We will review the appeal and respond in writing, with our reasons, within forty-five (45) days. If we deny the appeal, we will tell you how to complain to your state Attorney General. This appeal right is available to you regardless of your state of residence.

21. Additional Disclosures for California Residents

21.1 This Section supplements the rest of this Policy and applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

21.2 Categories collected in the preceding twelve (12) months. We have collected: identifiers (name, email address, telephone number, IP address, account identifiers); customer records information (billing contact details, limited payment card metadata); commercial information (subscription plan, transaction records); internet or other electronic network activity information (usage and device data); audio, electronic, or visual information (profile photographs and uploaded documents, where you provide them); inferences limited to product usage preferences; and sensitive personal information, being personal information concerning health, which encompasses conditions, allergies, medications, care notes, documents, emergency information, and wellness check-ins. We do not collect precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, biometric data for identification, sex life or sexual orientation data, the contents of mail, email, or text messages other than the messages you send within the Service, government identification numbers, or financial account log-in credentials.

21.3 Sources, purposes, and recipients. Sources are described in Sections 5, 8, and 9. Business and commercial purposes are described in Sections 6.2 and 10. Categories of recipients are described in Sections 13 and 15.

21.4 Sensitive personal information. We use and disclose sensitive personal information only for the purposes set out in Section 6.2, each of which is a purpose permitted by CCPA Section 1798.121(a) and its implementing regulations, namely to perform the services reasonably expected by an average consumer requesting them, to help ensure security and integrity, and for short-term transient use, and not to infer characteristics about any consumer. As a result, and under CCPA Section 1798.121, the right to limit the use and disclosure of sensitive personal information does not apply. Nevertheless, we honour a limitation request as though it did apply, to the extent doing so is compatible with providing the Service. You may make such a request at support@carecompanionpro.com.

21.5 Sale and sharing. We do not sell and do not share personal information, including sensitive personal information, and have not done so in the preceding twelve (12) months. We have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age.

21.6 Retention. See Section 17.

21.7 Your CCPA rights. Californians have the rights to know, access, delete, correct, opt out of sale and sharing, limit use of sensitive personal information, data portability, and non-retaliation, together with a right to appeal. All are provided in Section 20 and may be exercised as described there. You may designate an authorized agent in accordance with Section 20.6.

21.8 Shine the Light. California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

21.9 Notice of financial incentive. We do not offer any financial incentive or price or service difference in exchange for personal information.

22. Consumer Health Data Disclosures: Washington, Nevada, and Connecticut

22.1 This Section, together with Section 6, is our Consumer Health Data Privacy Policy for the purposes of the Washington My Health My Data Act ("MHMDA"), the Nevada consumer health data privacy law (Senate Bill 370), and the consumer health data provisions of the Connecticut Data Privacy Act. It applies to Washington and Nevada consumers, to Connecticut residents, and, as a matter of our own policy, to every user.

22.2 Categories of consumer health data collected and the sources. The categories are listed in Section 6.1. The sources are you, the Members of your Care Circle, and the documents you upload. We do not obtain consumer health data from data brokers, from health care providers, from health plans, or from any other third party source.

22.3 Purposes of collection and use. Set out exhaustively in Section 6.2. Excluded purposes are set out in Section 6.3.

22.4 Categories of consumer health data shared, and the categories of recipients. We disclose consumer health data only: (a) to the Members you invite into a Care Circle, at your direction; (b) to the processors listed in Section 15.1, being hosting and storage, artificial intelligence model, communications, security, and, where applicable, support providers, in each case bound by the restrictions in Section 15.2; and (c) as described in Sections 13.5, 13.6, and 13.7. We do not disclose consumer health data to any affiliate, advertiser, data broker, or other third party for that party's own purposes.

22.5 Sale. We do not sell consumer health data. See Section 6.5. We do not collect a signed authorization to sell because there is no sale to authorize.

22.6 Geofencing. We do not use geofencing, and Section 6.6 applies. MHMDA and the Nevada law prohibit implementing a geofence around an entity that provides in-person health care services in order to identify or track consumers, collect consumer health data, or send related notifications or advertisements. We do not do any of these things.

22.7 How we obtain and honour consent. See Sections 6.4 and 12.

22.8 Employees, contractors, and processors with access. Access within our organization is limited as described in Section 6.7. Processors are bound as described in Section 15.2.

22.9 Your rights under these laws. You have the right: to confirm whether we collect, share, or sell your consumer health data and to access it, including a list of all third parties and affiliates with whom we have shared or sold it and an active email address or other online mechanism for contacting them; to withdraw consent to its collection and sharing; and to have it deleted. To exercise these rights, write to support@carecompanionpro.com with the subject line "Consumer Health Data Request".

22.10 Deletion under MHMDA. On a valid deletion request we will delete the consumer health data from our records, including from all parts of our network, from archived and backup systems, and we will notify every affiliate, processor, contractor, and other third party with which we have shared it, instructing them to delete it as well. We will honour the request within thirty (30) days of receipt, and we will confirm to you when it is done. Where an exception under applicable law permits or requires retention of specific data, we will tell you which exception applies, retain only what that exception requires, and delete the rest.

22.11 Appeals. If we decline a request under this Section, you may appeal as described in Section 20.7. If your appeal is denied you may submit a complaint to the Washington State Attorney General at www.atg.wa.gov/file-complaint, to the Nevada Attorney General, or to the Connecticut Attorney General, as applicable to your residence.

22.12 Changes to this Section. We will not collect, use, or share additional categories of consumer health data, and will not collect, use, or share consumer health data for any purpose not disclosed in this Section, without first disclosing the new category or purpose and obtaining your affirmative consent.

22.13 Nevada. The Nevada consumer health data law is enforced by the Nevada Attorney General as a deceptive trade practice and does not contain a private right of action. That does not affect the rights we give you in this Section, which we honour in full.

23. Additional Disclosures for Other States

23.1 If you are a resident of a state with a comprehensive privacy law, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, or any other such state, you have the rights described in Section 20, exercisable in the manner described there. Where your state's law grants a right we have not listed, we will honour it.

23.2 Sensitive data. Health data is sensitive data under these laws and requires your consent before processing. We obtain that consent as described in Sections 6.4 and 12.

23.3 Targeted advertising, sale, and profiling. We do not process personal data for targeted advertising, do not sell personal data, and do not profile in furtherance of decisions producing legal or similarly significant effects. Accordingly, no opt out is necessary, but the mechanisms in Section 20 remain open to you.

23.4 Data protection assessments. We conduct and document data protection assessments for processing that presents a heightened risk of harm, including our processing of sensitive data, and make them available to a regulator on lawful request.

23.5 Universal opt-out mechanisms. We recognize the Global Privacy Control as described in Section 8.6.

23.6 Appeals. Every user has the appeal right in Section 20.7, and a right to complain to their state Attorney General.

23.7 Washington and Nevada consumers should read Section 22, which contains additional rights that apply to consumer health data specifically.

24. Children's Privacy

24.1 The Service is intended solely for adults aged eighteen (18) and over, is not directed to children, and we do not knowingly collect personal information from anyone under eighteen (18). We do not permit the registration of accounts by minors and we do not permit minors to be invited as Members.

24.2 We do not knowingly collect personal information from children under thirteen (13) within the meaning of the Children's Online Privacy Protection Act.

24.3 If we learn that we have collected personal information from a person under eighteen (18), we will delete it promptly and terminate any associated account. If you believe a minor has provided us with personal information, contact support@carecompanionpro.com and we will act without delay.

24.4 Because the Service is not directed to minors and we do not knowingly permit their use, we are not an operator of a companion chatbot platform serving known minors, and our AI features are not designed to meet a user's social or emotional needs. See Section 11.7 and our AI and Health Disclaimer.

25. Geographic Scope, Changes to This Policy, and Complaints

25.1 Geographic scope. The Service is offered to, and intended for, individuals located in the United States. Information we collect is processed and stored in the United States and may be accessed by our service providers there. If you access the Service from outside the United States, you do so on your own initiative and at your own risk, and you understand that your information will be processed in the United States, where privacy laws differ from those of your country. The Service is not offered to individuals in the European Economic Area, the United Kingdom, or Switzerland, and we do not target those markets.

25.2 Changes to this Policy. We may update this Policy. When we do, we will change the "Last updated" date at the top and post the revised Policy in the Service. If a change is material, we will notify you in advance by email or by a conspicuous in-Service notice before it takes effect, and we will describe what changed. We will not apply a material change retroactively to information already collected, and where a change would broaden the categories of consumer health data we collect or the purposes for which we use it, we will obtain your affirmative consent before it applies to you. Prior versions are available on request.

25.3 Complaints. If you are unhappy with how we have handled your information, please tell us first at support@carecompanionpro.com. We take complaints seriously and will investigate. You also have the right to complain to your state Attorney General, and to the Federal Trade Commission at www.ftc.gov. Complaining to us is not a condition of complaining to them.

25.4 Contact. Spatara AI LLC, Attn: Privacy, 8915 NE 9th Ave, Miami, FL 33138. Email support@carecompanionpro.com

Contact us

Questions about this page? Reach our team at support@carecompanionpro.com or write to Spatara AI, 8915 NE 9th Ave, Miami, FL 33138.