Privacy Policy

Introduction

CareBridge Connect LLC (“CareBridge,” “we,” “us,” or “our”) operates the CareBridge Connect platform available at carebridgeconnect.ai. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our platform and services.

CareBridge Connect is a B2B SaaS platform designed to support the privacy and security safeguards required by skilled nursing facilities (SNFs) while improving communication between care teams, residents, and their families. We take data privacy seriously and are committed to protecting all personal and health information entrusted to us.

Information We Collect

We collect the following categories of information in order to provide and improve our services:

• •Facility Information: Facility name, address, administrator contact details, NPI numbers, CMS certification information, and billing details.
• •Resident Information: Resident names, room assignments, admission dates, care status, and other information necessary to provide care updates to authorized family members.
• •Family Contact Information: Names, email addresses, phone numbers, and relationship to residents for authorized family members who are invited by the facility.
• •Care Log Data: Care notes, activity updates, wellness observations, meal and hydration tracking, vitals summaries, and other care-related entries created by facility staff.
• •Usage Analytics: Page views, feature usage patterns, device information, IP addresses, and browser type. This data is used in aggregate to improve our platform and is not linked to protected health information (PHI).

How We Use Information

We use the information we collect for the following purposes:

• •Providing the Service: Delivering approved care updates, managing resident timelines and authorized family access, and powering the family portal.
• •Sending Care Notifications: Delivering in-app notifications and generic email notices to the accountable Primary when an approved condition or appointment update is available.
• •Improving Our Product: Analyzing aggregate usage patterns to improve user experience, identify bugs, and develop new features that better serve facilities and families.
• •Billing and Account Management: Processing payments, managing subscriptions, and communicating with facility administrators about their accounts.

Text Messaging Information

We use mobile numbers, messaging preferences, consent records, message content, and delivery information to provide and support CareBridge texts. Messages and replies may contain health information, even when an update is brief. The care facility and providers involved in delivering, hosting, and supporting the service process the information needed for their roles, including messaging providers and mobile carriers.

We do not sell mobile numbers or SMS opt-in records, or share them with third parties or affiliates for marketing or promotional purposes. Opting into CareBridge texts does not enroll you in another organization's messaging program.

SMS is not end-to-end encrypted. Messages may be visible to others with access to your phone or notifications. Reply STOP to opt out or HELP for assistance. See our text messaging terms for program details.

For texting support, email carebridgeusa@gmail.com. Do not include health information in support email.

HIPAA Compliance

CareBridge Connect operates as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). Our platform is designed to handle Protected Health Information (PHI) in compliance with HIPAA Privacy, Security, and Breach Notification Rules.

We enter into a Business Associate Agreement (BAA) with every skilled nursing facility that uses our platform. The BAA defines how we may access, use, and safeguard PHI on behalf of the facility (the Covered Entity).

All PHI is processed and stored in accordance with the HIPAA minimum necessary standard. Access to PHI is restricted to authorized personnel and systems that require it to perform the contracted services. We maintain comprehensive audit logs of all PHI access events.

Data Sharing

We never sell your data. We do not sell, rent, or trade personal information or PHI to any third party for marketing or advertising purposes.

We use the following providers to operate the service. Text messages also pass through mobile carriers as described below:

• •Amazon Web Services (AWS): Our cloud infrastructure provider, hosting our application, database, and authentication systems. We operate under a signed AWS Business Associate Agreement (BAA), and AWS maintains SOC 2 Type II certification with data encrypted at rest and in transit.
• •Amazon Simple Email Service (SES): Our transactional email service, used to deliver care update notifications and account communications to authorized family members. SES operates within the same AWS environment and is covered under our AWS Business Associate Agreement.
• •AWS End User Messaging SMS and mobile carriers: Text delivery involves processing message content, phone numbers, and delivery information. Carrier transmission extends beyond our AWS environment and is not end-to-end encrypted.

Data Retention

We retain data in accordance with the HIPAA minimum necessary standard and applicable CMS (Centers for Medicare & Medicaid Services) requirements:

• •Protected Health Information (PHI): Retained for the duration of the facility’s active subscription and for a reasonable period thereafter to allow data export. PHI is permanently deleted upon verified request from the Covered Entity.
• •Audit Logs: Retained for a minimum of 7 years in compliance with CMS data retention requirements and HIPAA audit trail standards.
• •Account and Billing Data: Retained for the duration of the business relationship and as required by applicable tax and financial regulations.

Your Rights

You have the right to:

• •Access: Request a copy of the personal information we hold about you.
• •Correction: Request that we correct any inaccurate or incomplete personal information.
• •Deletion: Request that we delete your personal information, subject to applicable legal and regulatory retention requirements.

To exercise any of these rights, please contact us at privacy@carebridgeconnect.ai. We will respond to all verified requests within 30 days.

Security

We implement comprehensive technical and organizational measures to protect your information:

• •Encryption at Rest: All data is encrypted at rest using AES-256 encryption.
• •Encryption in Transit: Connections between your browser and our web application use TLS 1.2 or newer. This protection does not extend to carrier SMS transmission.
• •SOC 2 Type II Infrastructure: Our cloud infrastructure provider, Amazon Web Services (AWS), maintains SOC 2 Type II certification, ensuring rigorous controls over security, availability, and confidentiality.
• •Access Controls: Role-based access controls ensure that only authorized users can access specific data. All access to PHI is logged and auditable.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: