Privacy Policy
Version 1. Published October 7, 2026
1. TWO ROLES, AND WHY IT MATTERS
We handle information in two different capacities, and different rules apply to each.
On our own behalf. When you search, create an account, or compare providers before you have a relationship with any of them, that information is ours to handle, and this policy governs it.
On behalf of a healthcare provider. Once you book, we handle information about your appointment on behalf of the provider you booked with. For that information we are a HIPAA business associate. The provider is the covered entity, our Business Associate Agreement with them governs, and their own notice of privacy practices applies. We are not a covered entity and we do not issue a notice of privacy practices.
2. WHAT WE COLLECT
2.1 Information you give us
• Account information: name, email, telephone number, date of birth, and password.
• Booking information: the service you are looking for, the provider, facility, and time you select, and answers to questions we ask before booking, including whether you are enrolled in a government healthcare program.
• Payment information: entered directly into our payment processor. We do not store card numbers.
• Anything you send us in a support message.
2.2 Information we collect automatically
• Device and browser information, IP address, and general location derived from it.
• How you use the Platform: pages viewed, searches run, and features used.
• Cookies and similar technologies. You can control these through your browser and through our cookie settings.
2.3 Information from others
• From providers: confirmation that an appointment occurred, and information needed to operate a booking.
• From public registries: NPPES, state licensing boards, and federal exclusion lists, about providers and clinicians, not about patients.
3. SENSITIVE INFORMATION
What you search for can reveal something about your health. We treat that as sensitive information. We use it to run your search and your booking, and to operate and secure the Platform. We do not use it for advertising, we do not sell it, and we do not share it for cross-context behavioral advertising.
4. HOW WE USE INFORMATION
• To operate the Platform and let you find providers, compare prices, and book.
• To pass your booking to the provider you selected and for billing.
• To send you notices about your bookings.
• To provide support, and to help provider organizations use the Platform.
• To keep the Platform secure and to detect fraud and abuse.
• To improve the Platform, using de-identified or aggregated data.
• To meet our legal, tax, and audit obligations.
We do not use your information to train machine learning models on identifiable data, and we do not sell your information.
5. WHAT WE SHARE
5.1 With the provider you book
Your name, contact details, type of service, and appointment details go to the provider you select, so they can furnish the care. Once you book, the provider handles that information under its own privacy obligations.
5.2 With our payment processor
Our payment processor receives a booking reference and payment details. It receives no health information. The charge is created on the provider’s account, and the provider is the merchant of record.
5.3 With our service providers
We use vendors for hosting, infrastructure, and monitoring. Those with access to health information are Aptible, Amazon Web Services, DataDog, Neon, OVH, and Zoho. Each is bound by written agreement, including a business associate agreement where required.
5.4 With our own staff
Our personnel may access information to operate the Platform and to support provider organizations. Access is role-based and limited to what the task requires, and it is logged. Where we work inside a provider’s account, we do so only with that organization’s approval, for a limited period, and the organization can see the access log and revoke access at any time.
5.5 When the law requires it
We may disclose information where required by law, subpoena, or court order, or to protect the rights, safety, or property of any person. Where we may lawfully tell you first, we will.
5.6 If our business changes hands
If Care Cadet is acquired or merges, or sells substantially all of its assets, information may transfer as part of that transaction. The acquirer remains bound by this policy for information collected under it, until it gives notice of a change.
5.7 What we never do
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not disclose one provider’s prices to another provider, and we do not provide price benchmarking between providers.
6. NOTIFICATIONS CONTAIN NO HEALTH INFORMATION
Our text messages and emails tell you that something has happened with a booking and ask you to sign in to see the detail. They do not name a service, a specialty, or a condition. Neither does the wording that appears on your card statement, which names the provider only. This is deliberate, so that a message on a lock screen or a line on a statement does not reveal anything about your care.
7. HOW LONG WE KEEP INFORMATION
We keep each kind of information for a set period, not indefinitely. Account information is kept for two years after you close your account. Booking and payment records are kept for seven years, because that is how long a dispute about one could be brought. Records of messages we sent you are kept for two years, and we keep that a message was sent rather than what it said. A review stays up until you delete it; after that we keep only a record that one existed, without the text, for three years.
Information we hold on a provider’s behalf is returned or deleted when our agreement with that provider ends, as the Business Associate Agreement requires.
Deleting means removing the record from our live systems and from backups on the next full backup cycle. We keep information longer only where the law requires it or where it is subject to a legal hold. A deleted record persists in our backups for no more than 90 days. Some logs that the law requires us to keep, for example records of who accessed health information, are kept for six years and are not removed on that cycle.
8. YOUR CHOICES AND RIGHTS
Depending on where you live, you may have the right to access the information we hold about you, correct it, delete it, obtain a portable copy, or object to certain processing. You may also ask us not to sell or share your information, though we do neither.
To make a request, email requests@carecadet.com. We will verify your identity before acting. We will not treat you differently for exercising a right.
Where we hold information on a provider’s behalf, a request about your medical record goes to that provider. We will help them respond.
9. IF YOU WRITE A REVIEW
A review you write is public. It is visible to anyone, including people who are not signed in, and search engines may index it. We publish the text you wrote and one label: "Confirmed booking" or "Completed appointment", with the month and year. We publish no name, no initials and no pseudonym.
A review still discloses that someone received care from that provider in that month, and if you write about your own care in the text, it discloses what you chose to write. That is your disclosure to make, and we ask you to confirm it specifically before we publish. Write only what you are content to have public.
We keep the surrounding detail to a minimum. No author name of any kind. No department, service or procedure alongside the review. Month and year rather than a date. This applies to every review, in every specialty, rather than depending on a list of which kinds of care are sensitive.
You can delete your review at any time, through the Platform or at requests@carecadet.com. Deleting it also deletes the provider’s reply. Reviews cannot be edited; to change one, delete it and write a new one.
Deleting removes the review from the Platform. We cannot recall copies that other people or search engines have already made. We keep a record that a review existed and was deleted, for our own audit purposes, without the text.
A provider may publish one reply. A reply is not permitted to confirm that you were a patient or to describe your care, and we remove any that does.
10. WHEN SOMEONE BOOKS FOR YOU, OR YOU BOOK FOR SOMEONE ELSE
If someone books an appointment for you because they have authority to act for you, we record who they are, what authority they told us they have, and when they told us. We pass that to the provider and we keep it as part of the booking record.
We do not decide whether a person is authorized to act for a patient, we do not assess capacity, and we do not review powers of attorney, healthcare directives, guardianship orders, or proof of parentage. The provider makes that determination. If the provider tells us a person is not, or is no longer, authorized, we act on that promptly.
Someone who books for you sees the booking they made. This is not ongoing access to your account or your history.
If a parent or guardian books for a young person using their own card, the charge appears on that card statement. The wording names the provider only, never a service type, specialty, procedure, or department. Some care is confidential to a young person under state law, and where it is, the provider decides what may be discussed with a parent.
11. SECURITY
We use administrative, physical, and technical safeguards appropriate to the information we hold, including encryption in transit and at rest, role-based access control, and access logging. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.
12. CHILDREN
You must be 18 or older to create an account. We do not knowingly collect information directly from children. An adult may book care for a child they are responsible for. If you believe a child has created an account, contact us and we will remove it.
13. STAFF OF PROVIDER ORGANIZATIONS
If you use the Platform as a member of a healthcare organization’s staff, we hold your name, work contact details, role, and activity in the account. We use that to operate the account, provide support, and keep records of who did what. Your organization controls your access.
14. CHANGES AND CONTACT
We may update this policy. We will post the new version with a new effective date, and we will notify you where the change is material.
Our primary mode of contact is email:support@carecadet.com. Privacy requests:privacy@carecadet.com.
Our mailing address is Care Cadet, Inc., 4989 S State St #572592, Salt Lake City, UT 84107.