Privacy Policy

Account Information. When you register, we collect your name, email address, phone number, facility name and address, and payment information (processed securely by Stripe).

Resident Health Information. As part of providing the service, your facility enters protected health information (PHI) including resident names, dates of birth, medication records, physician information, diagnoses, and related clinical notes. We handle this information as a HIPAA Business Associate.

Uploaded Files. You may upload documents, photographs (including resident photos, prescription labels, and incoming fax images), and other files as part of your care records. These files are stored encrypted and associated with your facility's account.

Caregiver Portal Access. Your facility may share a Caregiver Portal link with care staff, who use it to record medication passes, vitals, notes and photos. Caregivers open the portal with a facility password you set and control, then sign in with a personal PIN; or you send a caregiver a one-time invite, and they choose their own PIN. We record the caregiver named on each entry, and session timestamps, for audit purposes. Beyond the name, initials and contact details your facility enters, we hold only what is described under Caregiver Mobile App and Time Clock below.

Caregiver Mobile App. The CareMAR app for iPhone, iPad and Android is the same Caregiver Portal. To run it, the app sends us an identifier for the installation, the device's make, model and operating system version (so your administrator can see and sign out each device), and a notification token from Apple or Google (so we can send alerts to that phone). Face ID and fingerprint unlock are handled entirely by the phone: we never receive a face, fingerprint or any biometric data, only a random key the phone releases after its own check. If the app fails, it sends us an error report (the error, the screen it happened on, the phone's web engine version and its network address). The app uses the camera and photo library only when a caregiver takes or chooses a photo, and it contains no advertising, analytics or tracking, and does not share data with data brokers.

Time Clock. If your facility uses the caregiver time clock, each clock-in, and each start or end of a meal break, takes one photo with the front camera, stored with the time record to show who punched. It is not used for face recognition. The time clock card tells caregivers this.

Fax Communications. Inbound faxes received on your facility's assigned fax number are stored in your account inbox. Outbound faxes sent through the platform are logged with timestamps, recipient numbers, and delivery status.

Usage Data. We automatically collect log data such as IP addresses, browser type, pages visited, and timestamps to operate and improve the service.

Support Communications. If you contact us for support, we retain records of that correspondence.

We use the information we collect to:

• Provide, operate, and maintain the CareMAR platform
• Process payments and manage your subscription
• Send and receive faxes on your facility's behalf using your assigned fax number
• Import medication and resident data via AI photo scan, email, or Excel/CSV upload at your direction
• Generate printable MAR reports and California compliance documents (e.g., LIC 622, LIC 603A, LIC 602A)
• Respond to your support requests
• Send service-related notices (e.g., subscription renewals, security alerts, CDSS regulatory updates)
• Comply with applicable laws and regulatory obligations

We do not sell, rent, or trade your personal information or resident PHI to third parties for marketing purposes.

CareMAR acts as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) with respect to PHI you enter into the platform. We implement administrative, physical, and technical safeguards designed to protect PHI as required by HIPAA's Security Rule.

We enter into a Business Associate Agreement (BAA) with every covered entity that uses the platform, at no additional cost. You review and sign it during signup, before your facility stores any protected health information, and a signed copy is available to download at any time from your account. To request a countersigned copy or a copy of the current terms, contact us at [email protected].

We share information with a small number of vetted service providers who assist us in operating the platform, under strict confidentiality obligations. They fall into these categories:

• Cloud hosting and data storage providers
• Communications providers, including fax and email
• Authentication and security providers
• Payment processors — card details go directly to the processor; CareMAR never stores them
• Document-processing and AI service providers

Service providers receive only the information reasonably necessary to perform their services. Providers that handle PHI on CareMAR's behalf are subject to applicable HIPAA contractual requirements, including Business Associate Agreements where required. CareMAR does not sell resident PHI or use resident PHI for advertising, and we do not use your resident data to train AI models — our AI providers are contractually barred from doing so.

Certain optional informational features — such as the Ask CareMAR (Title 22) regulations assistant — may use third-party AI services and are not designed or authorized for processing PHI. Ask regulatory questions in general terms — do not type resident names, dates of birth, or other identifying details into those features.

A current list of subprocessors that create, receive, maintain, or transmit PHI on our behalf — and whether written assurances are executed for each — is available to any customer facility on written request to [email protected].

We use industry-standard measures to protect your information, including encryption in transit and at rest, role-based access controls, audit logging, backups and recovery controls, personnel access restrictions, regular security reviews, and incident-response procedures. All uploaded files and resident data are stored encrypted with access restricted to your account.

Resident data and uploaded files are stored and processed entirely in the United States; no PHI leaves the country. Access to PHI in our systems is recorded in audit logs protected against alteration.

If you believe your account has been compromised, contact us immediately at [email protected].

We retain your account information and facility data for as long as your account is active. Resident records are retained as needed to provide the service and to comply with California's healthcare record-keeping requirements for licensed residential care facilities (typically a minimum of three years post-discharge under Title 22).

The platform maintains regular backups of your facility data for backup and restore purposes. Upon account termination, you may export a full ZIP archive of all records before deletion.

We retain your facility data for 14 days after account closure so you can view and export it, and we email the administrator on file during that window — beginning the day closure takes effect — with an export link and the scheduled deletion date. After 14 days your facility record and all associated resident data are permanently deleted, unless retention is required by law, subject to technically necessary backup retention. We do not hold PHI for facilities that are no longer customers beyond the time needed to return it.

Your facility remains responsible for retaining records it is legally required to keep (California Title 22 generally requires at least three years post-discharge). Export before your access ends.

Depending on your location, you may have rights including:

• Access to the personal information we hold about you
• Correction of inaccurate information
• Deletion of your personal information (subject to legal obligations)
• Portability of your data in a machine-readable format
• Objection to certain processing activities

To exercise these rights, contact us at [email protected].

We use essential cookies to maintain your session and authentication state within the platform. The marketing site (caremar.org) uses Google Analytics cookies to collect anonymized, aggregated traffic data. We do not use third-party advertising or retargeting cookies. You may disable cookies in your browser settings, but this may affect your ability to use the platform.

CareMAR is not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. The platform is intended solely for use by licensed care facility operators and their authorized staff.

California residents have the right under the California Consumer Privacy Act (CCPA) to request disclosure of the categories and specific pieces of personal information we have collected, the purposes for which it is used, and the categories of third parties with whom it is shared. California residents may also request deletion of their personal information, subject to certain exceptions.

To submit a CCPA data deletion request, use our online request form. You may also contact us at [email protected]. We will respond within 45 days.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform. Your continued use of CareMAR after changes take effect constitutes your acceptance of the revised policy. The "Last Updated" date at the top of this page reflects the most recent revision.

If you have questions about this Privacy Policy or our data practices, please contact us:

CareMAR LLC
A California limited liability company
Email: [email protected]
Website: caremar.org