Privacy Policy

CareTogether, Inc. ("CareTogether," "we," "us," or "our") owns and operates the CareTogether platform, including the website, mobile applications, and AI-powered voice and messaging services (collectively, the "Services"). CareTogether is headquartered in the United States and our Services are intended for use within the United States.

For all privacy-related questions or to exercise your data rights, please contact us:

• Email: privacy@caretogether.ai
• General inquiries: info@caretogether.ai
• Website: https://caretogether.ai/contact

This Privacy Policy applies to all individuals whose personal information is processed in connection with the Services, including:

• Account holders who trial and purchase a CareTogether subscription
• Family members, caregivers, or other individuals who create or manage an account on behalf of a recipient ("Care Circle Members")
• Recipients: the older adults, individuals with medical conditions or disabilities, or others ("Seniors") who receive AI-powered calls and messages as well as care coordination through the Services
• Visitors to the CareTogether website

If you are a partner, white-label partner or enterprise client accessing CareTogether through a business agreement, your use is governed by your Master Services Agreement and any applicable Partner Addendum, which may supplement this Privacy Policy.

Information You Provide Directly

When you register for and use our Services, you may provide:

• Account information: name, email address, phone number, mailing address, and password
• Payment information: credit card or payment method details (processed by our third-party payment processor; CareTogether does not store full payment card numbers)
• Recipient profile information: name, age, phone number, time zone, language preferences, health conditions or symptoms, medical treatment instructions, appointment information, insurance details, advance directives, and prescription information
• Care Circle member information: names, phone numbers, and email addresses of family members, caregivers, or other individuals you authorize to access the account
• Communications: messages, notes, and other content you submit through the platform
• Customer support information: information you provide when contacting us for assistance

Information Generated During AI Voice or Messaging Conversations

When you or a Recipient participates in AI-powered voice calls and messaging, we collect and generate:

• Audio recordings of conversations
• Transcripts of conversations
• Messaging logs of exchanges
• AI-generated summaries and insights derived from conversation content
• Mood and assessments generated by analysis of conversation content
• Call metadata: date, time, duration, call initiator, phone type, and telephony source

Information Collected Automatically

When you use our website or applications, we automatically collect:

• Usage data: pages visited, features used, time spent, click patterns, and search queries
• Device and technical information: IP address, browser type, operating system, device identifiers, and geolocation (city and state level)
• Log data: server logs recording your interactions with our Services
• Cookies and similar technologies: see Section 1.4 below

Cookies and Tracking Technologies

We use cookies and similar tracking technologies (web beacons, pixel tags) to operate and improve our Services. Categories of cookies we use:

• Strictly necessary cookies: required for the Services to function. Cannot be disabled.
• Functional cookies: remember your preferences and settings.
• Analytics cookies: help us understand how users interact with the Services. We use Google Analytics and similar services.
• Third-party AI service cookies: our AI technology partners (see Section 4) may set cookies to operate their services within our platform.

You can manage cookie preferences through your browser settings. Note that disabling certain cookies may limit your ability to use some features. To learn more, visit www.allaboutcookies.org.

Some information we collect may be considered "sensitive personal information" under applicable privacy laws, including:

• Health and information shared during AI conversations or entered into your account
• Information about medical conditions, disabilities, or unique care needs
• Information about mental or emotional health derived from conversation analysis

We collect sensitive personal information only to the extent necessary to provide the Services and with your explicit consent, which you provide by enrolling in and using the Services. You may withdraw consent to collection of sensitive information at any time by contacting us at privacy@caretogether.ai. Note that withdrawal of consent for health-related data collection may limit our ability to provide certain Services features.

We do not sell sensitive personal information. We do not use sensitive personal information for advertising or marketing profiling.

We use your personal information for the following purposes:

To Provide and Operate the Services

• Authenticate your identity and manage your account
• Process your subscription payments
• Deliver AI-powered calls to Recipients
• Generate and share call summaries, insights, and alerts with authorized Care Circle members
• Facilitate communication and care coordination among Care Circle members
• Provide customer support and respond to your inquiries

To Improve and Develop the Services

While you are an active subscriber, we use your account information, conversation data (including audio recordings, transcripts, AI-generated wellness signals, alerts, and care insights), and usage information to:

• Analyze usage patterns to improve platform functionality and user experience
• Train, evaluate, and improve CareTogether's AI services: including refining wellness signal detection, improving Carey's conversational quality, reducing alerting errors, and developing new features that benefit you and future users
• Conduct internal research and quality assurance

When your account is closed, your data is retained, de-identified, or deleted as described in Section 7 (Data Retention). De-identified data, which cannot be linked back to you, may continue to be used for any lawful purpose, including health research, AI model improvement, and feature development.

We will not use your individually identifiable personal information to train third-party AI models without your separate, explicit consent.

To Communicate With You

• Send service-related notices (account confirmations, subscription renewals, policy updates)
• Send alerts and care notifications to Care Circle members
• Send marketing and promotional communications: only with your prior consent, and you may opt out at any time

Legal and Safety Purposes

• Comply with applicable laws and regulations
• Detect, prevent, and address fraud, abuse, and security incidents
• Establish, exercise, or defend legal claims
• Protect the safety of CareTogether users and the public

Text Messages (SMS)

Where you have provided a mobile phone number, you may receive text messages (SMS) from CareTogether. The types of SMS we send include:

• Account verification messages: one-time codes to verify your phone number when signing in or setting up your account.
• Consent and onboarding messages: text messages sent to Seniors to introduce Carey and request their consent before any wellness calls or check-in texts begin. Seniors must reply YES before Carey will contact them.
• Wellness alerts: notifications sent to Care Circle members when a Senior's wellness signals require attention. These messages include the Senior's first name and a brief description of the alert.
• Senior check-in messages: periodic wellness texts sent to Seniors as part of the check-in workflow. Seniors may reply to these messages and their response will be recorded.

By providing your phone number, you consent to receiving these messages. You may opt out at any time by replying STOP to any message you receive from CareTogether. Replying HELP returns information about the Service. Standard message and data rates may apply from your carrier.

SMS messages are delivered through a third-party SMS provider acting as a CareTogether service provider. Senior phone numbers and the contents of messages we send may be processed by this provider as needed to deliver your messages. We do not use your phone number for marketing without your separate, explicit opt-in consent.

CareTogether's Services are powered in part by artificial intelligence. Our AI voice companion and messaging is not a human being. AI-generated insights and summaries may not be complete or error-free. The AI does not provide medical advice or diagnosis.

CareTogether uses AI and large language model (LLM) technology to deliver AI-powered voice calls, generate conversation summaries and insights, personalize call content based on your preferences and prior conversations, and identify potential changes to alert Care Circle members.

Our AI capabilities are supported by third-party technology providers. We have contractual data processing agreements with each provider.

These providers process your data only as directed by CareTogether and are contractually prohibited from using your personal information for their own purposes, including to train their own AI models, except as required to provide their services to us.

If you have questions about how your data is used in AI features or wish to access or delete personal data used in AI-powered interactions, please contact privacy@caretogether.ai.

We process your personal information on the following legal bases:

• Contract performance: to provide the Services you have subscribed to and fulfill our contractual obligations to you.
• Your consent: for collection of sensitive health data, marketing communications, and certain AI features. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legitimate interests: to improve our Services, prevent fraud, ensure security, and manage our business: balanced against your privacy rights.
• Legal obligation: to comply with applicable laws, regulations, and legal process.

Care Circle Members You Authorize

You control who has access to your account. When you invite Seniors and Care Circle members, they will have access to call summaries, insights, alerts, and other account information as configured by you.

Technology Service Providers (Sub-Processors)

We share data with third-party service providers that process data on our behalf under written data processing agreements.

These providers may only use your data as directed by CareTogether and are prohibited from selling it or using it for their own purposes.

Third-Party Business Partners and White-Label Partners

If you access CareTogether through a third-party business partner or white-label partner (such as a senior living community, insurance provider, or care organization), we may share your account information, summaries, and alerts with that partner in accordance with your enrollment agreement with them. The partner's own privacy policy also applies to their use of your data.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our business, your personal information may be transferred to the successor entity. We will notify you via email and/or prominent notice on our website of any change in ownership and your choices regarding your data.

Legal Requirements and Safety

We may disclose your personal information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a legal request.

What We Do Not Do

CareTogether does not:

• Sell your personal information to third parties
• Share your personal information with advertisers or advertising networks
• Use your health data for targeted advertising
• Share individually identifiable information for third-party direct marketing without your opt-in consent

Carey is an artificial intelligence-powered companion driven by computing resources. As such, your conversations with Carey may be recorded, transcribed, and retained. You agree to this when you sign up for the Service and interact with Carey.

We retain personal information to fulfill the purposes for which it was collected, including providing the Services, complying with legal obligations, defending against legal claims, and preventing fraud. To determine the appropriate retention period, we may consider factors such as the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process the personal information and whether those purposes can be achieved through other means; and applicable legal requirements. When we no longer require the personal information we have collected about you, we may either delete it, de-identify it, or isolate it from further processing.

You may request deletion of your personal information at any time by emailing privacy@caretogether.ai. We will process verified deletion requests within 30 days, except where retention is legally required (such as payment records under tax and accounting laws).

CareTogether's information security program is voluntarily aligned with the HIPAA Security Rule. We implement technical, administrative, and physical-equivalent safeguards designed to protect your personal information against unauthorized access, use, disclosure, alteration, and destruction. Current security measures include:

• Encryption in transit: TLS 1.2 or higher for all data transmitted between your browser or device and our services
• Encryption at rest: Production databases, storage systems, and backups are encrypted using AES-256 with cloud-managed encryption keys, including customer-managed encryption keys (CMEK) for our most sensitive data stores
• Role-based access controls: Employee and contractor access to personal information is limited to those with a legitimate business need, scoped by role, and logged
• Network isolation: Production databases are accessible only via private network paths and are not exposed to the public internet
• Audit logging: Access to personal information is logged. Audit logs are retained in immutable storage for at least 6 years
• Sub-processor management: Sub-processors with access to personal information are required to maintain comparable security controls and are subject to ongoing review
• Workforce policies and training: We maintain written information-security policies. Workforce members handling personal information are required to acknowledge our policies and complete security training
• Periodic security assessments: Our security program includes periodic third-party assessments and ongoing internal reviews. Findings are reviewed and addressed as part of our continuous improvement process
• Breach Notification: In the event of a security incident affecting your personal information, we will notify you in accordance with applicable law: including the Federal Trade Commission's Health Breach Notification Rule (16 CFR Part 318), the Texas Medical Records Privacy Act, the Washington My Health My Data Act, and other applicable state breach notification statutes. We will provide notification to affected individuals within the timeframes required by these laws, generally within 60 days of confirming a breach.

No method of data transmission or storage is completely secure. While we take our security obligations seriously and continually invest in our security program, we cannot guarantee absolute security.

Depending on your state of residence, you may have the following rights regarding your personal information:

Rights Available to All Users

• Right to access: request a copy of the personal information we hold about you
• Right to correction: request that we correct inaccurate or incomplete information
• Right to deletion: request that we delete your personal information, subject to certain legal exceptions
• Right to data portability: receive your personal information in a structured, commonly used, machine-readable format
• Right to withdraw consent: withdraw consent for optional data processing at any time without affecting past processing
• Right to opt out of marketing: unsubscribe from marketing emails at any time using the link in any marketing email, or by contacting us

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: request disclosure of categories and specific pieces of personal information collected, sources, purposes, and third parties with whom we share information
• Right to delete: request deletion of personal information, subject to exceptions
• Right to correct: request correction of inaccurate personal information
• Right to opt out of sale or sharing: we do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information: request that we limit use of sensitive personal information (including health data) to what is necessary to provide the Services
• Right to non-discrimination: we will not discriminate against you for exercising your privacy rights

To submit a California privacy rights request, contact us at privacy@caretogether.ai. We will respond within 45 days.

Texas Residents (TDPSA)

Texas residents have rights under the Texas Data Privacy and Security Act (TDPSA) including rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of the sale of personal data or use for targeted advertising. To exercise these rights, contact privacy@caretogether.ai.

Other State Residents

Residents of Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws have similar rights. Contact us at privacy@caretogether.ai to exercise any data rights, and we will respond in accordance with the law applicable to your state.

How to Submit a Privacy Request

To exercise any of the above rights, contact us at privacy@caretogether.ai with your name, email address, and description of your request. We may need to verify your identity before processing your request. We will respond within 45 days (or the timeframe required by applicable law).

The Services are intended for adults aged 18 and older. We do not knowingly collect personal information from children under 18 years of age. If you believe that a minor has provided personal information through our Services, please contact us immediately at privacy@caretogether.ai. We will take prompt steps to delete such information from our records.

CareTogether is based in the United States, and your personal information is stored and processed in the United States. By using our Services, you consent to the transfer and processing of your personal information in the United States, where privacy laws may differ from those in your country of residence.

Our Services may contain links to or integrations with third-party websites, services, or applications. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access through our platform. CareTogether is not responsible for the privacy practices of third-party services.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make changes, we will update the "Last Updated" date at the top of this page. For material changes, we will provide additional notice via email or a prominent notice on our website at least 30 days before the change takes effect.

Your continued use of the Services after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms.