This Healthcare Privacy Policy explains how CareFree Plus, Inc. collects, uses, stores, shares, and protects information when users access healthcare-related features, healthcare providers, medical professionals, wellness providers, healthcare bookings, or related services through our website, application, or platform. It supplements our general Privacy Policy and controls where the two policies conflict regarding healthcare-related information.
1. Our Role
The Platform may allow users to discover, communicate with, schedule, book, pay for, or receive services from independent healthcare professionals or healthcare organizations ("Healthcare Providers"). Unless expressly stated otherwise, CareFree Plus, Inc. is a technology platform and is not itself a hospital, medical practice, pharmacy, health plan, or healthcare provider. Healthcare Providers using the Platform may operate independently from us and are responsible for their own professional services, medical decisions, treatment, licensing, patient relationships, recordkeeping, and compliance obligations. A Healthcare Provider's own privacy practices may also apply to information collected directly by that provider.
2. Healthcare Information We May Collect
Depending on how you use the Platform, we may collect account information such as your name, email address, telephone number, date of birth, profile information, account identifiers, authentication information, and preferred language. We may also collect healthcare service information, including the requested service, appointment details, selected Healthcare Provider, symptoms or reason for an appointment, service preferences, accessibility requirements, appointment-form information, communications, and documents or images voluntarily uploaded through the Platform. We collect only information reasonably necessary for the applicable service.
3. Sensitive and Health Information
Some information submitted through healthcare features may qualify as sensitive personal information, consumer health data, health information, or protected health information under applicable law. We apply additional protections to healthcare-related information where required. We do not use sensitive healthcare information for unrelated advertising or sell such information for advertising purposes where prohibited by applicable law.
4. How We Use Healthcare Information
We may use healthcare-related information to provide Platform features, connect users with Healthcare Providers, process appointment requests, facilitate home healthcare visits, enable communications, process transactions, provide support, send notifications, verify identities, protect users and providers, detect fraud or unauthorized activity, maintain security, troubleshoot technical problems, comply with laws, respond to lawful requests, enforce our agreements, and maintain legally required records. We may also use aggregated or de-identified information for analytics, Platform improvement, safety, research, and operations where permitted by law.
5. Healthcare Providers
When a user requests services from a Healthcare Provider, we may share information reasonably necessary to fulfill that request, including the user's name, contact information, appointment information, service location, submitted request information, relevant communications, and other information needed for the provider to perform the requested service. Healthcare Providers may have independent legal obligations regarding patient privacy, medical records, professional confidentiality, and health information.
6. HIPAA and Protected Health Information
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) applies only when the applicable organization and information fall within its scope. Not all healthcare-related information collected through a consumer application or marketplace is Protected Health Information (PHI). If CareFree Plus, Inc. receives, creates, maintains, or transmits PHI while acting as a Business Associate of a HIPAA Covered Entity, we will handle that PHI in accordance with applicable HIPAA requirements and any applicable Business Associate Agreement. Where HIPAA applies, PHI will only be used or disclosed as permitted by law and the applicable agreement.
7. Consumer Health Data
Certain U.S. states and other jurisdictions provide additional protections for information concerning physical or mental health, healthcare services, diagnoses, treatments, medications, reproductive or sexual health, biometric information, precise location related to healthcare services, or other information that may reveal health status. Where applicable, we process such information in accordance with relevant consumer health privacy laws. Depending on applicable law, users may have rights to confirm collection or processing, access, deletion, correction, withdrawal of consent, information about disclosures, copies of information, and appeals of privacy decisions.
8. We Do Not Sell Healthcare Information
We do not sell personally identifiable healthcare information for monetary consideration. We also do not sell or share consumer health data for targeted advertising where prohibited by applicable law. If our practices materially change, we will provide notice or obtain consent required by applicable law.
9. Advertising and Tracking Technologies
We recognize that healthcare-related browsing and activity may reveal sensitive information. We seek to limit transmission of sensitive healthcare information to advertising platforms and technologies. Healthcare information submitted through private appointment forms, private communications, medical intake processes, or similar interactions should not be used for behavioral advertising except where expressly permitted by law and accompanied by required authorization or consent. We may use analytics, security, fraud-prevention, and operational technologies necessary to operate and improve the Platform.
10. Artificial Intelligence and Automated Systems
Where the Platform uses artificial intelligence or automated systems, they may assist with service routing, provider matching, scheduling, translation, customer support, fraud detection, document processing, or information organization. Unless expressly disclosed otherwise, these systems are not substitutes for licensed medical professionals and do not independently diagnose, prescribe, or provide medical treatment. We will not knowingly use sensitive healthcare information to train general-purpose artificial intelligence models where prohibited by applicable law or inconsistent with commitments made to users.
11. Communications
The Platform may facilitate in-app messages, appointment confirmations, SMS messages, email, telephone communications, service updates, and provider arrival notifications. Users should avoid including unnecessary sensitive medical information in ordinary SMS messages, emails, customer-support communications, or channels not specifically designated for sensitive healthcare information.
12. Emergency Situations
The Platform is not an emergency medical service unless a specific feature is expressly identified as such. If you believe you are experiencing a medical emergency, contact emergency services available in your location immediately. Do not rely on the Platform, messaging system, appointment booking feature, or provider response time for emergency assistance.
13. Information Sharing
We may disclose information to Healthcare Providers to fulfill requested services; service providers assisting with cloud hosting, payment processing, communications, security, identity verification, support, analytics, fraud prevention, or infrastructure; and authorities or other parties when reasonably necessary to comply with law, respond to lawful requests, protect users, prevent fraud, investigate abuse, protect legal rights, protect safety, or respond to emergencies. Information may also be transferred as part of a merger, acquisition, financing, restructuring, asset sale, bankruptcy, or similar corporate transaction, subject to applicable privacy requirements.
14. Data Minimization
We seek to collect healthcare information only when reasonably necessary for the relevant service, legal obligation, safety requirement, or Platform functionality. Healthcare Providers are encouraged to request only information reasonably necessary for the service being provided.
15. Data Retention
We retain personal and healthcare-related information only as reasonably necessary for providing services, maintaining transaction records, handling disputes, fraud prevention, security, regulatory obligations, tax and accounting requirements, contract enforcement, and legal claims. Retention periods vary by information type, jurisdiction, applicable law, and the relationship between the user and Healthcare Provider. Providers may independently maintain medical or patient records under their professional and legal obligations.
16. Security
We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, loss, alteration, misuse, and destruction. Safeguards may include encryption in transit and at rest, access controls, authentication, role-based permissions, logging, monitoring, security testing, restricted employee access, and incident-response procedures. No electronic system can guarantee absolute security.
17. Data Breach Notification
If we discover a breach involving healthcare-related information, we will investigate and provide notifications to affected individuals, regulators, Healthcare Providers, or other parties when required by applicable law. Requirements may differ depending on whether information is subject to HIPAA, the FTC Health Breach Notification Rule, state consumer health laws, general data-breach laws, or another regulatory framework.
18. Children's Information
Healthcare services involving minors may require additional authorization from a parent, guardian, or other legally authorized representative. We handle information concerning minors in accordance with applicable laws. Healthcare Providers are responsible for determining whether parental or guardian consent is required for services they provide.
19. Your Privacy Rights
Depending on where you live and which laws apply, you may request access to personal information, correction of inaccurate information, deletion, a portable copy of certain information, restriction of certain processing, withdrawal of consent, information regarding disclosures, or an appeal of a denied privacy request. Some information may not be deleted when retention is required by law, necessary to complete a transaction, needed for safety or security, required to resolve disputes, or otherwise legally permitted.
20. HIPAA Patient Rights
When information is subject to HIPAA, individuals may have rights through the applicable Covered Entity relating to access to PHI, copies, amendment, restrictions on certain uses or disclosures, confidential communications, and accounting of certain disclosures. If an independent Healthcare Provider provided the service, requests concerning medical records may need to be submitted directly to that provider.
21. International Users
If information is transferred across national borders, we will use safeguards required by applicable law. Privacy rights and healthcare privacy requirements differ between jurisdictions. Users outside the United States may have additional rights under the laws of their country or region.
22. Third-Party Services
Healthcare Providers or Platform pages may contain links to third-party websites, laboratories, pharmacies, insurers, payment processors, or other services. Those organizations may collect information independently from us, governed by their own privacy policies and legal obligations. We encourage users to review those policies before providing sensitive information.
23. Changes to This Healthcare Privacy Policy
We may update this Healthcare Privacy Policy periodically. When material changes are made, we will update the Last Updated date and provide additional notice when required by applicable law. Where a change requires consent, we will request that consent before applying it to information covered by that requirement.
24. Contact Us
Questions or requests concerning healthcare privacy may be submitted to CareFree Plus, Inc., Privacy Team, at info@carefree-consulting.com. CareFree Plus, Inc. does not list a public mailing address for privacy requests; email is the preferred contact method. For healthcare records maintained by an independent Healthcare Provider, users may need to contact that provider directly.
25. Privacy Requests
To exercise applicable privacy rights, contact info@carefree-consulting.com with the subject line “Privacy Request.” We may need to verify your identity before completing a request. Authorized agents may submit requests where permitted by applicable law, subject to reasonable verification requirements.
26. Regulatory Complaints
Depending on the law applicable to your information, you may have the right to submit a privacy complaint to an appropriate governmental or regulatory authority. Submitting a privacy complaint will not affect your ability to use the Platform or receive healthcare services, except where information is necessary to provide the requested service.
Important: This Healthcare Privacy Policy describes privacy and data-handling practices. It does not create a doctor-patient relationship between CareFree Plus, Inc. and users of the Platform, and it does not represent that every healthcare-related service or piece of information on the Platform is governed by HIPAA.