Privacy Policy

Care-Intel (“we”, “us”, “our”) operates care-intel.net and the related Care-Intel platform (the “Service”). This Privacy Policy explains how we collect, use, disclose and protect information about you when you use the Service.

1. Who We Are

Care-Intel is a healthcare intelligence platform that aggregates, normalises and delivers biomedical and clinical datasets, knowledge graph relationships, and AI-ready analytics to payers, providers, biopharma organisations, researchers, and AI developers. We are headquartered in the United States and operate under applicable U.S. and international privacy law.

2. Data We Collect

We collect the following categories of information:

• Account information: name, work email, organisation, job title, password hash.
• Usage data: pages visited, API calls made, datasets accessed, session identifiers, IP address, browser/device metadata.
• Payment data: billing address, last-four digits of card; full card details are processed directly by Stripe and never stored on our servers.
• Communications: demo requests, support messages, marketing opt-ins.
• Healthcare data on the platform: the platform processes de-identified, population-level clinical and claims data. We do not store individually identifiable protected health information (PHI) in end-user-facing systems.

3. How We Use Your Data

• Provide, operate and improve the Service.
• Process subscriptions and billing (via Stripe).
• Send transactional emails (account verification, invoice, alerts).
• Send marketing emails where you have opted in; you may opt out at any time.
• Comply with legal obligations and enforce our Terms of Service.
• Conduct analytics to improve product quality and user experience (aggregated/anonymised).

4. HIPAA & GDPR Compliance

HIPAA: Care-Intel applies Safe Harbor de-identification to any clinical dataset before it is ingested into the platform. PHI governance controls, minimum-necessary access policies, audit trails, and BAA-ready enterprise workflows are available for covered entities. Contact info@care-intel.net to request a BAA.

GDPR: If you are located in the European Economic Area, you have rights under the General Data Protection Regulation (see Your Rights below). Our legal basis for processing is: performance of a contract (account provision), legitimate interests (security, analytics), and consent (marketing communications).

5. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA/CPRA”), provides you with specific rights regarding your personal information. This section supplements the rest of this Privacy Policy and applies solely to California residents.

Categories of personal information we collect

In the preceding 12 months we may have collected the following categories of personal information (as defined by CCPA/CPRA), depending on how you interact with the Service:

• Identifiers (e.g., name, email address, account ID, IP address).
• Commercial information (e.g., subscription status, purchase history, demo or sales inquiries).
• Internet or other electronic network activity (e.g., browsing on our sites, API usage logs, device/browser metadata).
• Professional or employment-related information (e.g., organisation, job title).
• Inferences drawn from the above for product improvement and support (not for cross-context advertising profiles).

We do not knowingly collect “sensitive personal information” (as defined by CPRA) from consumers for the purpose of inferring characteristics about them. Platform healthcare datasets are de-identified / population-level and are not used as consumer personal information under CCPA/CPRA.

Business / commercial purposes

We use personal information for the business purposes described in How We Use Your Data, including providing the Service, security, billing, customer support, and limited analytics. We do not use or disclose sensitive personal information for purposes that require a right to limit under CPRA.

Sale and sharing

We do not sell personal information and we do not “share” personal information for cross-context behavioral advertising, as those terms are defined under CCPA/CPRA. We do not use third-party advertising cookies. Because we do not sell or share personal information in those senses, we do not currently offer a “Do Not Sell or Share My Personal Information” opt-out link; if our practices change, we will update this Policy and provide a compliant opt-out mechanism.

We may disclose personal information to service providers and contractors under written contracts that restrict their use to performing services for us (see Data Sharing & Transfers).

Your California rights

Subject to CCPA/CPRA exceptions and verification requirements, California residents may:

• Right to know / access: request the categories and specific pieces of personal information we collected about you, the sources, purposes, and categories of third parties to whom we disclosed it.
• Right to delete: request deletion of personal information we collected from you, subject to legal retention exceptions.
• Right to correct: request correction of inaccurate personal information we maintain about you.
• Right to opt out of sale / sharing: opt out of any sale or sharing of personal information (not applicable while we do not sell or share as defined above).
• Right to limit use of sensitive personal information: limit certain uses of sensitive personal information (not applicable while we do not use SPI for inferring characteristics).
• Right to non-discrimination: we will not discriminate against you for exercising CCPA/CPRA rights (e.g., by denying goods or services, or charging different prices, except as permitted by law).

How to submit a California privacy request

Email info@care-intel.net with the subject line “California Privacy Request” and describe the right you wish to exercise. You may also designate an authorized agent to submit a request on your behalf; we may require proof of authorization and will verify your identity before fulfilling requests. We will respond within the timeframes required by CCPA/CPRA (generally 45 days, extendable once by 45 days when reasonably necessary).

If you are a California resident and have an unresolved privacy concern that we have not addressed satisfactorily, you may contact the California Privacy Protection Agency or the California Attorney General for more information about your rights.

6. Data Sharing & Transfers

We do not sell your personal data and do not share it for cross-context behavioral advertising (see California Privacy Rights). We share data only with:

• Service providers: hosting/infrastructure providers, Stripe (payments), transactional email providers, and contracted data-delivery partners for enterprise clients under written agreements.
• Legal requirements: courts, regulators, law enforcement as required by law.
• Business transfers: in the event of a merger or acquisition, data may be transferred to the acquiring entity.

International transfers to the U.S. from the EEA are governed by Standard Contractual Clauses.

7. Cookies & Tracking

We use:

• Strictly necessary cookies: session authentication, CSRF protection.
• Analytics cookies: aggregated, anonymised visitor analytics (no cross-site tracking).

You can disable non-essential cookies in your browser settings. We do not use third-party advertising cookies.

8. Your Rights

Depending on your jurisdiction you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate data.
• Erasure: request deletion of your account and associated data.
• Portability: receive your data in a machine-readable format.
• Object / Restrict: object to or restrict processing for direct marketing or legitimate interests.
• Withdraw consent: unsubscribe from marketing emails at any time via the link in any email.

California residents have additional rights described in California Privacy Rights (CCPA / CPRA). To exercise any right, email info@care-intel.net. We will respond within applicable legal timeframes (generally within 30 days, or as required by CCPA/CPRA).

9. Security

We implement industry-standard safeguards including TLS encryption in transit, AES-256 encryption at rest, access controls, key rotation, audit logging, and penetration testing. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security but we take reasonable measures to protect your data.

10. Data Retention

Account data is retained for the duration of the subscription plus 90 days after closure. Audit logs are retained for 7 years for compliance purposes. You may request earlier deletion by contacting us.

11. Children’s Privacy

The Service is not directed to children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us immediately.

12. Contact Us

For privacy questions, data requests (including California CCPA/CPRA requests), or to report a concern:

• Email: info@care-intel.net
• Privacy requests subject: “California Privacy Request” or “Privacy Request”
• Phone: 301-744-0025

We may update this policy periodically. Material changes will be notified by email or a prominent notice on the site. Continued use of the Service after changes constitutes acceptance.