Privacy Policy

1.We're here to help

You can contact us any time about how we handle your information, whether you want to ask a question, update or delete your details, opt out of marketing, or raise a concern. Email us at legal@carebrain.com and we'll take care of it.

2.About us and this policy

Carebrain, Inc. ("Carebrain," "we," "us," or "our") provides a clinical efficiency platform for post-acute care ("Platform", "App").

Our website at www.carebrain.com (the "Website") is a marketing and information site. To use our Platform, you download our App from the Website or from the Apple App Store or Google Play. This Privacy Policy applies to the Website, the App, and Carebrain Assistant, our extension for Google Chrome (the "Extension", described in section 8), and it does not govern:

• Protected health information (PHI). Any PHI in your consultation recordings, the notes our Platform generates, and the consultation details the Extension exports to your EHR is handled under the Business Associate Agreement (BAA) you sign when you download the App, together with HIPAA, not under this Privacy Policy.
• Enterprise customers. If your healthcare organization has signed a Master Services Agreement (MSA) and Service Level Agreement (SLA) with us, those agreements govern how we handle information for your organization ("Enterprise Plan").

In this policy, "you" means a Website visitor or an individual user of the App or the Extension.

3.What information do we collect?

• Information you give us: when you create an account or contact us, such as your name, email address, phone number, professional role and credentials, and anything you include in a message or demo request.
• Recordings and notes you create: when you use the platform, the App records and transcribes your consultations to generate clinical documentation. These recordings and notes may contain PHI, which we handle under your BAA (see section 2).
• Information collected automatically: your IP address, device and browser type, app activity and feature usage, log and diagnostic data, and general location from your IP address.
• Information the Extension handles: when you use the Extension, it accesses your Carebrain sign-in and account details, the consultations you export, and content of the EHR page you export to, as described in section 8.
• Cookies and analytics: collected on the Website, as described in section 7.

4.How do we use your information?

We use it to:

• create your account and provide the Platform and related features
• generate, store, and sync your clinical documentation
• respond to your questions, provide support, and send service messages
• send you marketing you've asked for (you can opt out any time)
• keep the App and Website secure and prevent misuse
• improve our products, using de-identified data
• comply with the law

We don't use PHI to send you marketing.

5.Marketing and how to opt out

We may send you marketing about our products where you've agreed to hear from us. You can opt out any time using the unsubscribe link in any email or by contacting us. We'll still send necessary service messages, such as replies to your questions or account and security notices.

6.Who do we share your information with?

We share your information only with:

• service providers who help us run Carebrain, such as cloud hosting, analytics, monitoring (Datadog), and AI processing providers, under contracts that require them to protect it
• your healthcare organization, if you use Carebrain through an enterprise plan
• authorities or others where required or permitted by law
• a successor, if our business is sold or transferred

We do not sell your personal information or PHI. Our handling of PHI, including with service providers, is governed by your BAA.

7.Cookies and analytics

We use cookies and analytics tools (such as Google Analytics) on the Website to see how it is used and to support our marketing. For the Extension, we use Datadog to find errors and measure performance, as described in section 8. You can control cookies in your browser. We honor the Global Privacy Control (GPC) signal. Because there is no common standard for “Do Not Track” signals, we do not respond to them.

8.Carebrain Assistant for Google Chrome

Carebrain Assistant (the "Extension") is a Google Chrome extension for medical providers whose organization uses Carebrain. It exports a provider's signed Carebrain consultations into their electronic health record (EHR), currently Aarista, as encounter drafts for the provider to review and sign. This section describes how the Extension handles information. The rest of this policy also applies, and PHI is handled under your BAA (see section 2).

What the Extension accesses

• Your Carebrain sign-in. The Extension receives it from the Carebrain web app (app.carebrain.com) while you are signed in there. It never asks for or sees your password.
• Your name, email address, organization and role in Carebrain.
• The consultations in your export queue: the patient's name, date of birth and gender, the facility, the date and type of visit, the chief complaint, the history of present illness, and the ICD-10 and CPT codes.
• Content of the EHR page you are working in: the patient's name, date of birth and facility shown on the page, and the EHR's notice about other encounters on the same date. The Extension uses these to confirm it has the right patient before it creates anything.
• The web addresses of your open tabs, only to find your Carebrain and EHR tabs. They are not stored or sent anywhere.
• How you use the Extension's side panel, as described under Datadog below.

How the Extension uses this information

Only to do its one job: show your export queue, create the encounter draft in your EHR with the note and codes filled in, check that it is the right patient, and mark the consultation exported in Carebrain, which sends it to billing. We also use diagnostic information to find errors and keep the Extension reliable.

Where the information goes

• Carebrain. The Extension loads your queue and consultation details from Carebrain's servers and tells Carebrain when a consultation has been exported. It does not send Carebrain anything it reads from your EHR.
• Your EHR. The Extension enters the note and codes into the EHR tab you opened, using your own EHR session. Your organization's agreement with the EHR vendor governs the data in your chart.
• Datadog. We use Datadog, a monitoring service, to find errors and measure the Extension's performance. Datadog receives error reports, timing data, the names of buttons you click, and recordings of the side panel in which all text, inputs and images are masked, so patient information does not appear in them. It also receives your Carebrain user ID, name, email address, organization and role, so we can help you when something goes wrong. Datadog keeps this information for 30 days, and we may extend this for individual sessions up to 15 months.

We do not sell information from the Extension, use it for advertising, or use it to determine creditworthiness or for lending. We do not transfer it to anyone except as described in this section, to comply with the law, or as part of a merger, acquisition or sale of assets.

What the Extension keeps on your computer

Your sign-in, your selected organization and the progress of the current export are kept in Chrome's session storage, which is held in memory and cleared when Chrome closes or you sign out. Consultation details are not written to your disk. Datadog keeps a random session identifier in the Extension's storage.

Who at Carebrain can see this information

Carebrain staff look at information from the Extension only with your permission, such as when you ask us for support, to keep the service secure, to comply with the law, or in aggregated and anonymized form for running the service.

Limited Use

The use of information received from Carebrain Assistant adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Your choices

You can sign out of the Extension at any time, or remove it from Chrome on the chrome://extensions page. Removing it deletes everything it kept on your computer.

9.What are your rights?

Depending on where you live, including California and other US states with privacy laws, you can ask us to access, correct, or delete your information, get a copy of it, or opt out of targeted advertising or any “sale” or “sharing” of it (we don't sell it). You can also withdraw consent or unsubscribe at any time.

To make a request, email legal@carebrain.com. We'll respond as the law requires and may need to verify your identity first. Your rights over PHI are governed by HIPAA and your BAA, and we'll help you exercise them.

10.How do we protect and keep your information?

We use administrative, technical, and physical safeguards, such as encryption in transit and at rest, access controls, and monitoring, to protect your information, though no method of transmission over the internet is completely secure. We keep your information for as long as your account is active or as needed for the purposes above and as the law requires. PHI is retained as set out in your BAA.

11.Children's privacy

Carebrain is intended for healthcare professionals and is not directed to anyone under 18. We do not knowingly collect information from children.

12.Changes to this policy

We may update this policy from time to time and will change the "Effective" date above. If the changes are significant, we'll post additional notice on the Website or in the App.

13.Contact us