Privacy policy.

Careward, Inc ("Careward," "we," "us") operates the Careward post-visit patient follow-up platform at careward.co. Careward, Inc is incorporated in Delaware, United States. You can reach us at support@careward.co.

• Practice account data: name, work email, role, clinic name and location, billing contact.
• Patient episode data: first name, mobile number, procedure type, pathway day, check-in responses, and the messages exchanged with the patient companion.
• Contact form submissions: name, work email, practice, role, and message body.
• Usage data: page views, feature interactions, and aggregated product analytics. No advertising trackers.
• Cookies: session, preferences, and first-party analytics. See our Cookie Policy.

• Deliver the care pathway service to enrolled practices.
• Provide the patient companion experience over SMS and mobile web.
• Operate the escalation console and route flagged check-ins to clinical staff.
• Send transactional emails (account, billing, escalation notifications).
• Process billing through Stripe.
• Improve the product through aggregated usage analysis.

We process patient data as a service provider on behalf of the enrolled clinic. The clinic is the data controller for patient data. We do not use patient data for advertising, AI model training, or sharing with third parties outside the subprocessors listed below. A Business Associate Agreement (BAA) is available on request before any protected health information is processed — contact privacy@careward.co.

Careward does not use patient PHI for global model training. Patient identifiers are minimized before LLM processing where possible, and responses are constrained to the practice-approved pathway knowledge base.

Episode records and exports follow the retention settings in the practice agreement and applicable BAA. Practices may request export and deletion according to the agreement.

• Account data: retained for the life of the account, with a 60-day deletion period after cancellation.
• Episode data: retained for the life of the account and exportable on request.
• Contact form data: retained for 2 years or until you request deletion.

We share data with the following subprocessors to operate the service:

• Stripe — billing and subscription management.
• Twilio — SMS delivery to enrolled patients.
• Resend — transactional email delivery to practice users.
• Supabase — application database and authentication infrastructure.

We do not sell data. We do not share data with advertising platforms or data brokers.

Data is encrypted in transit (TLS) and at rest. Access to production data is role-based and limited to staff who require it. Significant data access events are recorded in audit logs, and we run regular internal security reviews.

You can request access, correction, deletion, export, restriction, or portability of personal data we hold about you. Reach us at privacy@careward.co and we will respond within 30 days.

We use a small number of first-party cookies to operate the product. See our Cookie Policy for details and how to manage your choices.

Careward is not intended for use by individuals under 18 years old. We do not knowingly collect data from children.

We notify account holders by email of any material changes to this policy at least 30 days before they take effect.

Privacy questions: privacy@careward.co.