CareNest Privacy Policy
Version 1, effective October 2026. We will notify customers of any changes.
1. Who we are and what this covers
CareNest LLC ("CareNest," "we") provides software that licensed residential care facilities use to manage resident records, medications, billing and state forms. This policy explains how we handle information in two roles:
- For our customers' data (residents, their families and facility staff), we act on behalf of the care facility. The facility decides what information is entered and why; we process it only to provide the Service. Where HIPAA applies, our Business Associate Agreement with the facility controls. Residents and families with questions about their records should contact the care facility first; we will help the facility respond.
- For our own business (people who visit mycarenest.app, sign up, or contact us), we decide how information is used, as described below.
We do not sell personal information, we do not share it for targeted advertising, and we do not use resident information for marketing.
2. Information we collect and how we use it
| Information | Examples | Why we use it |
|---|---|---|
| Account and staff information | Names, work emails, roles, login activity | Create accounts, control access, keep an audit trail of who did what |
| Resident information (entered by the facility) | Names, dates of birth, medications and doses, vitals, progress notes, photos, incident reports, emergency contacts, state forms | Provide the Service to the facility |
| Family and responsible-party information | Names, emails, signatures on forms sent by the facility | Deliver signature requests and invoices the facility sends |
| Billing information | Facility billing contact, subscription and payment status (card details are handled by our payment processor, not stored by us) | Charge for the Service |
| Technical information | Device and browser type, IP address, error logs | Keep the Service secure, prevent abuse, fix problems |
| Messages to us | Support requests, sales inquiries | Respond to you |
We use information only for these purposes, to comply with the law, and to protect the Service and the people whose information it holds.
3. AI features
Two optional features use artificial intelligence. They run only when a staff member starts them.
- Document scanning and auto-fill: staff upload a document (for example a physician's order or a hospital discharge form), and AI reads it to suggest values for CareNest forms. Staff review and confirm every value before it is saved.
- Translation: staff press Translate to translate text, such as a progress note, into another language.
For these features, the document or text is sent to our AI provider (Anthropic) only to produce the result. The provider's terms prohibit using it to train AI models, and the provider does not keep it longer than needed to process the request and meet its legal and safety obligations. AI results can contain errors; staff remain responsible for the final record.
4. Who we share information with
We share information only with service providers that help us run CareNest, under contracts that limit their use of it to providing services to us, and when the law requires.
| Provider | What it does for us | Information involved |
|---|---|---|
| Supabase | Database, file storage and sign-in | All Service data |
| Netlify | Hosts the website and app | Technical information |
| SendGrid and our sign-in email service | Send emails such as signature requests, invoices and password resets | Recipient names and emails, message content |
| Anthropic | AI scanning, auto-fill and translation | Only the documents or text a staff member submits |
| Stripe | Payment processing | Billing contact and payment details |
We may also disclose information if required by law, court order or a licensing agency; to protect someone's safety; or to a successor if CareNest is merged or sold, under the same protections. We do not sell personal information.
5. Security, retention and deletion
Security. We protect information with:
- encryption in transit (HTTPS) and at rest;
- separation between customers, so one facility cannot access another's data;
- role-based access, so staff see and change only what their role allows;
- an audit log of changes to records;
- private file storage that serves files only to authorized users;
- automatic sign-out after inactivity, and daily backups.
No system is perfectly secure. If we learn of a security incident affecting information we hold, we will notify the affected facility without unreasonable delay, and as required by law and any BAA, so it can meet its own obligations.
Retention. We keep customer data while the customer's subscription is active. After cancellation, the facility has 30 days to export it; we then delete it from the active Service, and from encrypted backups within 90 days, unless the law requires us to keep it longer. Facilities are responsible for keeping resident records for the periods California law requires. We keep our own business records (such as invoices) as long as needed for tax and legal purposes.
6. Your rights, cookies, changes and contact
Residents and families. Requests to see, correct or delete resident records should go to the care facility, which controls those records. If you contact us, we will forward your request to the facility.
California residents. For information we handle for our own business purposes, you may have the right under California law to know what we collect, request a copy, ask us to correct or delete it, and not be discriminated against for asking. Medical information protected under California's Confidentiality of Medical Information Act or HIPAA is handled under those laws instead. To make a request, email support@mycarenest.app; we will verify your identity before acting.
Cookies and browser storage. The app uses browser storage and cookies only to keep you signed in, remember settings such as your language, and keep the Service secure. We do not use advertising or cross-site tracking cookies.
Children. The Service is for businesses and is not directed to children. Residents' information is entered by facilities, not collected from residents directly.
Changes. We will post updates here with a new effective date and notify customers of material changes at least 30 days in advance.
Contact. CareNest LLC, 2100 Ball Road, Anaheim, California, support@mycarenest.app, (949) 994-2900.
Effective date: October 2026