CariMed+1. Who is responsible
CariMed+ is operated by Dr. Kishron Richards. This policy covers the CariMed+ service available through carimedhealth.com and its native mobile clients.
Healthcare facilities decide which patient records and clinical information their teams enter into CariMed+ and who may access them. For those records, the responsible facility’s privacy notices, instructions and applicable obligations also apply. Questions about care or a patient record should first go to that facility. The service operator handles platform accounts, technical operation and support.
2. Information processed
- Account and access information: your name, email, invitation, facility memberships, roles and permissions; password verification data; passkey public credentials; and linked sign-in provider identifiers.
- Clinical and operational information: patient identifiers and contact details, medical history, encounters, notes, diagnostic requests and documents, medications, referrals, procedures, follow-up, scheduling, billing and other records entered by authorized facility users.
- Device and security information: device or installation identifiers, device names, browser and app details, session activity, network information and IP-derived security fingerprints, sign-in events and audit records.
- Preferences and support: theme and notification preferences, messages you send for support, and information you choose to provide while using enabled features.
The information processed depends on your role, the client you use and the features your facility enables. Passkey private keys and device biometric templates are managed by your device or credential provider; CariMed+ does not receive those secrets.
3. How information is used and shared
We process information to authenticate users, enforce facility permissions, provide requested clinical and administrative workflows, coordinate sessions and notifications, maintain audit trails, troubleshoot problems and protect the service.
Information is available to authorized members of the relevant facility according to their permissions. The operator and service providers may process information as needed for hosting, storage, network delivery, security, communications and support. Cloudflare provides network delivery and protection for our public domains. Sign-in providers process information when you choose their sign-in services. Optional cloud AI processing is described below.
Information may also be disclosed when required by applicable law or necessary to investigate abuse, protect safety or establish or defend legal rights. We do not sell personal or health information or use it for targeted advertising. Third-party providers have their own privacy policies. Processing locations depend on the infrastructure and providers used; contact us for information about arrangements relevant to your facility.
4. Google and other provider sign-in
If you choose Google sign-in, Google supplies an identity token containing your Google account identifier, email and verification claims. Basic profile information may also be provided through the sign-in process. CariMed+ uses this information to verify your identity, connect the provider to an existing CariMed+ account and maintain secure access. Provider sign-in does not itself grant access to a facility.
CariMed+ does not request access to your Gmail messages, Google Drive files, contacts or calendar for sign-in. Google sign-in information is not used for advertising, sold, or used to train general-purpose AI models. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements where applicable.
Apple and Microsoft sign-in similarly provide identity information used to authenticate and connect accounts. You can review connected methods in your account settings and, where supported, disconnect a method while retaining another working sign-in method. You can also revoke Google access through your Google Account connections. Revoking provider access does not by itself delete facility medical records.
5. Optional AI assistance and audio
Where enabled, AI assistance processes selected clinical context to prepare drafts. Local assistance uses the service’s configured local model runtime. Enhanced assistance can send permitted clinical context to the configured cloud provider, currently OpenAI, after the required in-product approval. Direct identity fields are excluded from the cloud drafting context, but free text can still contain identifying details. Do not enable cloud processing without the authority and approvals required by your facility.
Optional ambient recording requires patient consent and a visible recording action. Audio is sent to the internal speech service for transcription and discarded after transcription; a transcript can remain for correction, review and permitted drafting workflows. Clinicians must review drafts before applying them to clinical work. AI output does not independently finalize a record, order or care decision.
Personal cloud API credentials, if saved, are encrypted server-side and can be removed through the relevant settings. Third-party cloud processing is also subject to that provider’s terms and privacy practices.
6. Cookies, device storage and security
The browser uses session cookies and browser storage for sign-in continuity, device recognition, preferences and session-scoped recovery references. Native clients use platform-protected storage for session credentials. Clearing browser storage or reinstalling a client can remove local preferences and require sign-in again.
We use HTTPS, access controls, session revocation and audit mechanisms to protect access. Passwords are verified using password hashes. These safeguards reduce risk but cannot guarantee that every device, network or service is free from security incidents.
7. Retention
We retain information for the purposes described here, including service operation, security, audit, backup and applicable clinical or legal recordkeeping needs. Clinical records and their audit history may need to remain after an individual user leaves a facility or disconnects an account. Retention periods vary by data type and the responsible facility’s obligations; this policy does not set a single deletion period for all records.
Session and temporary authentication records have expiration controls. Backups and records retained for legal or security reasons may not disappear immediately when live data is removed. Contact the responsible facility or the operator for retention details and a request relating to your information.
8. Your choices and requests
You can review account details, passkeys, connected sign-in methods, devices, sessions and available preferences in your account settings. You can sign out, revoke supported sessions, adjust notifications and withdraw device permissions through system settings.
Depending on applicable law and the nature of the information, you may request access, correction, a copy, restriction or deletion, or raise an objection or concern. Contact us using the address below. We may need to verify your identity and coordinate with the responsible facility. Some requests may be limited by clinical recordkeeping, security, legal obligations or the rights of others. Do not send patient records, passwords or identity documents in an initial email.
9. Children’s information
CariMed+ accounts are intended for authorized healthcare personnel and facility users. Facilities may process children’s patient records as part of healthcare delivery. Requests concerning those records should go to the responsible healthcare facility or an authorized guardian’s established contact there.
10. Policy changes
Updates will be published on this page with a revised date. Material changes may also be communicated through the service or the contact information associated with your account.
11. Contact
Operator: Dr. Kishron Richards
Privacy and support: [email protected]
Service: CariMed+
For medical-record access, corrections or care questions, contact your healthcare facility. For platform-account and privacy questions, contact the service operator.