What we hold, who sees it, and what we will not do with it

Who this covers, and who holds your record

Cairava provides software to hospitals. When a hospital uses Cairava to run a transition program, the hospital holds your medical record and Cairava handles information on its behalf under a written agreement. In the language of United States health-privacy law, the hospital is the covered entity and Cairava is its business associate.

This matters for a practical reason: rights you have over your health information — seeing it, correcting it, asking who it was disclosed to — are exercised through the hospital, not through us. If you ask us directly, we will pass the request to the hospital and tell you we have.

This policy also covers the cairava.com website, which anyone may visit without being in a program.

What we collect

• Information the hospital gives us about your discharge: your name, contact details, the plan, your medicines, and your follow-up appointments.
• What you tell the program: your check-in answers, your weight when you send it, and anything you write or say to your care team through Cairava.
• Records of messages: which messages were sent, when, whether they were delivered, and whether you replied.
• Basic technical information from the website and app, such as device type and pages visited.

If you fill in the request form on this website, we collect what you type into it — your name, your work email, your organisation, and your message.

Why we collect it

To run the program: to send you the right prompts at the right time, to show your care team what you reported, and to make sure something you raised reaches a person who can act on it. We also use information in aggregate to measure whether the program is working and to improve it.

Text messaging

Your mobile number and the fact that you opted in to text messages are used only to deliver this program. We do not sell them. We do not share them with third parties or affiliates for marketing purposes. No mobile opt-in information is shared with anyone for any purpose other than sending you the program's messages.

Text messages travel over the ordinary mobile network and are not encrypted end to end. Because of that, program messages are written to be brief and non-specific — a prompt asks you to check in; it does not restate your diagnosis or your medicines. Detail belongs behind a sign-in.

We use a messaging provider to deliver texts. That provider handles your number and message content under a written agreement that restricts what it may do with them. Your mobile carrier also handles the message, on its own terms.

The messaging program's own terms — frequency, HELP, STOP — are on the SMS page.

Who else sees it

• Your care team at the hospital. This is the point of the program.
• A caregiver you have named, and only the information you agreed they should receive.
• Service providers that host the software or deliver messages, under written agreements that limit them to working for us.
• Anyone the law requires, such as in response to a valid legal demand.

We do not sell personal information, and we do not use it for advertising.

Automated processing

Cairava uses software, including language models, to summarise what you wrote, to translate it, and to sort it for the care team. It does not diagnose you, does not decide what treatment you should have, and does not close a clinical concern. Rules approved by the hospital decide what gets escalated, and a licensed person makes the clinical decision.

How long we keep it

Health information is kept for as long as the hospital's agreement with us requires, and then returned or destroyed according to that agreement. Records of what happened in the program — that a message was sent, that a concern was raised and resolved — are kept as an audit trail and are not edited after the fact.

Information from the website request form is kept until it is no longer needed for the conversation you started.

How it is protected

• Information is encrypted when stored and when travelling between systems.
• Each part of the system receives only what its narrow role requires.
• Names, symptoms, medicines, measurements, appointments, free text, and documents are excluded from application logs.
• Access is limited to people who need it, and access to a patient record is itself recorded.

No system is perfectly secure, and we do not claim otherwise. Security controls for any particular hospital deployment are agreed with that hospital.

Children

The program is for adults. Cairava is not directed to children, and we do not knowingly collect information from anyone under 18 through this website.

Changes

If this policy changes in a way that matters, we will update the date at the top of this page and, where the change affects an active program, tell participants.

Contact

Write to privacy@cairava.com. If your question is about your medical record or your rights over it, your hospital is the right place to start, and we will help you get there.