CareCompanion is operated by BaneyGroup LLC. It helps adults organize health information, prepare questions and follow through after appointments. Access is currently by invitation; public enrollment is not open. Only features enabled for your account are available. Describing a connection here does not activate it or authorize access to your records.
CareCompanion is not an end-to-end-encrypted vault that only you can open. Authorized services and operators process information to run the service and provide support. We use signed-in account and care-space controls and encrypted network connections; no system guarantees perfect security. We do not claim HIPAA certification or that every supplier has signed a healthcare agreement.
What we receive and why
We receive account and session identifiers, name and email, access permissions, and technical information needed for sign-in, security and support. For features you use, we may receive records, selected photos/files, health history, questions, conversations, appointments, tasks, source identifiers and recorded choices. Information can include diagnoses, medicines, results, family or genetic history, reproductive or mental-health information, and insurance details. Explanations derived from it may also be health information.
Sources include you, authorized helpers, systems you connect, device permissions you grant, and requested app functions. Only provide information you are entitled to use. A connection or uploaded file may contain information about other people; permission to help one person is not permission to collect the entire family's records.
Family-history or genetic information can reveal health information about your relatives, even when their names are not included. Sharing it may affect their privacy as well as yours. Before you upload or share a record, consider who else it describes and whether you have authority to share that information.
We use this information to provide the requested care space, preserve sources, organize records, prepare questions, support authorized communication, track next steps and protect the service. Saving a document does not mean it has been analyzed or accepted as a medical instruction.
Our business restrictions
We do not sell or rent personal health data, use it for targeted advertising, independent research or training general-purpose AI models. This restriction also covers health information with names removed. Using a disclosed service to provide a requested answer or necessary service/security operation is different from training a general-purpose model on your information. A purchase does not grant access to another person's records.
Services and people involved
- Cloudflare: hosts the website/API, private database and files, background work and existing web email-code access. Saved records remain on the hosting service between visits; they do not stay only on your phone.
- Auth0/Okta and your sign-in provider: handle mobile identity and sessions. CareCompanion does not send your medical chart as sign-in profile data.
- OpenAI: receives selected record text/page images and relevant context for a requested AI review, and voice/conversation context for an authorized Clara call.
- Twilio: handles necessary numbers, audio/text content and service status for authorized calls/messages.
- Record sources and enabled intermediaries: handle the authorization and requests for a connection you choose. The connection identifies its source or intermediary.
- Expo and Apple or Google notification services: handle app/device registration identifiers, tokens and generic reminder delivery. The reminder payload contains no name, task title, care-space identifier or medical-record content; its identifiers can still reveal use of CareCompanion. Expo also builds/distributes apps; patient records are not authorized build inputs.
- Email services: handle the messages actually sent through them, including support correspondence. A separate Resend account-notice sender has been prepared but automated sending is off. It is not a medical-record inbox or permission for marketing.
- Apple, Google and RevenueCat, if purchases are enabled: handle purchase identifiers and subscription status, not medical charts. Card details belong in the payment provider's checkout, not care records.
- Authorized helpers, operators and recipients you select: receive information needed for their granted role, support or an export/share you initiate.
These services have their own terms and retention practices. Their presence in this list is not a claim that all integrations are active, every recipient acts only on our instructions, all information stays in the United States, or every copy disappears when a session ends. We must reconcile applicable provider requirements before enabling a new use; this notice does not waive those requirements or your rights.
Current database/file placement is Eastern North America. That does not establish the location of every recovery copy, log, provider operation or support session. We make no US-only residency guarantee.
The current native call path asks Twilio not to record audio, but live processing, conversation text/notes, status and provider retention are separate. OpenAI's standard abuse-monitoring retention may include submitted content for up to 30 days, with stated exceptions. Our optional OpenAI data-sharing settings are disabled; this is not a zero-retention promise.
Choices are separate
General agreement is separate from collection and feature permissions. Reading this notice, signing in or paying does not authorize a new record connection, AI review, call, helper invitation or outbound share. We ask about the health information you choose to supply or separately authorize for the core care-space service. Requested AI reviews name OpenAI; authorized calls name OpenAI and Twilio. You can decline a new action without that action deleting previously saved information.
Apple Health, where enabled, copies available records in the categories you allow from this iPhone to your private CareCompanion space, including contents and source identifiers. Opening or returning to the app can upload more available records while the connection remains on. Use Stop Apple Health retrieval to stop the connection; an uncertain server response is not confirmed success. Apple does not reveal individual read denials, so an empty result does not prove missing records or removed permission. Permission for the separate local-only sample check does not authorize this cloud transfer or continuing synchronization.
Epic/MyChart, where enabled, is one user-started retrieval run, not automatic ongoing sync. Choose the correct patient using your own portal account or proxy access granted by the provider. Family membership alone is not proxy authority. A temporary authorization code returns through CareCompanion's hosted callback; the phone exchanges it with the provider and uses the portal token in memory for that run. This connector does not persist that portal token or send it to our record-storage API. That does not promise immediate memory erasure, browser sign-out or removal of the provider's grant. Returned record contents, source identifiers and original responses are uploaded to Cloudflare-hosted storage for patient/source review. Stop gathering records stops the phone's run; Stop future retrieval separately closes the server-side connection when confirmed.
Neither connection's stop action erases uploaded copies or provider originals. Rejected or interrupted records may remain stored separately. Use Help and support for a scoped deletion request and the provider's portal to manage its separate grant. Patient/source review, filing, AI review and sharing are different actions. A saved page is not proof of a correct patient or complete history; a document reference may not include the underlying PDF or image.
Medicare's current connection is sandbox testing, not production Medicare access. Its user-started import can organize permitted identity, coverage and claims information and identify providers to ask for missing records. Claims are not a complete chart or proof of a current diagnosis. Never send a Medicare or portal password to support.
Phone reminders require your in-app choice and the phone's permission. Each reminder is separately scheduled, follows saved quiet hours and has a generic preview. Opening it requires sign-in and current task access. Turning reminders off stops eligible future sends but cannot recall messages already handed to delivery services. Delivery is not guaranteed; these are not emergency alerts or medication alarms. Email fallback is inactive; SMS is not a phone-reminder fallback.
Optional account-service email has a separate choice when available. It uses your verified sign-in address, not another person's care-space contact, and can be withdrawn without losing account access. A changed notice or observed sign-in email requires a matching new choice. Prepared sender notices@notify.baneygroup.com directs replies to brandon@baneygroup.com; it is not currently sending. Optional-email choices do not substitute for required privacy or incident notices.
Helper access lasts until removed, but revocation cannot recall downloads, printouts or forwarded copies. CareCompanion does not currently provide a comprehensive per-access report or notify you of every access. Request additional handling or recipient information through support.
Retention and deletion
We keep care records, saved conversation text and resources while the account is open unless deletion is requested. Stopping retrieval is not deletion. Our approved targets are active-system removal within 30 days of receiving a request, with prompt identity verification, and controlled-backup removal within 90 days of verification. Shorter applicable legal deadlines take priority. A request, checkbox or queued job is not proof of completion.
For copies under our control, the approved limits are 90 days for necessary non-content operational/security logs, 12 months after resolution for support correspondence, and 24 months after closure for minimal consent/deletion receipts. Actual cleanup must be verified. Provider-held copies, private exports and recovery copies need their own review; a dashboard log window does not prove complete erasure. Any restricted preservation exception needs a specific reason and review, not indefinite retention of everything. Deletions must be reapplied before restored information is used.
Our approved inactivity policy is a private keep-or-delete check-in after 12 months without recorded app activity, not automatic deletion. Its automated delivery is not active. Returning to the app resets the activity clock, not consent; declining optional email does not authorize email anyway or erase your history.
After 24 calendar months from completed deletion, verified active/backup cleanup and cleared holds, a returning person may deliberately start a new, empty account when registration is available. Fresh sign-in, current notice choices and explicit setup are required. No old records, memberships, connections or optional permissions are restored. A minimal security guard remains until it can be replaced safely by the new account's protection, so old sessions cannot reopen access. This is not a promise that every identifier disappears automatically after 24 months. Provider originals are separate and are not re-imported automatically.
Requests, incidents and changes
Email brandon@baneygroup.com, subject CareCompanion privacy request, for access, correction, recipient information, withdrawal, export or deletion. No new account is required. Use your account email when possible; do not attach records, passwords, codes or identity documents to the first message. We may arrange proportionate verification and a suitable private exchange. The app's selected structured-history export is not a complete export of every original or vendor record. We explain refusals and appeal options; use CareCompanion privacy appeal at the same address. Interface limits do not reduce applicable rights.
We will comply with the FTC Health Breach Notification Rule when applicable, including required notices to affected people, the FTC and, where required, the media. Unauthorized disclosure can require action even without a hack. Other applicable notice duties remain separate. Optional account-email permission is not a complete incident-notification system.
We will explain material changes before changed uses begin, identify the effective date and give the applicable choices to decline, stop affected features, export or request deletion. We will keep dated notices and obtain new permission where required; continued use alone is not permission for a new health-data purpose. Notices will appear in the app and use additional delivery where required. A company sale does not itself authorize repurposing health data. If Medicare production participation later requires CMS approval of notice changes, that approval must precede rollout.
Contact: BaneyGroup LLC — brandon@baneygroup.com. Support is not an emergency service.