CareFlow Technologies — Privacy Policy
Effective Date: August 7, 2026 Last Updated: August 7, 2026
1. Introduction
CareFlow Technologies ("CareFlow," "we," "us," or "our") operates the CareFlow Training platform. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what choices are available.
This policy covers app.careflowtraining.com and related services.
Two kinds of people use CareFlow, and this matters for privacy:
- Agency customers — home care agencies that purchase and administer the Service
- Individuals — caregivers, employees, and job applicants whose records are entered into the Service by an agency
For individual records, the agency is the controller of that data and CareFlow is a service provider acting on the agency's instructions. If you are a caregiver or applicant with a question about your records, contact your agency first. See Section 9.
2. Information We Collect
2.1 Information agencies provide about themselves
- Agency name, business contact name, email address, phone number
- Billing contact information
- Plan selection, add-ons, and account configuration
- Support correspondence
2.2 Information agencies provide about individuals
Depending on the products an agency uses, the Service may store:
Caregiver and employee records
- Name, email address, phone number, mailing address
- Employment dates, role, and status
- Training assignments, progress, assessment results, and certificates
- Continuing education hours
Applicant records (CareFlow Plus)
- Application responses and contact information
- Pre-employment assessment results
- Background check authorization forms (CareFlow collects the authorization; background screening itself is performed by the agency or its vendor)
- Offer letters and acceptance status
- Orientation scheduling and attendance
Sensitive employment documentation (CareFlow Plus)
- Social Security numbers
- Form I-9 employment eligibility information, including date of birth and identity document details
- Form W-4 tax withholding information
- Employee health assessment responses
- Direct deposit information
We treat these categories as sensitive and apply additional protections. See Section 5.
2.3 Information we collect automatically
- Log data: IP address, browser type, device type, pages accessed, timestamps
- Authentication events: sign-in times, password reset requests
- Audit records: actions taken within the Service, including who performed them and when, retained for compliance and security purposes
- Email delivery events: whether a message was sent, delivered, or failed
2.4 Payment information
Payment card details are collected and processed directly by our payment processor. CareFlow does not receive or store full payment card numbers. We receive transaction records, subscription status, and limited billing identifiers.
2.5 What we do not collect
CareFlow Training does not store health information about an agency's clients (the individuals receiving care). The Service is limited to workforce training, compliance, and onboarding records.
3. How We Use Information
We use information to:
- Provide, operate, and maintain the Service
- Create and administer accounts and permissions
- Deliver training content, track progress, and issue certificates
- Process applications and onboarding workflows on an agency's behalf
- Process payments and manage subscriptions
- Send transactional and service communications, including invitations, reminders, notifications, and account notices
- Provide customer support
- Maintain audit trails for security and compliance
- Monitor for and investigate security incidents, fraud, and misuse
- Improve reliability and functionality of the Service
- Comply with legal obligations
We do not sell personal information.
We do not use individual records to train artificial intelligence models.
We do not use caregiver or applicant records for advertising.
4. Legal Basis and Consent
Agencies are responsible for establishing the lawful basis for collecting and processing information about their caregivers and applicants, and for providing any notices and obtaining any consents that applicable law requires.
By submitting data to the Service, an agency represents that it has the authority and any necessary consents to do so.
5. How We Protect Information
We apply technical and organizational safeguards, including:
- Encryption in transit for all connections to the Service
- Encryption at rest for stored data
- Field-level encryption for the most sensitive records. Social Security numbers and Form I-9 Section 1 payloads are encrypted using AES-256-GCM and stored separately from general records
- Role-based access control. Users see only what their role and agency permit. Row-level security is enforced at the database layer
- Segregated confidential storage. Health assessment records, I-9 records, and payroll records are held in separate access-controlled areas, each with its own permission grants and audit logging
- Audit logging of access to and changes affecting sensitive records
- Least-privilege internal access. CareFlow personnel access customer data only when necessary to provide support, resolve an incident, or comply with law
No system is perfectly secure. We cannot guarantee absolute security, but we work to protect information in a manner appropriate to its sensitivity.
6. When We Share Information
We share information only as described here.
Service providers. We use third parties to operate the Service, including cloud hosting and database infrastructure, payment processing, and email delivery. These providers process data on our behalf and are bound by contractual confidentiality and security obligations.
Within an agency. Records are visible to authorized users of the agency that owns them, according to their assigned role. Records are not visible across agencies.
Legal requirements. We may disclose information if required by law, court order, subpoena, or governmental request, or where we believe disclosure is necessary to protect rights, safety, or property, or to investigate fraud or a security incident.
Business transfers. If CareFlow is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will provide notice of any such transfer and any material change to how information is handled.
With your direction. We share information as an agency instructs, including when an agency requests an export.
We do not sell, rent, or trade personal information.
7. Data Retention
While your subscription is active. We retain your data for as long as your account is active and as needed to provide the Service.
After cancellation. Retention and deletion after cancellation are governed by our Refund and Cancellation Policy. In summary, agencies have a defined window to export their data, after which it is deleted.
Audit and transaction records. We retain security audit logs, billing records, and transaction history for a longer period as required for legal, accounting, and security purposes, even after account data is deleted.
Backups. Deleted data may persist in encrypted backups for a limited period before being overwritten in the ordinary course.
Your obligations. Certain employment records carry retention obligations that belong to the employer, not to CareFlow. Federal law requires employers to retain Form I-9 documentation for a defined period after hire or termination. Agencies are responsible for retaining their own copies of employment records as required by law. Do not rely on CareFlow as your system of record for legally mandated retention.
8. Your Choices
Agency customers may:
- Access and correct account information through the Service
- Export data as described in the Refund and Cancellation Policy
- Cancel a subscription at any time
- Request deletion of the account and its data, subject to legal retention requirements
- Opt out of non-essential communications. Transactional and service communications cannot be opted out of while an account is active
Individuals (caregivers and applicants):
Because your agency controls your records, requests to access, correct, or delete them should go to your agency first. If you contact us directly, we will refer you to your agency, or work with your agency to respond, unless applicable law requires otherwise.
9. Individual Rights
Depending on where you live, you may have rights regarding your personal information, which may include the right to access, correct, delete, restrict processing of, or receive a portable copy of your information, and the right not to be discriminated against for exercising those rights.
For records held on behalf of an agency, direct your request to that agency. CareFlow will support the agency in responding.
To make a request about information CareFlow holds as a controller — such as agency contact and billing information — email support@careflowtraining.com. We will verify your identity before acting on a request.
10. Children's Privacy
The Service is intended for use by businesses and their adult workforce. We do not knowingly collect information from anyone under 16. If we learn we have collected such information, we will delete it.
11. Data Location
The Service and its data are hosted in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States.
12. Cookies and Similar Technologies
We use cookies and similar technologies necessary to operate the Service, including maintaining your authenticated session and remembering preferences.
We do not use advertising cookies or third-party advertising trackers.
Most browsers allow you to refuse cookies, but disabling essential cookies will prevent you from signing in and using the Service.
13. Security Incidents
If we become aware of a security incident affecting personal information, we will notify affected agencies without undue delay and in accordance with applicable law, and will provide information about the nature of the incident and the steps we are taking.
Agencies are responsible for any notifications they are required to make to their own employees, applicants, or regulators.
14. Changes to This Policy
We may update this Privacy Policy. For material changes, we will notify account holders by email and update the "Last Updated" date above. Continued use of the Service after the effective date constitutes acceptance.
15. Contact
Questions, concerns, or requests regarding this Privacy Policy:
CareFlow Technologies Email: support@careflowtraining.com Web: app.careflowtraining.com
CareFlow Technologies