CareMap Privacy Policy

Effective date: July 20, 2026

This Privacy Policy explains how MPower Me, LLC ("MPower Me," "we," "us," or "our"), located in Amissville, Virginia, United States, collects, uses, shares, and protects information when you use the CareMap application and related CareMap services (together, "CareMap"). It also briefly describes analytics used on the public CareMap marketing website.

CareMap is initially offered to people in the United States who are at least 13 years old. If you do not agree with this Policy, do not use CareMap.

At a glance

• You control the information you add to CareMap and the people or organizations with whom you share it.
• CareMap may contain sensitive care, disability, and health information. Use sharing and organization access controls carefully.
• We do not sell personal information and do not use personal information for targeted advertising.
• We use service providers to host CareMap, send email, measure product usage, and provide optional artificial intelligence features.
• You can request deletion from Account Settings. After email confirmation, the account is locked for a seven-day cancellation period before cleanup begins.
• Some shared, legal, billing, security, or care records may need to be retained or anonymized instead of deleted.

1. Information we collect

Account and profile information

We collect information such as your name, email address, authentication credentials or passkey details, profile image, date of birth when provided, account settings, license status, organization memberships, and device or session information.

User-generated and care information

CareMap stores information that you or authorized users create, upload, or share, including:

• Guides, Templates, Forms, folders, files, images, audio, video, and other attachments;
• Form answers, Guide activity, reports, Records, observations, exports, and related evidence;
• Notes and revision history, schedules, reminders, contacts, Guardian relationships, organization information, and access permissions;
• information that may describe a person's health, disability, support needs, routines, preferences, relationships, or care; and
• prompts, messages, tool activity, generated responses, summaries, embeddings, and other information used by CareMap's optional AI features.

Other people may add information about you when you have permitted that relationship or when an organization is authorized to coordinate your care. CareMap records relevant authorship and access history so users can understand who created or changed information.

Device permissions and uploaded media

If you choose to use features that need a camera, microphone, photos, files, notifications, or other device capabilities, CareMap requests the applicable device permission. We use that access only to provide the feature you requested. You can change permissions through your device settings.

Diagnostics and usage analytics

We collect limited technical and usage information, such as browser or device type, app version, approximate network information, timestamps, feature interactions, errors, performance information, and pseudonymous analytics identifiers. We configure analytics to avoid collecting the contents of care records or user-generated fields. CareMap does not use session-replay recording.

The public CareMap marketing website has no user accounts, but it uses pseudonymous Amplitude event analytics to understand visits and button interactions.

2. How we use information

We use information to:

• create, authenticate, secure, and support CareMap accounts;
• store, synchronize, search, share, and present the content and workspaces you are authorized to use;
• run Guides and Forms, create reports, maintain Records and Notes, manage schedules, and support organizations and Guardians;
• provide document processing, media processing, search, accessibility, notifications, exports, and optional AI features;
• calculate storage and AI-credit usage, administer licenses, and maintain required billing records;
• diagnose errors, prevent fraud or abuse, protect users, and improve reliability and usability;
• communicate about account security, invitations, deletion, service changes, and support requests; and
• comply with law, enforce our terms, and protect the rights and safety of CareMap, our users, and others.

We do not sell personal information. We do not share personal information for cross-context behavioral or targeted advertising.

3. Workspaces, sharing, and access

CareMap is designed for collaboration, and information may be visible to other people based on controls you or an authorized organization configure.

• Personal workspaces. Content is private unless you share it, add collaborators, or use a feature that gives another person access.
• Organizations. Organization Managers and authorized Staff may access organization workspaces and care information according to their roles. Content created in an organization workspace belongs to that workspace.
• Guardians. A Guardian may receive broad access to the appointing person's CareMap information and workspace while the relationship and required license are active. The appointing user controls Guardian designation.
• Contacts and sharing. Contact status alone does not grant report or Record access. Users can grant specific permissions, share content, or allow another person to create reports about them.
• About and shared information. A report or Note can be about another person. That person and other authorized users may receive access even when they do not own the source Guide, Form, or workspace.

Review access settings before entering sensitive information. A recipient may retain information they lawfully exported or copied before access was removed.

4. Artificial intelligence

When you use an AI feature, CareMap sends the instructions and relevant authorized context needed to perform the request to our configured AI service provider. This may include selected CareMap content, reports, Notes, search results, or files. CareMap uses workspace access rules to determine which information may be included.

AI output can be incomplete or incorrect and should be reviewed by a qualified person. It is not medical advice and must not replace professional judgment, emergency services, or a healthcare provider.

CareMap currently routes hosted AI requests through OpenRouter. Our use of AI for protected health information is limited to configurations and agreements that we determine are appropriate for that processing.

5. Service providers and platform features

We disclose information to service providers that process it for us under their terms and our instructions. Major providers include:

• Amplitude for privacy-filtered product and marketing-site event analytics;
• Mailgun for transactional email;
• DigitalOcean for application, database, file, and infrastructure hosting; and
• OpenRouter for configured AI model routing.

Optional platform features may also be governed by the policies of Apple, Google, and YouTube. For example, app-store distribution, push notifications, passkeys, device backups, or embedded YouTube videos may cause those companies to process information under their own policies.

We may also disclose information when you direct us to do so, to an organization or person you authorize, to professional advisers and business transaction participants under appropriate safeguards, or when reasonably necessary to comply with law or protect rights and safety.

6. HIPAA and health information

CareMap is designed to support privacy and security controls that can be used in HIPAA-regulated settings. We describe CareMap as HIPAA-ready only where the applicable configuration and a Business Associate Agreement (BAA) are in place. When MPower Me acts as a business associate, the applicable BAA controls our processing of protected health information if it conflicts with this Policy.

This Privacy Policy is not a healthcare provider's Notice of Privacy Practices. A healthcare provider or organization using CareMap may provide its own notice and may have independent obligations concerning your records.

7. Retention and deletion

We retain information for as long as needed to provide CareMap, maintain security and integrity, meet contractual or legal requirements, and resolve disputes. Retention depends on the type of information and the workspace or organization that owns it.

You can start account deletion while signed in by opening CareMap Account Settings → Danger Zone → Delete account. CareMap sends a one-time confirmation email. Opening the confirmation link locks the account, revokes active sessions, and starts a seven-day grace period. A separate cancellation link can restore the account during that period. After seven days, deletion is irreversible and is performed by a retry-safe background process.

Deletion may be temporarily blocked if you are the only active Manager of an organization. Assign another active Manager before trying again.

Account deletion removes or de-identifies credentials, sessions, profile information, personal workspace content, schedules, assistant conversations, contacts, Guardian relationships, grants, memberships, and unreferenced assets. It does not necessarily erase every record immediately or in every location:

• organization-owned content and required shared or historical records may remain with authorship replaced by Deleted CareMap user;
• shared reports, Notes, audit information, Catalogue releases, and minimum billing or security records may be retained where necessary;
• organization care records are deleted unless an authorized, audited retention hold or other legal obligation applies; and
• provider logs, disaster-recovery copies, and backups expire under provider retention schedules and are protected from ordinary use while retained.

An organization Manager or CareMap administrator may place a reasoned, optionally expiring retention hold on an organization client's care records. A hold preserves only relevant care records and the identity needed to understand them; it does not preserve login access or unrelated personal workspace content.

If you cannot access your account, email [email protected] for help.

8. Security

We use administrative, technical, and organizational safeguards designed for the sensitivity of CareMap data, including access controls, encryption in transit, session management, audit information, and restricted infrastructure access. No system can guarantee absolute security. Keep your credentials and devices secure, use sharing controls carefully, and contact us if you believe an account has been compromised.

9. Your choices and US privacy rights

You can review and update much of your profile, content, sharing, and permissions in CareMap. Depending on where you live, US law may give you rights to request access, correction, deletion, or a copy of certain personal information and to appeal a denied request. We may need to verify your identity and may retain information where an exception applies.

CareMap does not sell personal information or process it for targeted advertising, so there is no separate sale or targeted-advertising opt-out. To make a privacy request, email [email protected]. We will not discriminate against you for exercising applicable privacy rights.

10. Children

CareMap is not offered directly to children under 13. People under 13 may be described in care information entered by an authorized adult or organization, but they may not independently create a CareMap account. If you believe a child under 13 created an account or provided information without proper authorization, contact us.

11. Changes to this Policy

We may update this Policy as CareMap changes. We will post the revised Policy with a new effective date and provide additional notice when required by law or when a change is material.

12. Contact us

For privacy questions, requests, or concerns, contact:

MPower Me, LLC
Amissville, Virginia, United States
[email protected]