Last updated: June 29, 2026
CareTrack ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application and services.
You voluntarily provide health data including medications, dosages, appointments, symptom logs, medical photos, and health notes. This data is stored securely in your account.
Email address, full name, and role/permissions within your care circle.
We may collect analytics on feature usage and app performance to improve the service. We do not track personal behavior.
Your health data is encrypted in transit (HTTPS/TLS) and at rest. We use industry-standard security measures. Access to your data is limited to you and only the care circle members you explicitly authorize. We do not share, sell, or monetize your health information.
When you invite someone to your care circle, you grant them access to the data categories you select. You control granular permissions for each member (medications, symptoms, appointments, wishlist, etc.). You can revoke access at any time by removing the user.
Payment processing is handled by Stripe. We do not share health data with Stripe. We use Base44 as our backend infrastructure provider, which is bound by strict confidentiality and security obligations.
Your data is retained as long as your account is active. If you delete your account, all associated data is permanently deleted within 30 days.
CareTrack is intended to be used by adults. When legally permitted, parents, legal guardians, healthcare providers, social workers, case managers, or other authorized representatives may manage care information on behalf of a minor.
We use the term "HIPAA-Friendly" intentionally — and we want to be transparent about what that means.
CareTrack is designed with the same core privacy and security principles that HIPAA requires: encryption in transit and at rest, permission-based access controls, no selling of health data, user-controlled data sharing, and the ability to delete your records at any time. We believe your health information deserves that level of protection regardless of legal obligation.
True HIPAA compliance is an organizational and legal status — not just a technical one. It requires formal Business Associate Agreements (BAAs) with every vendor in the data chain (infrastructure, email, storage), documented risk assessments, breach notification protocols, internal policies and staff training, and audit logs. This is a significant undertaking typically pursued by healthcare organizations and their software vendors.
We are actively working toward meeting the requirements for full HIPAA compliance. This includes evaluating Business Associate Agreements with our infrastructure providers and building the supporting policies and procedures required. Pursuing formal HIPAA compliance requires a certain scale of adoption to be sustainable — we are transparent that we are on that path, but are not there yet.
We share this openly because we believe patients deserve to understand exactly where we stand — not just what sounds reassuring.
CareTrack is a personal health record tool built for patients and their caregivers. It is not intended to be used by HIPAA-covered entities (hospitals, clinics, insurers) as a Business Associate tool. If you are a healthcare provider looking to use CareTrack as part of your practice's workflows, please contact us at support@savagesurvivor.com before doing so.
If you have questions about this Privacy Policy or your data, contact us at: support@savagesurvivor.com
By using CareTrack, you acknowledge that you have read and understood this Privacy Policy.