Trust Center
Security, privacy, and compliance in one place
Every document a compliance officer asks for, plus how patient data is actually handled on a call.
Privacy Policy
What data we collect from website visitors and clinic users, how it is used, and how to request deletion.
Terms of Service
The agreement governing use of the CareOS platform, including acceptable use and service commitments.
BAA Agreement
Our standard Business Associate Agreement, executed with every covered entity before any patient call is handled.
HIPAA Compliance
The administrative, physical, and technical safeguards behind how CareOS handles protected health information.
How patient data is handled
Encryption
PHI is encrypted in transit and at rest. Call audio and transcripts are access-controlled.
Identity verification
Two-factor caller verification with a three-attempt limit before transfer to staff.
No PHI read aloud
The agent acts on patient information without reciting it back over the phone.
Audit trail
Every AI decision, confidence score, and staff override is logged and exportable.
Access control
Role-based access to the review dashboard with per-user activity logging.
Breach process
Documented incident response and notification procedures, defined in the BAA.
Subprocessors
CareOS uses a small number of vendors to deliver telephony, hosting, and messaging. The named subprocessor list is being finalized and will be published here, with advance notice of any additions as required under our BAA.
Need the current list for a vendor review before it is posted? Email contact@careos.pro and we will send it directly.