Privacy Policy

CarePathIQ is software for building evidence-graded care pathways. This policy explains what we collect, why, and what we do not do, based on what the software actually does.

The short version

We do not hold patient information, and you should not enter it. The AI Studio checks for possible identifiers at a few points, such as a safety event summary and before you publish; those checks are an extra safeguard and can miss something. The one exception is a HIPAA-compliant Enterprise service your institution enables under a signed business associate agreement, described under Review programs. We do not sell your personal data, run advertising, or use third-party analytics or cross-site tracking. We store the pathways you save so you can come back to them, the account details needed to sign you in, and a record of how you use the Studio, keyed to your NPI (National Provider Identifier). We may describe aggregate, de-identified patterns in research and publications. Pathways you choose to share with the Library may be provided to Enterprise customers under an annual agreement and licensed to other companies for use in their products, with your name attached, as the Terms of Use describe. Two things to read closely: Product analytics, and the note about pathway titles under Pathways you save.

What we collect

Account information

Your name, email address, your National Provider Identifier, your ORCID iD if you sign in with ORCID, your stated role, institutional affiliation if you provide one, your plan, and your approval status. At registration your NPI is checked against the public national registry (NPPES). A confirmed individual clinician NPI is approved automatically and recorded as verified. A registry answer that does not confirm the NPI is declined, and is not held for review. If the registry itself cannot be reached, your registration is held for a person to review, because an outage is not evidence about you. The registry lookup sends only the NPI, and we record whether it was verified.

The AI Studio is for people with a verified NPI. People without one can answer a survey or complete an education module from an invitation link, without an account. An account opened earlier with a workshop access code is marked as not verified. It has a limited life: after 30 days it carries a reminder, and after 60 days pathway drafting and evidence search stop until an NPI is added. You can always sign in to that account, and you can always add your NPI to it, which clears the limit immediately.

Accounts opened from an invitation

If you open a free account from an invitation, we keep your email address and the version of the Terms of Use you agreed to and when. We do not ask for an NPI or a password. To show you what you have been sent, we keep an index of the invitations sent to your address (the topic, who sent it, the dates and whether you answered), filed under a one-way keyed hash of your email so the address itself never appears in the index. That page shows only your own invitations and their status: never anyone else’s name, email or answers, and not your own answers.

Requests and messages from the Get started page

When you send a request or a message from carepathiq.org/start, we store what you enter: your name, email and message, and for a Pro, workshop or partnership request, your role, organization and team details. We use it to reply to you and to count requests by type. A copy is emailed to our team.

Pathways you save

When you save a pathway, its content is stored on our infrastructure so you can return to it and so it can be shared with people you invite. Pathways are retained for 365 days from the last time you write to them, and are limited to 1 MB. You can delete a pathway at any time.

Your institution does not see them. A pathway you save is not visible to your employer, your department or your training program: not its content, and not its title, unless you join a group (below). There is no roster or index of what our users are working on that we hand to an institution.

What a program can see, and only if you send it. If you are a trainee, you can submit a pathway you authored as your own scholarly work and say which training milestones it documents. You do that on the pathway itself, by confirming one sentence, and we keep that sentence with the submission as the record of what you agreed to. We store, alongside it, your member identifier, name and email, your program, level and accreditor as they appear on your record, the pathway and its condition, the milestones you selected, and the date, and we show that on your program’s milestone dashboard. It gets there because you sent it. You can take it back two ways. On the pathway itself, the same control you used to send it becomes Unshare this pathway, which deletes that submission outright; your pathway is untouched. Or, in your identity settings, you can switch off every submission at once; that switch is checked each time the dashboard is read, so it covers what you have already sent as well as anything later, and while it is on nothing of yours appears on that dashboard.

A group you join. Anyone with an account can create a group. If its admin sends you a code and you join in the AI Studio, you first confirm that the admin can see your name, your role, your pathways (view only, with their survey results) and the education modules you complete, while you are in the group; we record that you confirmed it and when. The admin sees the role you set in your Profile, each pathway’s title, content and progress, the survey answers with the names and emails of the people you surveyed removed, and the education modules you completed online with your score and the date. The admin cannot change or publish your pathways. Leave the group in My Dashboard, or be removed by its admin, and that access ends at once. If the admin sets the group to show totals only, you confirm that instead, and the admin sees only counts and percentages across the members who are not admins, never your name, your pathways or your results, and nothing until at least five such members have joined.

Education modules you complete. When you complete a module someone shares with you, we keep a record under your account: the module, your score and the date. The person who shared it sees a count of completions, never who completed it.

Published versions. Nothing leaves the AI Studio until you publish a version. On Individual and Pro, a published version goes to the CarePathIQ Library; on Enterprise you may instead keep it within your organization. In the Library, that version’s steps, the evidence it cites, its grades, its patient version if you confirmed one (plain-language steps and questions for patients; we do not collect patients’ answers), a summary of how its decisions were recorded (counts by stage and by role, and dates; never names or reasons), and your name as its author are visible to other Studio account holders and may be provided to Enterprise customers and licensed to other companies for use in their products, as the Terms of Use describe. We also keep the version’s full Approval Record (each recorded decision with its reason, the role that made it and the date, and your review log; roles, never names) and its working record: frontline testers’ answers and comments, consensus rounds and comments, case simulation results, grading reasons, targets, rollout plan and local material, with testers, panelists and raters shown only as labels and never patient-level data. Neither is shown in the Library, and both may be provided or licensed with the version. People who answer a survey for a pathway are told on the survey page that their answers, without their name, are kept with a published pathway. We also use Library versions inside our own software, such as Library search and the Assistant, and to train models. We do not train models on a pathway you keep private. Where you published it, the version of the terms in force, and your confirmation that the pathway holds no patient information are recorded with the version, as is your answer on whether the pathway draws on a society guideline; if it does, the Library shows the society, the guideline and its year with the version. Published versions stay at their permanent link even after you delete the working pathway or retire the version; your name is removed from a retired version on request.

Co-authors. If an author lists you as a co-author when publishing, we keep your name and email address with that version, privately, to send you a confirmation email (and up to two more if the author asks). The author sees only a shortened form of your email, and it is never public. If you confirm, your name, and an ORCID iD you add, appear in the version’s citation, its Pathway Paper and, if a DOI is later registered, its DOI record. If you decline or do not answer, your name is not shown. You can withdraw a confirmation at any time by emailing contact@carepathiq.org; we then remove your name and iD from the Library page and the Pathway Paper we provide, but we cannot recall copies made before then.

Your roster

If you save a roster in My Dashboard, the names, emails and roles you enter, and the date you last sent each person a survey, are kept on your account so you can find and reuse them for your next survey. Only you can see it, and no one is emailed until you press Send. It is deleted when you delete it, or 365 days after your last change.

When you send a survey, CarePathIQ records whether each person opened and answered it, so you can see who is still to answer. It never shows you anyone's answers by name.

Files you upload

Media you attach to a pathway is stored on our infrastructure. Local policy or guideline documents you upload to ground a pathway are read in your browser, and the extracted text is sent to the AI provider as part of the request that generates your pathway. See AI processing below.

Product analytics

The Studio records how it is used, keyed to your NPI. This is our own system: no third party receives it, and it is not advertising or cross-site tracking. What it holds:

• Your professional record. Your name, credential, specialty and practice state, drawn from NPPES, the public federal provider registry, when you first sign in, together with an institution inferred from that registry entry.
• An event log. One row per action you take in the Studio: what the action was, when it happened, and a small amount of metadata about it. It is a per-event log, not a running total; we aggregate it when we read it, not when we write it.
• The condition you are scoping. Each event carries the clinical condition text you typed for the pathway you were working on. It passes through a filter that strips patterns resembling identifiers and truncates it, but it is text you wrote and we hold it.
• Your browser and referring page, recorded once when a session starts.

What it does not hold: the content of your pathway (the nodes, recommendations, evidence and text you author) and the content of anything you send to the AI.

We keep the event log for 90 days. Rows older than that are deleted automatically every day. The professional-record part (name, credential, specialty, practice state, inferred institution) is kept while your account remains active and is deleted 18 months after your last activity. You can ask us to delete your analytics record sooner at any time, and we will.

AI usage

The shared AI allowance is a one-time starter allowance: it covers your account’s first pathway, after which you continue on your own free Google AI key. We record how much of it your account has used (a request count and an estimated cost, against a random identifier) and which pathway it was first used on, and we keep that record, because it is what makes a one-time allowance one-time. We also keep a running monthly total of shared-allowance spending that is not tied to any account, for about 60 days, to enforce a global budget. The content of those requests and responses is not stored.

Review programs

If you run a case-review program, we store the structured codes and ratings reviewers submit. By default this is codes only, with no free-text clinical narrative. Verbatim narrative can only be stored where your institution has a signed business associate agreement with us as part of an Enterprise annual agreement and has explicitly enabled it. The system refuses otherwise, and refuses on any uncertainty.

Ordinary server records

Requests to our services generate logs containing IP address, timestamp and user agent, kept for security and troubleshooting.

What we do not collect

• Patient information. No protected health information is held anywhere in the product except through the Enterprise, BAA-gated review path described above. The person entering text is responsible for keeping it out. The Studio checks for identifiers only where the Terms of Use say, and those checks can miss something. If you submit a flagged safety event summary anyway, it goes to the AI provider as typed; we record that choice and the kinds of identifiers flagged, never the flagged words. If patient information is entered anyway, report it to contact@carepathiq.org with the subject “PHI report”, saying where it is, not what it is. We take any public copy offline within 2 business days and remove the information from every copy we hold within 45 days, including published and retired Library versions. Copies outside our reach expire on their own schedule: your own browser, our hosting provider’s database backups (up to 30 days) and logs (up to 7 days), our AI provider (up to 55 days), and our email provider under its own terms.
• Your own AI key. If you supply your own Google Gemini key it stays in your browser and travels directly to Google. We never receive the key itself. Your browser computes a one-way hash of it and sends us only that hash, which we use to recognize your account. A hash cannot be turned back into the key.
• Your own PubMed key. If you add an NCBI API key under Your account, we keep it encrypted on your account and attach it only to your own PubMed searches. We never show it again in full, and you can remove it at any time.
• Advertising and third-party trackers. No advertising, no third-party analytics, no cross-site tracking, and no cookies beyond what is required to keep you signed in.
• Pathway logic running in your EHR. Where a pathway is deployed as a clinical decision support service, that service runs inside your own infrastructure. Patient context passes to your endpoint, not to us. This is by design and it is not a configuration we offer to host.

AI processing

Generating a pathway sends the text you have entered, including any policy or guideline text you uploaded for grounding, to Google's Gemini API. If you supply your own key, that request goes directly from your browser to Google. If you use the shared allowance, it passes through our proxy, which adds the key and records the usage counters described above; the proxy does not log the request or response body. Google's handling of that data is governed by their terms: the shared allowance runs on Google's paid API, whose terms say Google does not use prompts or responses to improve its products; if you use your own key on Google's free tier, Google's unpaid terms apply, and Google may use what you send to improve its products and models.

Aggregate and de-identified use

We may compute aggregate, de-identified statistics from how the product is used, for example how many pathways include a risk stratification, how often cited evidence supports the recommendation attached to it, or how long authoring takes. We may describe these aggregate results publicly, including in research publications, conference presentations and product materials.

We will not identify you, your pathway content, or your institution in anything we publish without your specific agreement. Where analysis of this kind constitutes human subjects research or quality improvement requiring institutional review, we will obtain the appropriate determination before conducting it, not afterwards.

Who else processes your data

• Cloudflare — hosting, storage and the databases behind the product
• Google (Gemini API) — AI generation, as described above
• Google (Gmail) — the inbox for email sent to our carepathiq.org addresses, such as contact@ and security@
• Resend — email such as sign-in links and invitations, and product updates to people who chose them
• ORCID — optional identity verification, if you choose to sign in that way
• NPPES, PubMed and NLM terminology services — outbound queries to public federal registries for provider details, literature and clinical codes
• jsDelivr — a public CDN serving the diagram library. Loading it exposes your IP address to that CDN, as with any web font or script.

We do not sell your personal data and we do not share it with advertisers. Pathways you publish to the Library are licensed as described above and in the Terms of Use, and may be used in our software and to train models. Pathways you keep private are used for none of this.

Retention

• Pathways: 365 days from the last write, or until you delete them.
• Published versions: kept at their permanent link. You can retire one at any time; it is never deleted, and your name is removed on request. Reported patient information is removed from it (see What we do not collect).
• Record of a PHI report: six years. It holds the report’s date, roles, the kind of information and what was removed, never the information itself.
• Co-author emails: kept privately with the version they were given for.
• Your roster: until you delete it, or 365 days after your last change.
• Your PubMed key: until you remove it.
• Trainee milestone attestations you submit: while your account is open, or until you opt out.
• Account records: for as long as your account is open, and afterwards only as required for legal or accounting purposes.
• Product analytics: the event log for 90 days; the professional record until 18 months after your last activity, or sooner if you ask us to delete it.
• AI allowance record: kept while the allowance system operates; it is what keeps the one-time allowance one-time. The untied monthly spend total: about 60 days.
• Server logs: a short operational period.

Email from us

Account email, such as sign-in links, survey invitations and reminders, and notices about your account, goes to every account holder. Product updates and special offers go only to people who chose them, with the optional box at sign-up or with "Email me updates and offers" under Your account in the AI Studio. People who signed up before that box existed get product updates until they choose.

Every update or offer has an unsubscribe link that works in one click, with no sign-in. You can also turn it off under Your account, or reply "unsubscribe". We record your choice, the wording you were shown, and when you made or changed it. Every update or offer also carries our mailing address.

Your choices and rights

You can delete any draft you have authored, and download any version you have published. On Individual and Pro, a version is published to the Library before you download or share it; on Enterprise you may keep it private to your organization. You can retire a published version afterwards. Publishing and retiring are free. You can opt out of the trainee milestone attestation in your identity settings. You can stop product updates and offers at any time, as described under Email from us. You can request a copy of the account and analytics data we hold, ask us to correct it, ask us to delete your analytics record, or ask us to close your account entirely. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA; we apply the same handling to everyone regardless.

To make any of these requests, email contact@carepathiq.org.

Children

The product is intended for clinicians, trainees and healthcare professionals. It is not directed to anyone under 18.

Changes

If we change this policy we will update the date above and, for material changes, tell account holders directly.

Contact

Email: contact@carepathiq.org

Mail:

CarePathIQ
1280 Lexington Ave FRNT 2 #1149
New York, NY 10028
United States

See also the Terms of Use.