Last modified: October 12, 2026. This version supersedes the Privacy Policy dated July 20, 2026. A summary of what changed is at the end of this policy.
CareSwaps, LLC, a Colorado limited liability company that also does business as PatientSwaps (the "Company," "we," "us," or "our"), respects your privacy and is committed to protecting it through our compliance with this Privacy Policy (this "Privacy Policy").
This Privacy Policy describes the types of information we may collect from you or that you may provide when you access and use www.careswaps.com ("CareSwaps") or www.patientswaps.com ("PatientSwaps") (collectively, the "Websites"), including any products or services offered on or through the Websites (collectively referred to as the "Services"), whether as a guest or a registered user, and our practices for collecting, using, maintaining, protecting, and disclosing that information.
The Company operates two related web-based platforms:
The Company provides matching technology only. We do not provide care, and every admission and clinical decision is made by the participating facility's own licensed staff. The Services currently cover Colorado only.
This Privacy Policy applies to information we collect from CareSwaps and PatientSwaps users:
It does not apply to information collected by:
Please read this Privacy Policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Websites or the Services. By accessing or using the Websites and the Services, you agree to this Privacy Policy. This Privacy Policy may change from time to time (see Changes to This Policy in Section 10 below). Your continued use of the Websites or the Services after we make changes is deemed to be acceptance of those changes, so please check the Privacy Policy periodically for updates.
We collect several types of information from and about users of our Websites and Services, including information:
We collect this information:
The information we collect on or through our Websites and Services may include:
For CareSwaps users we may also collect:
For PatientSwaps users we may also collect:
Facility business information is not health information, and some of it (such as a facility's name and the care levels it offers) may be shown to families as part of a match.
As you navigate through and interact with our Websites and Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:
The information we collect automatically may include personal information, or we may maintain it or associate it with personal information we collect in other ways or receive from third parties. It helps us to improve our Websites and to deliver a better service, including by enabling us to:
The technologies we use for this automatic data collection may include, without limitation:
Our hosting provider also processes standard technical information (such as IP address, browser type and the pages requested) to deliver the pages to you. We do not use this information to build advertising profiles.
Some content or applications on the Websites are served by third parties, including content providers and application providers (for example, the Jotform intake and document forms and the Stripe checkout page). These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Websites, under their own privacy policies. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about targeted content, you should contact the responsible provider directly.
The Company is a healthcare technology platform. We are not a healthcare provider, and we are not a "Covered Entity" as defined by the Health Insurance Portability and Accountability Act ("HIPAA"). We act as a Business Associate of each participating facility, and we require a signed Business Associate Agreement ("BAA") with a facility before it can see any resident's identity. Our system shows a resident's identity to a facility only when that facility has a signed BAA with us on file and the family has authorized that specific match. When we process Protected Health Information ("PHI") on behalf of a facility, HIPAA individual rights (such as the right to access, amend, or receive an accounting of disclosures of PHI) should generally be exercised through the applicable healthcare facility (the "Covered Entity"), not directly through the Company. If you wish to exercise a HIPAA right relating to PHI that we have processed on behalf of a facility, please contact the applicable facility directly.
Information submitted directly by patients, families, and caregivers through CareSwaps (for example, through the intake form) is protected under this Privacy Policy and applicable federal and state privacy and security laws. Because resident information we receive from families is used with facilities, we treat all resident information we hold as PHI, whatever its source, and protect it under our written HIPAA Privacy, Security, and Breach Notification policies. When that information is shared with a facility under a BAA, it also becomes subject to the BAA terms.
The Company will cooperate with facility requests to fulfill individual rights obligations as required by the applicable BAA. If a breach involves PHI that the Company processes on behalf of a facility, we will notify the applicable Covered Entity as required by the BAA and HIPAA (45 CFR § 164.410), and we will notify affected individuals, or cause them to be notified, in coordination with that facility as HIPAA and the BAA require. The Company may also have independent state-law breach notification obligations for personal information it holds directly (see Section 8.3).
We use information that we collect about you or that you provide to us, including any personal information:
We do not: (a) sell personal data or PHI; (b) use PHI for advertising, marketing, or targeted content; or (c) use health information to make or influence clinical decisions.
We may de-identify information in accordance with HIPAA (45 CFR § 164.514(b)) such that there is no reasonable basis to believe the information can identify an individual. Properly de-identified information is not PHI and is not subject to HIPAA restrictions.
The Company may use de-identified and aggregated information for lawful business purposes, including:
We will not attempt to re-identify de-identified information and will not use de-identified data to contact or identify specific individuals.
Apart from the welcome email described above, which goes only to you through our Google Workspace email (covered by a BAA), if we need to send resident health information by email — for example, a copy of records you requested — we send it through Paubox, an encrypted email service that has signed a BAA with us.
Opting out. You can opt out of non-essential emails (waitlist, launch, onboarding, and outreach messages) by using the unsubscribe link or emailing privacy@careswaps.com. You cannot opt out of essential service, legal, or billing notices while you have an active request or subscription, because we need them to run the Services and meet the law.
We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.
We may disclose personal information that we collect or you provide as described in this Privacy Policy:
We have no subsidiaries or affiliates. If that changes, they will be bound by this Privacy Policy and will not receive resident information except as described in Section 4.1.
We may also disclose your personal information:
For CareSwaps users, when a family user affirmatively opts into the matching process, we may share relevant information with participating facilities as needed to facilitate transfer matching, as described in Section 4.1. Resident identity is shared only with a facility that has a signed BAA with us on file, and only after the family authorizes that specific match. De-identified operational signals (such as geographic demand information) may be shared more broadly to notify facilities of interest, but never in a form that identifies a specific patient or family.
For PatientSwaps users, information about a resident is shared between facilities only as described in Section 4.1: de-identified facts before the family authorizes a specific match, and the resident's identity only after that authorization.
Families decide when a resident's identity is shared:
Information already shared with a facility under your authorization becomes part of that facility's records, and the facility handles it under its own HIPAA obligations and its own Notice of Privacy Practices.
Colorado law (C.R.S. § 6-1-729) requires referral services to give families a written disclosure. Ours says, in summary:
We use third-party service providers to operate our platforms. The providers that hold resident health information and uploaded documents for us — Jotform (its HIPAA environment, including Jotform Sign), Google Workspace, and Paubox — operate under business associate agreements (BAAs) with us. Our hosting provider, Cloudflare, has not signed a BAA; it carries dashboard data between our records and your browser over encrypted connections, processing it in memory as it passes through, and does not store it. Our automation and billing tools (Make.com, Stripe, and Airtable) receive account, billing, and de-identified identifiers only; Airtable also holds facility business profiles and waitlist contacts. Our other providers receive only website-usage information or business contact information. We check what each provider receives whenever we add or change a provider or change how information flows to it.
| Function | Provider | What it handles | BAA |
|---|---|---|---|
| Intake forms, document uploads, and e-signatures | Jotform (HIPAA environment), including Jotform Sign | Intake answers, resident information, uploaded documents, signed authorizations and disclosures | Yes |
| Records, email, and back-end logic | Google Workspace (Sheets, Gmail, Drive, Apps Script) | Our system of record for requests and matches, document-upload status, audit logs, and outbound email | Yes (Google Workspace HIPAA Business Associate Addendum) for the services Google lists as covered |
| Encrypted email | Paubox | Any resident health information we must send by email | Yes |
| Website and dashboard hosting | Cloudflare | Hosts our sites and dashboards; keeps session identifiers only; dashboard data travels over encrypted connections and is processed in memory as it passes through, without being stored or logged there | No (data in transit only) |
| Payments | Stripe | Subscriber name, email, card details (held by Stripe), and subscription status | Not needed (no PHI) |
| Facility profiles and account records | Airtable | Facility business profiles, subscriber account status and Stripe identifiers, waitlist contacts, and a log of document-upload events that holds identifiers only — no resident health information and no document links | Not needed (no PHI) |
| Automation | Make.com | Connects billing, subscription, renewal-notice, and waitlist events to our records and email, using account, billing, and de-identified identifiers only | Not needed (no PHI) |
| Website analytics | Google Analytics | Page-view statistics for our public marketing pages only (see Section 6) | Not needed (no PHI) |
| Business email outreach | An email-outreach service | Facility business contact lists only | Not needed (no PHI) |
Where resident health information lives. Intake answers, signed authorizations and disclosures, uploaded documents, and other resident health information stay in Jotform's HIPAA environment and our Google Workspace records. When you upload a document, the document stays in Jotform's HIPAA environment and Jotform notifies our Google Workspace records directly; neither the document nor a link to it passes through our automation tool (Make.com) or our account database (Airtable). Our automation and billing tools (Make.com, Stripe, and Airtable) and our analytics tool (Google Analytics) receive only account, billing, de-identified, or website-usage information, never resident health information.
We maintain a current list of service providers with PHI access. You may request this list at any time by contacting privacy@careswaps.com.
The Company uses a minimal set of cookies and similar technologies on the Websites to:
These cookies include:
Pages hosted by Jotform and Stripe (for example, the intake form and the checkout page) may set their own cookies under those providers' policies.
You can control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Refusing analytics cookies does not affect your use of the Services. Disabling essential cookies will prevent you from signing in to the dashboards. You can also use Google's browser add-on to opt out of Google Analytics.
Depending on your jurisdiction and our relationship with you, you may have the right to:
To exercise any of these rights, contact privacy@careswaps.com. We will verify your identity (and, for a resident's information, your authority to act for the resident) before acting. We will respond within 45 days (or such shorter period as applicable law requires). We will not treat you differently for making a request.
Colorado residents may have additional rights under the Colorado Privacy Act (C.R.S. § 6-1-1301 et seq.) if the Company meets the applicable processing thresholds, including:
The Company does not sell personal data and does not engage in targeted advertising. If these practices change, we will update this Privacy Policy and provide opt-out mechanisms as required by the Colorado Privacy Act. Whether or not the Colorado Privacy Act applies to us, we honor the access, correction, deletion, and opt-out requests described in this policy.
Residents of other states with comprehensive consumer privacy laws (such as California, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia) may have similar rights under their respective statutes, including the rights to:
The exact scope of these rights may vary by state. To exercise any of these rights please send an email to: privacy@careswaps.com.
If your request relates to PHI that the Company processes on behalf of a healthcare facility under a BAA, HIPAA individual rights (including access, amendment, and accounting of disclosures) should be exercised through the applicable Covered Entity (the facility). Please contact the facility directly to exercise these rights. The Company will cooperate with the facility as required by the BAA. For information you gave us directly through CareSwaps, contact privacy@careswaps.com and we will respond as described in Section 7.1.
If we deny a privacy rights request, we will explain the basis for the denial and you may appeal by responding to our denial communication. If we deny your appeal, you may file a complaint with the Colorado Attorney General (coag.gov) or, for PHI matters, with the U.S. Department of Health and Human Services Office for Civil Rights (hhs.gov/ocr). We will not retaliate against you for filing a complaint.
Our Terms of Service contain the full dispute-resolution terms, and the Terms control. In summary, disputes with families and other users are resolved by binding individual arbitration under the American Arbitration Association's Consumer Arbitration Rules, seated in Larimer County, Colorado, and governed by the Federal Arbitration Act. Claims may be brought only on an individual basis, not as a class, collective, or representative action. Either side may bring a qualifying claim in small-claims court instead. We pay the arbitration filing and administrative fees above your share under the AAA rules. You may opt out of arbitration by email within 30 days after you accept the Terms, as the Terms describe. If the class-action waiver is found unenforceable, the dispute goes to court in Larimer County, Colorado. Facility agreements contain their own dispute terms. Nothing in this section limits your right to file a complaint with the regulators listed in Sections 7.5 and 11.
We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. The Company maintains administrative, physical, and technical safeguards designed to protect personal information and PHI, including:
PatientSwaps users may request integration with their existing Electronic Health Records (EHR) or healthcare information systems. The Company may support such integrations in the future and, if offered, will execute appropriate data sharing agreements with the facility's vendor.
The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a magic link, access code, or password for access to certain parts of our Websites or Services, you are responsible for keeping it confidential. We ask you not to share or forward it.
Unfortunately, the transmission of information via the internet is not completely secure. Although we implement measures designed to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Websites. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Websites, except to the extent such circumvention results from our failure to maintain reasonable safeguards.
We retain information only as reasonably necessary to provide our services and comply with legal obligations:
When retention is no longer required, data is securely deleted or de-identified in accordance with applicable standards. You can ask us to delete your information sooner; we will delete what we can, but we may need to keep records that HIPAA, our Business Associate Agreements, Colorado law, tax rules, or a legal dispute require us to keep. Information already shared with a facility under your authorization is held by that facility, and we will tell you how to contact it.
In the event of a security breach that results in the unauthorized access, acquisition, or disclosure of personal information, we will investigate the incident and take appropriate steps to mitigate any harm. Where required by applicable state or federal law (including, without limitation, HIPAA, our Business Associate Agreements, the Colorado data-breach law, C.R.S. § 6-1-716, and the laws of any other state in which we operate), we will notify affected individuals (or cause them to be notified, in coordination with the affected facility) and, where required, the affected facility and the appropriate state or federal authorities, in the manner and within the timeframes prescribed by law. Such notification will include, to the extent known, a description of the incident, the types of personal information involved, and the steps individuals may take to protect themselves. We keep written information security practices and update them when our systems change and as new threats emerge.
The Services are designed for adult users (e.g., family members, caregivers, and healthcare facility staff arranging senior-care transfers); you must be 18 or older to use the family service (see our Terms of Service). Our Services are not directed to children under 13, and we do not knowingly collect personal data from children.
Family and caregiver users may provide information about a loved one or resident as part of the intake and matching process. By submitting such information, you represent that you have the authority to do so on behalf of that individual (for example, as a legal guardian, power of attorney, or authorized family member).
If we become aware that any user has provided information through the Websites about a child, we will delete that information promptly. If you believe a child under 13 has submitted information to us, please contact privacy@careswaps.com and we will promptly delete it.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. When we make material changes, we will:
Continued use of CareSwaps or PatientSwaps after the effective date of an updated policy constitutes acceptance of the updated terms. We encourage you to review this policy periodically.
For privacy questions, rights requests, or to report a concern, contact us:
You may raise a privacy concern without giving your name by writing to the mailing address above.
For regulatory complaints contact:
This version, effective October 12, 2026, updates and supersedes the Privacy Policy dated July 20, 2026; the section order is unchanged, and a short Disputes summary has been added as Section 7.6. It adds a description of how a family's authorization controls when a resident's identity is shared with a specific facility, and how withdrawal re-locks it (Section 4.1); a summary of our Colorado referral-service disclosure under C.R.S. § 6-1-729, including our no-sale promise, how the disclosure is signed and dated, the copy the admitting facility receives, and the cancellation notices we send to facilities (Sections 4.2 and 3.1); a plain statement that participating communities currently pay us nothing and that any future facility fee will be a flat software subscription that never varies with referrals, transfers or outcomes (Section 4.2); the payer types we accept, including private long-term-care insurance, and the federal programs we do not (Section 2.1); the subscription acknowledgment, the monthly courtesy notice, and the reminder sent 25 to 40 days before a subscription continues past each 12-month mark (Sections 3 and 3.1); the record we keep when you accept our Client Subscription Agreement (Section 2.1); Paubox encrypted email for resident health information we must email (Sections 3.1, 5 and 8.1); a summary of the arbitration terms in our Terms of Service (Section 7.6); a more specific cookie section that explains the dashboard session cookie and names Google Analytics, what it receives, and that it runs on public marketing pages only (Section 6); the privacy@careswaps.com contact throughout; and our mailing address (Section 11). It replaces the statement that every provider that processes PHI has a BAA with a description and table showing which providers hold resident health information under BAAs (Jotform, Google Workspace and Paubox), that our hosting provider carries data in transit without storing it, and that our automation, billing and account tools receive no resident health information or uploaded documents (Section 5). It describes portal sign-in as a magic link rather than multi-factor authentication, and it removes statements about features and safeguards we have not documented.