CareVoyage Privacy Notice
Global Privacy Policy
Last updated: April 1, 2026
Effective Date: April 1, 2026
Effective Date: April 1, 2026
This Privacy Notice for CareVoyage Co. (“CareVoyage,” “we,” “us,” or “our”) describes how and why we might access, collect, store, use, share, and/or process your information (“Personal Information” or “PI”) when you (“You” or “Client”) use our services, which include, but are not limited to, our website, email communications, newsletters, phone marketing, social media, and any digital properties (together the “Services”).
CareVoyage is a Delaware-incorporated and New York–based company founded by experienced professionals who saw firsthand how fragmented and inaccessible high-quality medical care can be when traveling, and set out to build a more seamless, trusted way to access care globally. Now, CareVoyage gives members a reliable way to identify trusted providers and coordinate support quickly. CareVoyage discreetly addresses that critical gap faced by travelers by reducing uncertainty, complexity, and risk when navigating medical needs abroad. CareVoyage delivers a high-touch concierge experience that simplifies access to trusted medical providers and support services around the world, giving members confidence and clarity when navigating healthcare outside their home market.
CareVoyage is built on a privacy-first philosophy: we purposefully limit our collection of any data related to medical health records, diagnoses, or treatment details through our website or standard enrollment flow and focus on collecting what is necessary to deliver our Services securely and effectively. However, given the nature of our Services, certain information we process may be considered health-related under applicable law (see Section 10). We treat all such information with heightened care.
The Services covered by this Privacy Notice include:
CareVoyage is a Delaware-incorporated and New York–based company founded by experienced professionals who saw firsthand how fragmented and inaccessible high-quality medical care can be when traveling, and set out to build a more seamless, trusted way to access care globally. Now, CareVoyage gives members a reliable way to identify trusted providers and coordinate support quickly. CareVoyage discreetly addresses that critical gap faced by travelers by reducing uncertainty, complexity, and risk when navigating medical needs abroad. CareVoyage delivers a high-touch concierge experience that simplifies access to trusted medical providers and support services around the world, giving members confidence and clarity when navigating healthcare outside their home market.
CareVoyage is built on a privacy-first philosophy: we purposefully limit our collection of any data related to medical health records, diagnoses, or treatment details through our website or standard enrollment flow and focus on collecting what is necessary to deliver our Services securely and effectively. However, given the nature of our Services, certain information we process may be considered health-related under applicable law (see Section 10). We treat all such information with heightened care.
The Services covered by this Privacy Notice include:
- our website and any website that links to this Privacy Notice;
- any contract or membership agreement that references this Privacy Notice;
- our Careers portal (employment applications);
- any other way you engage with us, including sales, marketing, customer support, or events.
Though CareVoyage only offers enrollment to members based in the United States, this Privacy Notice applies to all CareVoyage Services worldwide unless otherwise indicated in writing.
Individuals in Mexico or whose data is used in connection with services offered in Mexico:Aviso de Privacidad (Mexico): Si usted se encuentra en México o sus datos personales son tratados en conexión con servicios prestados en México, por favor consulte nuestro Aviso de Privacidad Integral en español, disponible en nuestro sitio web, el cual cumple con la Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, then you are not authorized to use our Services. If you still have any questions or concerns, please contact us at Privacy@carevoyage.com or by mail at the address provided in Section 18 below.
Individuals in Mexico or whose data is used in connection with services offered in Mexico:Aviso de Privacidad (Mexico): Si usted se encuentra en México o sus datos personales son tratados en conexión con servicios prestados en México, por favor consulte nuestro Aviso de Privacidad Integral en español, disponible en nuestro sitio web, el cual cumple con la Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, then you are not authorized to use our Services. If you still have any questions or concerns, please contact us at Privacy@carevoyage.com or by mail at the address provided in Section 18 below.
TABLE OF CONTENTS
- What Information Do We Collect?
- How Do We Use Your Information?
- How Do We Share Your Information?
- International Data Transfers
- Do Not Sell or Share My Personal Information
- Your Privacy Rights
- Data Retention
- Security and Breach Notification
- Information About Children
- Health-Related Information — Important Notice
- Cookies and Tracking Technologies
- Categories of Personal Information — U.S. State Law Disclosures
- Marketing Communications
- Automated Decision-Making and Profiling
- Links to Other Sites
- Indemnification
- Updates to This Privacy Notice
- How to Contact Us
- Supervisory Authorities and Enforcement
1. What Information Do We Collect?
We collect Personal Information that (a) you provide directly, (b) is collected automatically when you use the Services, and / or (c) we receive from partners and providers when you ask us to coordinate services.
1.1. Information You Provide to Us
We collect Personal Information that you voluntarily provide to us when you contact us, request information about us or our products and Services, register for our Services, use our Services, or when you otherwise contact or communicate with us. All Personal Information you provide must be true, complete, and accurate, and you must notify us of any changes.
The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we may collect includes the following:
The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we may collect includes the following:
1.1.1. Account and Membership Information
When you create an account or enroll, we collect: full name, date of birth, home address, email address, username and password.
1.1.2. Family/Dependent Information
We do not permit the creation of individual member accounts for individuals under 18 years of age. But, we do allow Clients to create a “family membership” wherein they may add coverage for their own dependent under the age of 13 as a member of their primary account. If you add a dependent to a family membership, we collect the dependent’s name and date of birth to confirm eligibility and administer coverage. This may include information about minors under 18 (see Section 9).
1.1.3. Payment and Billing Information
We do not store full payment card numbers. We may receive limited payment-related details (billing address, transaction identifiers) and retain invoices as required for accounting and tax purposes. For payments via credit card, we partner with Stripe as a payment processor to facilitate payments through the Stripe checkout portal. B2B and enterprise customers are billed and pay via invoice. We also offer subscription memberships for which we partner with Memberstack to assist us in managing customer subscriptions.
1.1.4. Customer Support and Communications
If you contact us by email, phone, SMS, WhatsApp, or other channels, we collect the information you provide, and basic metadata needed to respond. We do not record calls as standard practice. Communications are facilitated through Dialpad.
Messaging Opt-In: We may offer you the ability to OPT-IN via SMS or WhatsApp to certain messages related to your account and our Services, including reminders, alerts, service notifications, updates, and offers. We use DialPad to manage all such messaging. You must explicitly opt in to receive these text messages. By providing your phone number to opt-in to receive such messaging, you will be agreeing to receive SMS or WhatsApp messages from CareVoyage via Dialpad. Message frequency will vary. Standard message and data rates may apply. Check with your wireless provider for details. You will be provided the opportunity to opt out at any time by replying STOP to any message or contacting us directly. If you need assistance or have questions about our SMS service, you may also reply with "HELP" to any SMS message you have received from us, or contact our customer support team at membersupport@carevoyage.com. Your phone number and message content shall solely be used for communication between you and CareVoyage and are not sold.
Messaging Opt-In: We may offer you the ability to OPT-IN via SMS or WhatsApp to certain messages related to your account and our Services, including reminders, alerts, service notifications, updates, and offers. We use DialPad to manage all such messaging. You must explicitly opt in to receive these text messages. By providing your phone number to opt-in to receive such messaging, you will be agreeing to receive SMS or WhatsApp messages from CareVoyage via Dialpad. Message frequency will vary. Standard message and data rates may apply. Check with your wireless provider for details. You will be provided the opportunity to opt out at any time by replying STOP to any message or contacting us directly. If you need assistance or have questions about our SMS service, you may also reply with "HELP" to any SMS message you have received from us, or contact our customer support team at membersupport@carevoyage.com. Your phone number and message content shall solely be used for communication between you and CareVoyage and are not sold.
1.1.5. Business and Network Inquiries
If you submit a corporate lead form or provider-network inquiry form, we collect the information you provide (name, organization, contact details, message content), and will manage such information in accordance with this Privacy Policy.
1.1.6. Job Applicants (Careers)
If you apply for employment through our Careers section or by other means, we collect: name and contact information; resume/CV (including employment history, education history, skills, qualifications); cover letter or free-text narrative; and any other information you voluntarily include.
Important: We advise applicants not to include sensitive PI (such as SSN, government IDs, financial account information, health/medical information, race/ethnicity, religious beliefs) unless specifically requested for a lawful purpose. We use job applicant information solely for evaluating candidacy, communicating about the recruitment process, conducting reference/background checks (with notice), complying with employment laws, and maintaining records as required by law.
Retention: We retain applicant data for up to 24 months following the recruitment process, to comply with legal obligations, defend against potential claims, and consider you for future opportunities unless you request earlier deletion.
Important: We advise applicants not to include sensitive PI (such as SSN, government IDs, financial account information, health/medical information, race/ethnicity, religious beliefs) unless specifically requested for a lawful purpose. We use job applicant information solely for evaluating candidacy, communicating about the recruitment process, conducting reference/background checks (with notice), complying with employment laws, and maintaining records as required by law.
Retention: We retain applicant data for up to 24 months following the recruitment process, to comply with legal obligations, defend against potential claims, and consider you for future opportunities unless you request earlier deletion.
1.2. Information Received from Partners and Providers
When you ask us to connect you with a medical provider, that provider or partner may share information with us in connection with the coordination and delivery of the requested service. This may include:
- Logistical and scheduling details (e.g., appointment confirmations, provider availability, estimated arrival times);
- Medical consultation summaries, which may contain clinical observations, diagnoses, treatment recommendations, vital signs assessments, and medications prescribed, delivered to you through CareVoyage as part of the Standard Medical Visit service; and
- For Platinum Plan members, medical evacuation coordination data shared by or with Medjet Assist, LLC ('Medjet'), which may include hospitalization status, medical condition, diagnosis, and transport eligibility information necessary to arrange medical evacuation and transport services.
CareVoyage does not independently request or access your complete medical records. Information received from providers and partners is limited to what is necessary to coordinate and deliver the specific service you requested."
1.3. Information Collected Automatically
When you visit, use, or navigate our website, our servers may automatically receive and log certain information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes. As of this date, we do not use analytics, advertising trackers, cookies, or similar technologies beyond those strictly necessary for site functionality. If we add such technologies in the future, we will update this Privacy Notice and provide required notices and choices.
The data we collect automatically may include usage, device, and location information as detailed below:
The data we collect automatically may include usage, device, and location information as detailed below:
1.3.1. Log and Usage Data.
Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type and characteristics, timestamps, language preferences, referring URLs, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
1.3.2. Device Data.
We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device name, device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
1.3.3. Location Data.
We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.
1.4. Data Minimization
Consistent with applicable law, including the Maryland Online Data Privacy Act (Md. Code, Com. Law §§ 14-4601 et seq.), we only collect Personal Information that is reasonably necessary and proportionate to provide or maintain the specific product or service you have requested. We do not collect Personal Information beyond what is needed for the stated purposes in this Privacy Notice without your prior notice and consent.
2. How Do We Use Your Information?
2.1. Purpose(s) of Processing
Below are the general purposes for which we process your Personal Information. For further details on the purposes of processing of data corresponding to different legally defined categories of data, please refer to the table in Section 12.
a. Provide and operate the Services, including creating and managing your account and membership
b. Process payments, manage subscriptions, and maintain business records
c. Coordinate services you request, including connecting you with medical providers or partners
d. Provide customer support and respond to inquiries
e. Send service-related communications (confirmations, updates, important notices)
f. Send marketing and promotional communications where permitted by law (see Section 13)
g. Evaluate job applicants and manage recruitment (see Section 1.1)
h. Maintain security and integrity of the Services, prevent fraud, and enforce our terms
i. Comply with legal obligations and respond to lawful requests from authorities
j. Maintain records as required by tax, accounting, employment, and other applicable laws
b. Process payments, manage subscriptions, and maintain business records
c. Coordinate services you request, including connecting you with medical providers or partners
d. Provide customer support and respond to inquiries
e. Send service-related communications (confirmations, updates, important notices)
f. Send marketing and promotional communications where permitted by law (see Section 13)
g. Evaluate job applicants and manage recruitment (see Section 1.1)
h. Maintain security and integrity of the Services, prevent fraud, and enforce our terms
i. Comply with legal obligations and respond to lawful requests from authorities
j. Maintain records as required by tax, accounting, employment, and other applicable laws
We do not process Personal Information for: targeted advertising, cross-context behavioral advertising, sale of Personal Information, profiling in furtherance of decisions that produce legal or similarly significant effects, or training of artificial intelligence or machine learning models.
2.2. Legal Bases for Processing (Mexico)
Under Mexico’s reformed LFPDPPP (2025), processing is based on your consent (provided at enrollment through acceptance of this Privacy Notice and our Aviso de Privacidad), contractual necessity, and legal obligations. For complete Mexican disclosures including ARCO rights, consult our standalone Aviso de Privacidad Integral in Spanish.
3. How Do We Share Your Information?
We do not sell Personal Information. We do not share Personal Information for cross-context behavioral advertising. We do not disclose Personal Information to third parties for targeted advertising purposes. We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information. We share Personal Information only as described below.
3.1. Service Providers
Provider
Service
Location
Data Shared
Stripe
Payment processing
United States
Billing address, transaction IDs, payment card data (processed by Stripe; we do not receive full card numbers)
Memberstack
Subscription/membership management
United States
Account credentials, subscription status, membership tier
Dialpad
Customer communications
United States
Contact details, communication content/metadata
MailerLite
Email marketing
United States / EU
Name, email, marketing preferences, engagement data
Make
Workflow Management
United States
Personal information in transit (name, email, membership tier, contact details), but Make does not store data independently
Airtable
CRM and Operations
United States
Member account information including name, email address, phone number, membership tier, and non-PHI service coordination notes (e.g. data and location of a doctor visit request).
3.2. Partners and Coverage Providers
Medjet (Birmingham, Alabama, USA): We share enrollment details (name, address, email, phone, DOB) to activate Medjet medical transportation services. Medjet is an independent data controller processing your information under its own privacy policy.
3.3. Medical Providers and Affiliates
Medical Providers: When you request a connection with a medical provider (currently in United States, Mexico, Dominican Republic, Jamaica, the United Kingdom, Bahamas, France, Greece, Italy, with additional markets planned), we share information necessary to facilitate that connection (typically name, contact details, DOB). We share this only at your direction and solely for coordinating the requested service.
Specific third-party disclosure: Under the laws of Oregon (ORS 646A.574(1)(f)), Minnesota (Minn. Stat. § 325M.14, subd. 1(h)), and Rhode Island (R.I. Gen. Laws § 6-48.1), you may request the specific identity of third parties (not just categories) to whom we have disclosed your PI. To make such a request, contact us at the information provided in Section 18 herein.
Specific third-party disclosure: Under the laws of Oregon (ORS 646A.574(1)(f)), Minnesota (Minn. Stat. § 325M.14, subd. 1(h)), and Rhode Island (R.I. Gen. Laws § 6-48.1), you may request the specific identity of third parties (not just categories) to whom we have disclosed your PI. To make such a request, contact us at the information provided in Section 18 herein.
3.4. Legal and Safety Disclosures
We may disclose PI where necessary to: comply with applicable law, regulation, legal process, or governmental request; enforce our terms, policies, or agreements; protect rights, property, safety, or security of CareVoyage, members, or the public; detect, prevent, or address fraud, security, or technical issues.
3.5. Business Transfers
We may share or transfer your information in connection with a merger, sale, financing, or acquisition. The acquiring entity will be bound by this Privacy Notice.
3.6. Sale/Sharing and Disclosures (CCPA/CPRA)
In compliance with the CCPA/CPRA, we share data with service providers that process Personal Information on our behalf under written contracts that restrict their use of Personal Information to the specific business purposes set forth in the contract, prohibit selling or sharing the Personal Information, and require them to comply with applicable obligations under the CCPA (§ 1798.100(d); 11 CCR § 7050).
We have not sold or shared PI for cross-context behavioral advertising in the preceding twelve (12) months. We will not sell or share PI in the future. We have not sold or shared the PI of consumers under 16.
We have not sold or shared PI for cross-context behavioral advertising in the preceding twelve (12) months. We will not sell or share PI in the future. We have not sold or shared the PI of consumers under 16.
3.7. Maryland (MODPA) Statement on Sale of Data
Consistent with Maryland law (Md. Code, Com. Law §§ 14-4601 et seq.), we do not sell sensitive data under any circumstances. Maryland prohibits the sale of sensitive data outright, and we comply with this prohibition.
4. International Data Transfers
CareVoyage Co. is incorporated in Delaware, headquartered in New York, United States. Your Personal Information may be transferred to, stored in, and processed in countries other than your country of residence, including the United States, Mexico, the Dominican Republic, Jamaica, and additional markets that may be incorporated in the future.
4.1. Transfers from Mexico
Under the reformed LFPDPPP (2025), international transfers may be made where necessary for contract performance, medical care purposes, or with your consent. See our Aviso de Privacidad for complete Mexican transfer disclosures.
4.2. Transfers from the United States
U.S. federal law does not impose general geographic restrictions on outbound PI transfers. Applicable state laws require disclosure of sharing practices, which this Privacy Notice provides. To obtain a copy of safeguards: Contact Privacy@carevoyage.com.
5. Do Not Sell or Share My Personal Information
We do not sell your Personal Information. We do not share your Personal Information for cross-context behavioral advertising.
5.1. CCPA/CPRA Requirements for California Residents
Under the reformed LFPDPPP (2025), international transfers may be made where necessary for contract performance, medical care purposes, or with your consent. See our Aviso de Privacidad for complete Mexican transfer disclosures.
5.1.1. Under the CCPA/CPRA (§ 1798.120; § 1798.135),
California residents have the right to opt out of the sale or sharing of their Personal Information. Because we do not sell or share PI, this right does not currently require any action on your part. If our practices change in the future, we will provide a “Do Not Sell or Share My Personal Information” link (or a combined “Your Privacy Choices” link with the required opt-out icon) on our homepage and honor opt-out preference signals including the Global Privacy Control (GPC).
5.1.2. Right to Limit Use of Sensitive PI (CCPA/CPRA § 1798.121):
We use sensitive PI only for purposes necessary to provide and maintain the Services. If we ever use sensitive PI for purposes beyond those necessary, we will provide a “Limit the Use of My Sensitive Personal Information” link and enable you to restrict such use.
6. Your Privacy Rights
This section describes your rights under every applicable privacy framework. We respond to all legitimate requests in accordance with the shortest applicable response deadline. You will not receive discriminatory treatment for exercising your rights.
6.1. Core Rights Available Under All Applicable U.S. State Privacy Laws
If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Tennessee, Indiana, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, or Rhode Island, you have the following core rights (subject to limitations noted for specific states). NOTE: Though we do not undertake many of these activities (e.g. targeted advertising), we are still required to notify You of that right:
- Right to confirm and access: Confirm whether we process your PI and obtain a copy. Under the CCPA, this includes a 12-month lookback, with access to PI collected on or after January 1, 2022 (CCPA § 1798.130(a)(2)(B)).
- Right to correct: Request correction of inaccurate PI. (Note: Iowa and Utah do not provide a correction right.)
- Right to delete: Request deletion of your PI, subject to applicable legal exceptions (e.g., legal obligations, security, exercising legal rights).
- Right to data portability: Obtain a copy of your PI in a structured, commonly used, machine-readable format.
- Right to opt out of: (a) the sale of PI; (b) sharing PI for cross-context behavioral advertising/targeted advertising; and (c) profiling in furtherance of decisions that produce legal or similarly significant effects. (Note: Utah does not provide a profiling opt-out.) We do not engage in any of these activities.
- Right to non-discrimination: We will not deny goods/services, charge different prices, or provide different quality because you exercised privacy rights (CCPA § 1798.125; all state laws).
6.2. State-Specific Rights
6.2.1. California (CCPA/CPRA)
If you are a California resident, California specifically affords You the following Rights:
Authorized agent: You may designate an authorized agent to submit requests on your behalf. We may require you to verify your identity and confirm the authorization.
Financial incentives: We do not offer financial incentive programs in exchange for Personal Information. If we do in the future, we will provide a Notice of Financial Incentive as required by § 1798.125(b).
Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose PI to third parties for their direct marketing purposes. Regardless, California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in Section 18.
Additional Rights
Authorized agent: You may designate an authorized agent to submit requests on your behalf. We may require you to verify your identity and confirm the authorization.
Financial incentives: We do not offer financial incentive programs in exchange for Personal Information. If we do in the future, we will provide a Notice of Financial Incentive as required by § 1798.125(b).
Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose PI to third parties for their direct marketing purposes. Regardless, California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in Section 18.
Additional Rights
- Right to know categories of sources, business/commercial purposes, and categories of third-party recipients for each category of Personal Information
- Right to know specific pieces of Personal Information collected over a period of the prior 12-months.
- Right to limit use and disclosure of sensitive Personal Information (§ 1798.121)
6.2.2. Oregon (OCPA)
Enhanced Profiling Rights. If you are an Oregon resident, You may request the specific identity of third parties (not just categories) to whom we have disclosed your Personal Information (ORS 646A.574(1)(f)).
6.2.3. Minnesota (MCDPA) — Profiling Rights
Enhanced Profiling Rights. If you are a Minnesota resident, you have enhanced profiling rights under Minn. Stat. § 325M.14:
- Right to question the results of profiling
- Right to be informed of the reasons for a profiling decision
- Right to be informed of actions you could take to secure a different outcome
- Right to request human review of a profiling decision
We do not currently engage in profiling that produces legal or similarly significant effects. If this changes, we will update this section.
Third-Party Identities. You may request the specific identity of third parties (not just categories) to whom we have disclosed your PI (Minn. Stat. § 325M.14, subd. 1(h)).
Third-Party Identities. You may request the specific identity of third parties (not just categories) to whom we have disclosed your PI (Minn. Stat. § 325M.14, subd. 1(h)).
6.2.4. Maryland (MODPA)
If you are a Maryland resident:
- Sensitive Data: The sale of your Sensitive data is prohibited outright (not opt-out; not consent-based)
- Data minimization: collection must be reasonably necessary and proportionate to the specific product/service requested
- Minors under 18: processing for targeted advertising or sale is prohibited if we know or should know the consumer’s age
- Geofencing: Geofencing within 1,750 feet of mental health and reproductive health facilities is prohibited
6.2.5. Rhode Island (RIDTPPA)
If you are a Rhode Island resident, be aware that we may consider having Tier 1 exposure (all commercial websites). As a result, we maintain a privacy notice naming all third parties to whom PI has been or may be disclosed.
6.2.6. Connecticut (CTDPA)
If you are a Connecticut resident, and in compliance with CTDPA, we do not process the data of known minors (under 16) for targeted advertising or sale.
6.2.7. Delaware (DPDPA)
If you are a Delaware resident, we shall consider your Transgender/nonbinary status, if we are ever called upon to request it, as sensitive data requiring opt-in consent. In compliance with DPDPA, we do not process the data of known minors (from 13 to 17 years old, inclusive) for targeted advertising, sale, or profiling.
6.2.8. New Jersey (NJDPA)
If you are a New Jersey resident, then Your data that constitutes “Financial credentials” (account number + security code) shall be considered sensitive data requiring opt-in consent in accordance with NJDPA.
6.2.9. Tennessee (TIPA)
CareVoyage maintains a written privacy program designed to conform to recognized privacy frameworks. Tenn. Code Ann. § 47-18-3213 provides an affirmative defense for controllers maintaining compliance with the NIST Privacy Framework or comparable standards.
6.2.10. Iowa (ICDPA)
If you are an Iowa resident, then in accordance with ICDPA, we shall provide you with (i) a 90-day response period to requests; (ii) you shall not be afforded the Right to Correct your data; and (iii) you shall be provided an “opt-out” capability regarding the collection, use, or management, of your sensitive data (not an opt-in capability as in other jurisdictions.)
6.2.11. Nevada (NRS 603A)
If you are a Nevada resident, you shall be provided the (i) Right to opt out of sale of covered information (NRS 603A.345). Furthermore, Nevada’s consumer health data provisions (NRS 603A §§ 400–550) may apply to CareVoyage. See Section 10 for details.
6.3. Rights Under Mexico’s LFPDPPP (ARCO Rights)
If you are a resident of Mexico, then you may be afforded the following rights:
- Derecho de Acceso: You may have the right to access Personal Information and processing conditions.
- Derecho de Rectificación: You may have the right to correct inaccurate, incomplete, or outdated data.
- Derecho de Cancelación: You may have the right to request deletion, subject to blocking period (i.e. statute of limitations), then suppression.
- Derecho de Oposición: You may have the right to object to processing, including automated processing producing legal effects (Art. 26(II), LFPDPPP 2025).
To exercise your rights under this Section 6.3 please submit ARCO requests to Privacy@carevoyage.com. We will endeavor to respond within 20 business days and implement any requirements within 15 additional business days, free of charge. If the request is denied, then you may file a “solicitud de protección de datos” with the Secretaría de Anticorrupción y Buen Gobierno within 15 business days.
6.4. How to Exercise Your Rights
6.4.1. You may Contact us at privacy@carevoyage.com to submit a request or Data Subject Access Request.
If you are a Nevada resident, you shall be provided the (i) Right to opt out of sale of covered information (NRS 603A.345). Furthermore, Nevada’s consumer health data provisions (NRS 603A §§ 400–550) may apply to CareVoyage. See Section 10 for details.
6.4.2. Verification:
We will need to verify your identity before processing any requests. For CCPA requests, account holders will be offered the opportunity to verify via existing authentication mechanisms. Non-account holders, or those who do not wish to authenticate through existing mechanisms must provide two or more data points (categories) or 3 more data points and a signed declaration under penalty of perjury (for specific pieces). Authorized agents must provide signed written permission or power of attorney. And we may require consumer verification of identity and confirmation of authorization.
6.4.3. Response timeframes:
We will respond within the shortest applicable deadline. That means we will endeavor to respond within 15 business days for CCPA opt-out requests, 20 business days for Mexican ARCO rights, 45 calendar days for most U.S. state rights requests (extendable by 45 days), 45 days for Nevada consumer health data requests (extendable by an additional 45 days with notice, per NRS 603A.510), 60 days for Nevada opt-out-of-sale requests (extendable by 30 days, per NRS 603A.345), and 90 days for Iowa requests.
6.5. Appeals Process
All U.S. state privacy laws except Utah require an internal appeals process. If we decline your request, you may appeal by emailing Privacy@carevoyage.com. We will respond within 60 days (or the applicable statutory period). If the appeal is denied, we will provide information about how to contact your state attorney general or other applicable authority.
6.6. Universal Opt-Out Mechanisms / Global Privacy Control
6.6.1. Global Privacy Control (GPC).
We honor the Global Privacy Control (GPC) opt-out signal as legally mandated in California (11 CCR § 7025), Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Maryland, and Minnesota. As of this date, because we do not sell, share, or use PI for targeted advertising, the GPC signal does not trigger a change in our practices — but we are committed to honoring it if our practices change.
6.6.2. Do Not Track Signals.
Some web browsers permit you to broadcast a signal to websites and online services indicating a preference that they “do not track” your online activities. At this time, we do not respond to such Do Not Track (DNT) browser signals, as no uniform standard exists. CalOPPA (Cal. Bus. & Prof. Code § 22575(b)(5)) requires this disclosure. Furthermore, we do not modify what information we collect or how we use that information based upon whether such a signal is broadcast or received by us.
7. Data Retention
We retain Personal Information only as long as necessary for stated purposes, unless longer retention is required by law (CCPA § 1798.100(a)(3). The following table provides category-specific retention guidance:
Data Category
Retention Period
Criteria / Purpose
Account/membership data
Duration of membership + 7 years (tax/legal)
Accounting, legal obligations, dispute resolution
Payment/billing data
Duration of membership + 7 years
Tax, accounting, chargeback defense
Family/dependent data
Same as primary account holder
Eligibility verification
Customer support data
3 years after last interaction
Service improvement, dispute resolution
Job applicant data
Up to 24 months post-recruitment
Legal compliance, future opportunities, claim defense
Business inquiry data
2 years after last interaction
Lead management, legal obligations
Automatically collected data
Up to 13 months
Security, debugging
Health-adjacent data (voluntary)
Only as long as needed for the specific request
Service coordination; deleted after fulfillment
When no ongoing business need exists, we delete or anonymize Personal Information, or securely isolate it until deletion is possible. Under Mexico’s LFPDPPP, a blocking period equal to the statute of limitations applies before final suppression.
8. Security and Breach Notification
8.1. Security Measures
We implement appropriate administrative, physical and technical security measures including encryption in transit, access controls, and secure authentication. No system is 100% secure. Transmission of Personal Information is at your own risk.
8.2. Breach Notification
In the event of a breach of security affecting your Personal Information, we will notify affected individuals and applicable regulators in accordance with the requirements of all applicable breach notification laws, including:
- All 50 U.S. state breach notification laws (response times vary from 30–60 days depending on jurisdiction)
- FTC Health Breach Notification Rule (16 CFR Part 318): To the extent CareVoyage is a “vendor of personal health records” or “PHR-related entity” not covered by HIPAA, we will comply with the HBN Rule’s 60-day notification requirement, including identifying any third parties that acquired the information.
- Mexico LFPDPPP: notification as required under the reformed statute
9. Information About Children
Our Services are not directed to individuals under 18. We do not permit individuals under 18 to create independent accounts and use age verification during enrollment. Additionally, we do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information for any purpose whatsoever. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at privacy@carevoyage.com.
9.1. Family Memberships
We implement appropriate administrative, physical and technical security measures including encryption in transit, access controls, and secure authentication. No system is 100% secure. Transmission of Personal Information is at your own risk.
9.2. COPPA Specific Considerations
Because dependent information is collected from parents (not from children), COPPA’s direct requirements (15 U.S.C. §§ 6501–6506; 16 CFR Part 312) do not strictly apply to CareVoyage. However, as a best practice consistent with the FTC’s 2025 COPPA amendments, we: (i) do not knowingly solicit data from children or market to children; (ii) do not sell children’s PI or share it for advertising purposes; (iii) promptly delete any PI collected directly from a child without parental authorization; and (iv) enable parents/guardians to review, update, or request deletion of dependent data at any time by contacting us at privacy@carevoyage.com.
9.3. State-Specific Children’s Protections
9.3.1. Connecticut.
We do not target advertising or sell data of known minors (under 16). Therefore, the issue of capturing consent under such circumstances in accordance with (§ 42-520(b)) is inapplicable.
9.3.2. Delaware.
We do not target advertising, sell data, or profile minors between (and including) 13-17 years of age. Therefore, the issue of capturing consent under such circumstances in accordance with (§ 12D-106(a)(6)) is inapplicable.
9.3.3. Maryland.
We do not process data for targeted advertising or sale for any consumer under 18.
10. Health-Related Information — Important Notice
10.1. General.
CareVoyage is not a healthcare provider. We do not diagnose, treat, or prescribe. We are not a HIPAA-covered entity or business associate under U.S. law. We do not independently access or maintain complete medical records. However, as part of our Standard Medical Visit service, referred medical providers deliver written consultation summaries - which may include diagnoses, treatment recommendations, and related clinical information - to members through CareVoyage. We treat all such information with heightened care as described below.
10.2. Our Four Step Approach to Health-Related Information.
However, certain information we process may be considered health-related under applicable laws. To provide clarity, health-related information shall be processed through a three-tier approach
STEP 1: Membership/enrollment data
(e.g. name, DOB, address, email, payment) will be processed as general Personal Information for purposes in accordance with Section 2 of this Privacy Policy.
STEP 2: Voluntarily disclosed health information
shall be treated as sensitive, used solely for the specific service request, subjected to heightened access controls, retained only as necessary; and not shared beyond what is needed for the requested service.
STEP 3: Medical consultation summaries and evacuation coordination data
received from providers or Medjet shall be treated as sensitive health-related information, subjected to heightened access controls, used solely for the purpose of delivering or coordinating the specific service you requested, retained only as long as necessary for that purpose, and not shared beyond what is necessary for service fulfillment.
STEP 4: Provider referral data,
when requested, this data may constitute health data under certain frameworks. In order to comply with legal requirements, this data shall be treated and processed in accordance with the requirements of Section 2.2 of this Privacy Policy and other applicable law, with data minimization practices in effect.
10.3. Washington MHMDA (RCW Ch. 19.373)General.
The MHMDA covers information identifying a person as seeking health care services. This Requires a separate consumer health data privacy policy and opt-in consent for collection and sharing. Additionally, if the data is to be sold, there should be written authorization. Lastly, MHMDA prohibits geofencing within 2,000 feet of healthcare facilities. As a result, we have provided a separate consumer health data privacy policy, and will provide residents of Washington with opt-in consent for collection and sharing, and written authorization if the data is ever to be sold. CareVoyage does not geofence.
10.4. Nevada (NRS 603A §§ 400–550)General.
NRS covers consumer health data including data identifying someone as seeking healthcare services. This also requires separate health data privacy policy, consent for collection/sharing, and contains a geofencing prohibition. As a result, we have attached a separate health data privacy policy for Nevada residents.
10.5. Mexico LFPDPPPGeneral.
The Mexico LFPDPPP (2025, Art. 2-VI) classifies present and future health status as sensitive data requiring express written consent. As a result, for those services where an individual is subject to LFPDPPP we will be sure to secure express written consent.
10.6. FTC Health Breach Notification Rule (“HBNR”; 16 CFR Part 318)
10.6.1.
The FTC Health Breach Notification Rule ('HBNR') applies to vendors of personal health records and PHR-related entities that are not covered by HIPAA. Because CareVoyage is not a HIPAA-covered entity or business associate, and because certain information we maintain — including medical consultation summaries, provider referral data, voluntarily disclosed health information, and evacuation coordination data — may constitute identifiable health information within the scope of the HBNR, CareVoyage treats the HBNR as potentially applicable to its operations.
10.6.2.
The HBNR's notification obligation is triggered by the unauthorized acquisition of identifiable health information (i.e., a breach of security), not by authorized sharing or sale of data. In the event of an unauthorized acquisition of identifiable health information maintained by CareVoyage, we will notify each individual whose information was acquired, the FTC, and, where required, the media, not later than sixty (60) days after discovery of the breach, in accordance with 16 CFR §§ 318.3–318.5 as amended effective July 29, 2024. Such notification will identify the types of information involved and the entities that acquired the information, to the extent known.
10.6.3.
CareVoyage does not sell personal health records. Authorized sharing of information with providers and partners as described in this Privacy Notice is not subject to the HBNR's notification requirements.
11. Cookies and Tracking Technologies
11.1. Cookies
As of this date, we do not deploy analytics, advertising, or behavioral tracking cookies. Our website may eventually use strictly necessary cookies for basic functionality (session management, security). If we eventually introduce any essential or non-essential tracking, we will: (i) update this Notice; (ii) provide cookie consent banners; (iii) honor GPC and applicable opt-out mechanisms; and (iv) update the cookie language to reflect what cookies are being used and for what purpose.
11.2. Do Not Track / Global Privacy Control (GPC)
GPC
We honor GPC as required by applicable state laws. We do not currently respond to DNT signals, as no uniform standard exists. CalOPPA (§ 22575(b)(5)) requires this disclosure even where we do not honor DNT.
CalOPPA (§ 22575(b)(6))
We do not currently allow third parties to collect PI about your online activities across different websites when using our Services. If this changes, we will disclose it here.
11.3. On-Site Search / Indexing Provider Disclosure
Our website may at some point include an on-site search feature powered by a third-party service provider that helps us index our website content and return relevant results. When you enter a search query and submit it, your browser transmits the query and certain related information (such as your IP address, device/browser information, page URL, and the date/time of the request) to us and/or may also transmit that information to our search provider solely to process your request, display search results, maintain site security, and troubleshoot or improve site functionality. This transmission is an essential part of providing the search feature you request and may occur even if you have rejected non-essential cookies or similar tracking technologies, because the search feature cannot operate without sending your query to the systems that generate results. We require our service providers to process this information only on our behalf and not for their own marketing or other independent purposes. Please do not include sensitive personal information (e.g., financial account numbers, Social Security numbers, or health information) in any search field. If you do not want your search query to be processed in this way, please do not use the on-site search feature. We may implement this feature so that your requested search is fulfilled, and the associated communications are processed through systems operating under our direction and on our behalf for that purpose.
12. Categories of Personal Information — U.S. State Law Disclosures
12.1. General
This section satisfies the disclosure requirements of the CCPA/CPRA (§§ 1798.100, 1798.110, 1798.115, 1798.130; 11 CCR §§ 7011–7012), the TDPSA (§ 541.102), CalOPPA (§ 22575), and all other applicable U.S. state privacy laws. Two tables are provided: Table A identifies the categories of data collected, sources, and purposes of collection/use; Table B identifies, for each category, the business-purpose disclosures, sale/sharing status, and retention periods.
12.2. Table A: Categories Collected, Sources, and Purposes of Collection/Use
The following table identifies the categories of Personal Information we have collected in the preceding twelve (12) months, using the categories defined at Cal. Civ. Code § 1798.140(v)(1)(A)–(K) (11 CCR § 7011(e)(1)(A)–(C)):
Category
Collected?
Examples
Sources (§ 7011(e)(1)(B))
Business / Commercial Purposes (§ 7011(e)(1)(C))
A. Identifiers
YES
Name, postal address, email, username, DOB, IP address, phone number
Directly from you (enrollment, forms, communications); automatically (IP address, device info)
Provide/operate Services; account management; customer support; coordinate provider referrals; legal compliance
B. Customer records (§ 1798.80(e))
YES
Name, address, phone, billing address, transaction identifiers
Directly from you; from Stripe (limited payment-related details)
Payment processing; subscription management; accounting and tax records; legal compliance
C. Protected classifications
YES (limited)
Age (derived from DOB)
Directly from you (enrollment)
Eligibility verification (age gating, dependent eligibility); legal compliance
D. Commercial info
YES
Membership purchase history, subscription tier, transaction records
Directly from you; from Stripe and Memberstack (subscription / payment records)
Provide/operate Services; billing and invoicing; internal analytics
E. Biometric info
NO
N/A
N/A
N/A
F. Internet / network activity
YES (limited)
Server logs: IP address, browser type/version, timestamps, pages requested
Automatically from your device when you visit our website
Security monitoring; debugging; maintaining site functionality
G. Geolocation
YES (limited)
Approximate (city/region-level) location inferred from IP address
Automatically from your device
Security; fraud prevention; service delivery (regional provider matching)
H. Sensory info
NO
N/A
N/A
N/A
I. Professional / employment info
YES (applicants only)
Resume/CV, employment history, education history, skills, qualifications, professional references, contact info
Directly from you (via Careers section or direct application)
Evaluate candidacy; communicate about recruitment; reference/background checks; comply with employment laws; maintain records
J. Education info
YES (applicants only)
Education history, degrees, institutions (submitted via job applications)
Directly from you (via Careers section)
Evaluate candidacy; verify qualifications
K. Inferences
NO
N/A
N/A
N/A
L. Sensitive PI
YES (limited)
Account login credentials (username + password); health-related information voluntarily disclosed by you to facilitate a service request; medical consultation summaries received from referred providers; medical evacuation coordination data received from Medjet (Platinum Plan only)
Directly from you
Account authentication and security; coordination of the specific service you requested (health-adjacent data only)
12.3. Table B: Disclosures, Sale/Sharing, and Retention Per Category
For each category identified in Table A, the following table identifies: (1) whether we disclosed that category to third parties for a business purpose in the preceding 12 months and the categories of recipients (§ 1798.115(b); 11 CCR § 7011(e)(1)(E)); (2) whether we sold that category (§ 1798.115(a); 11 CCR § 7011(e)(1)(I)); (3) whether we shared that category for cross-context behavioral advertising (§ 1798.115(a); 11 CCR § 7011(e)(1)(I)); and (4) the applicable retention period (§ 1798.100(a)(3); 11 CCR § 7011(e)(1)(D)).
Category
Disclosed for Business Purpose? (Recipient Categories) (§ 7011(e)(1)(E))
Sold? (§ 1798.115(a))
Shared for CCBA? (§ 1798.115(a))
Retention (§ 1798.100(a)(3))
A. Identifiers
YES — Service providers (Stripe, Memberstack, Dialpad, MailerLite, Airtable, Make); Partners (Medjet); Medical providers/affiliates
NO
NO
Duration of membership + 7 years; No retention for Make
B. Customer records
YES — Service providers (Stripe, Memberstack, AirTable)
NO
NO
Duration of membership + 7 years
C. Protected classifications
YES — Partners (Medjet); Medical providers/affiliates (DOB for eligibility)
NO
NO
Duration of membership + 7 years
D. Commercial info
YES — Service providers (Stripe, Memberstack)
NO
NO
Duration of membership + 7 years
E. Biometric info
NO (not collected)
NO
NO
N/A
F. Internet / network activity
NO
NO
NO
Up to 13 months
G. Geolocation
NO
NO
NO
Up to 13 months
H. Sensory info
NO (not collected)
NO
NO
N/A
I. Professional / employment info
NO
NO
NO
Up to 24 months post-recruitment
J. Education info
NO
NO
NO
Up to 24 months post-recruitment
K. Inferences
NO (not collected)
NO
NO
N/A
L. Sensitive PI
YES (limited) — Health-related data shared with the specific medical provider for the specific service requested, at your direction; evacuation coordination data shared with Medjet for Platinum Plan medical transport services; medical consultation summaries delivered to you through CareVoyage
NO
NO
Account credentials: duration of account. Health-adjacent data: only as long as needed for specific request
13. Marketing Communications
13.1. Email Marketing (CAN-SPAM Act)
We comply with the CAN-SPAM Act (15 U.S.C. § 7701 et seq.) for all commercial email: accurate header information; non-deceptive subject lines; identification as advertisement where required; valid physical postal address included; clear opt-out mechanism in every email; opt-outs honored within 10 business days; opt-out mechanism functional for 30 days after send; no sale or transfer of opt-out addresses.
You can opt out of marketing emails by clicking “unsubscribe” in any email or contacting Privacy@carevoyage.com. Service-related communications (confirmations, security notices, account updates) are not marketing and will continue.
You can opt out of marketing emails by clicking “unsubscribe” in any email or contacting Privacy@carevoyage.com. Service-related communications (confirmations, security notices, account updates) are not marketing and will continue.
13.2. SMS/Phone Marketing (TCPA)
If we send SMS or make phone calls for marketing purposes, we will obtain your prior express written consent as required by the TCPA (47 U.S.C. § 227). You may revoke consent at any time by texting STOP or by any other reasonable means. We will honor revocations within 10 business days and will send no more than one post-revocation confirmation message.
14. Automated Decision-Making and Profiling
CareVoyage does not currently use automated decision-making, profiling, or AI systems that produce legal or similarly significant effects on individuals. We do not use algorithms to determine eligibility for Services, pricing, or access to features based on profiling.
If we introduce automated decision-making or profiling in the future, we will: (i) update this Privacy Notice; (ii) satisfy Minnesota’s profiling rights (Minn. Stat. § 325M.14); (iii) obtain opt-in consent where required for sensitive data profiling; and (iv) comply with CCPA/CPRA ADMT regulations when effective (Jan. 1, 2027).
If we introduce automated decision-making or profiling in the future, we will: (i) update this Privacy Notice; (ii) satisfy Minnesota’s profiling rights (Minn. Stat. § 325M.14); (iii) obtain opt-in consent where required for sensitive data profiling; and (iv) comply with CCPA/CPRA ADMT regulations when effective (Jan. 1, 2027).
15. Links to Other Sites
We may provide links to websites that are owned or operated by third-parties. When you click on those links or otherwise visit that third-party website, you will no longer be covered by the terms of this Privacy Policy, and instead will be subject to the policies, terms, and security practices of that third-party entity, to the extent such policies, terms or practices exist. We are not responsible for the privacy or security practices or representations of any third parties or the content of sites that are linked from our Services. We strongly encourage you to read their applicable privacy policies and terms and conditions of such parties or websites before providing a third-party any information, as their terms may be very different from ours.
16. Indemnification
You are entirely responsible for maintaining the confidentiality of your data, as well as all activities you engage with under your online profile. You hereby agree to indemnify, defend, and hold us, our agents, representatives and other authorized users, and each of the foregoing entities’ respective officers, directors, owners, employees, agents, representatives and assigns (collectively the “Indemnified Parties”) harmless from and against any and all losses, damages, liabilities and costs incurred by the Indemnified Parties in connection with any claim arising out of any breach by you of this Privacy Policy or claims arising from our Services. You agree to use your best efforts to cooperate with us in the defense of any claim. We reserve the right, at our own expense, to employ separate counsel and assume the exclusive defense and control of any matter otherwise subject to indemnification by you.
17. Updates to This Privacy Notice
We may modify or update this policy from time to time. If we make changes, we will notify you by posting the updated policy and revising the “Last Updated” date above. We encourage you to review the policy whenever you use our Services to stay informed about our information practices and about the choices available to you. You acknowledge and agree that it is your responsibility to review the Policy. Your continued use of the Services will constitute acknowledgment and acceptance of the then-published Policy. For material changes, we will prominently post a notice on our website or send a direct notification by email. Under CalOPPA, we will update this Notice within 30 days of any material change (§ 22575(b)(1)). Under Mexico’s LFPDPPP, material changes to the Aviso de Privacidad will be communicated through the mechanisms described therein.
18. How to Contact Us
CareVoyage Co.
590 Madison Ave.
New York, NY, United States
Privacy inquiries: privacy@carevoyage.com
General inquiries: info@carevoyage.com
Accessibility: accessibility@carevoyage.com
590 Madison Ave.
New York, NY, United States
Privacy inquiries: privacy@carevoyage.com
General inquiries: info@carevoyage.com
Accessibility: accessibility@carevoyage.com
19. Supervisory Authorities and Enforcement
If you have any issues or concerns, we encourage you to reach out to us at the contact information above. If we cannot resolve an issue to your satisfaction, you may lodge complaints with:
- Mexico: Secretaría de Anticorrupción y Buen Gobierno
- California: California Privacy Protection Agency (CPPA) or California Attorney General
- All other U.S. states: Your state Attorney General’s office
