Privacy Policy
Last updated: October 22, 2026
This policy covers personal information collected through CareFlow HQ's public website at careflowhq.com (the “Site”), operated by Divine Ventures Group LLC d/b/a CareFlow HQ (“CareFlow HQ,” “we”). It does not cover the patient portal or any patient health information, which are governed by separate agreements. Section 5 also describes how the CareFlow HQ application handles Google Calendar data when a practice user connects a Google account, and Section 11 describes the text messages CareFlow HQ sends to its staff users. For the Site, CareFlow HQ is the data controller.
1. Information we collect
- You give us: name, email, phone, practice name, and message content when you request a demo, contact us, subscribe to updates, or create an account.
- Automatically: device/browser data, IP address, pages viewed, and similar usage data, via cookies and analytics (see the Cookie Notice below).
2. How we use it
To respond to inquiries; provide and improve the Site; market our services to businesses (practices); create and administer accounts; and comply with law. We do not sell personal information.
3. Legal bases (EU/UK GDPR)
Where the GDPR applies, we rely on: your consent (e.g., marketing emails, non-essential cookies); our legitimate interests (operating and securing the Site, B2B marketing); the performance of a contract (account administration); and legal obligations.
4. Sharing
We share personal information with service providers who help us operate the Site — website hosting, a bot-protection service that secures our request form (it processes your IP address to tell humans from automated software), and font delivery — under appropriate confidentiality and data-protection terms, and as required by law or in a business transfer. Demo-request details are processed by our own secure systems. Our marketing/CRM provider may process business-contact data; it does not receive patient health information.
5. Google Calendar integration
If you choose to connect your Google Calendar to CareFlow HQ, we request limited access to your calendar so that your CareFlow HQ booking availability reflects your real schedule. Our use of this access is described below.
What we access. With your permission, we access:
- The list of calendars in your Google account (their names), so you can choose which calendars count as busy.
- The free/busy information of the calendars you choose — the times you are marked busy or available. We do not read the titles, descriptions, guests, locations, or any other contents of your calendar events.
- The ability to create and manage events on a dedicated calendar that CareFlow HQ creates in your Google account. We do not create, change, or delete events on any other calendar.
How we use it.
- We use your free/busy times to remove the slots you are already busy from your CareFlow HQ booking availability, so you are not double-booked.
- We add your CareFlow HQ appointments to the dedicated CareFlow calendar as neutral time blocks carrying only a generic label your practice chooses (for example, “Busy”) — never a patient’s name or any patient information.
What we store. We store, encrypted: the connection token (so the calendar stays linked), the email address of the connected Google account, and the identifiers of the dedicated calendar and of the calendars you chose. We also keep a short-term cache of your free/busy time blocks (start and end times only) and a non-reversible fingerprint of your account and chosen calendars, used only to restore your choice if you reconnect the same account. We do not store the contents of your Google Calendar events.
What we share. We do not sell your Google data, use it for advertising, or share it with third parties. It is used solely to provide the calendar features described above.
Disconnecting. You can disconnect Google Calendar at any time from your CareFlow HQ settings. Disconnecting asks Google to revoke our access and deletes the stored connection token, the stored account email and calendar identifiers, and the cached availability data. It also removes the time blocks CareFlow HQ added to the dedicated calendar and, when that calendar holds nothing else, the calendar itself. The non-reversible fingerprint of which calendars you chose is kept for up to 180 days so your choice can be restored if you reconnect the same account, then deleted. It cannot be turned back into your account or calendar details; it is used only to recognize the same account if you reconnect.
Limited Use. CareFlow HQ’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. International transfers
The Site is operated from the United States. If you are outside the US, your information will be transferred to the US, protected by appropriate safeguards (e.g., Standard Contractual Clauses) where required.
7. Retention
We keep personal information only as long as needed for the purposes above or as required by law.
8. Your rights
Depending on where you live, you may have rights to access, correct, delete, port, or object to/restrict processing of your personal information, and to withdraw consent. EU/UK residents may complain to a supervisory authority. US-state residents may have rights under applicable state privacy laws. To exercise rights, contact support@careflowhq.com.
9. Children
The Site is for businesses and is not directed to children. We do not knowingly collect children's personal information through the Site.
10. Changes and contact
We may update this policy and will post the new “Last updated” date. Contact: support@careflowhq.com.
11. Text messages (SMS)
CareFlow HQ (Divine Ventures Group LLC d/b/a CareFlow HQ) sends text messages only to staff users of the CareFlow HQ app who opt in: one-time sign-in codes and, if chosen, staff alerts (a new secure message or a new online booking). We collect the mobile number you enter, your consent (the wording you agreed to, the time and IP address), and delivery and opt-out records. We use them only to send the texts you asked for, to secure your account, and to honor opt-outs. Our texting provider (Amazon Web Services) delivers the messages for us under contract.
We never sell your mobile number or share it with third parties or affiliates for marketing. Text-message opt-in data and consent are not shared with any third party. Staff texts never contain patient information.
To stop texts, reply STOP or turn them off in Settings. For help, reply HELP or email support@careflowhq.com. We keep consent and opt-out records as long as needed to prove consent and honor opt-outs.
Divine Ventures Group LLC d/b/a CareFlow HQ, Bradenton, Florida · support@careflowhq.com
Cookie Notice
Cookie Notice
Last updated: July 8, 2026
1. What cookies we use
Today, the Site itself sets no tracking, analytics, or advertising cookies. The only cookies that may be set are strictly necessary ones from our bot-protection service to secure the request form. If we add analytics or marketing cookies in the future, we will update this notice and, where required, ask for your consent first.
2. Your choices
Where required (e.g., in the EU/UK), we ask for your consent before setting non-essential cookies. You can also control cookies through your browser settings at any time.
3. Contact
Questions: support@careflowhq.com.