Legal & trust center
Privacy, terms & security.
How CirrusCare collects, protects and shares health information across our continuous-care platform — and the terms that govern its use. We hold health data to a clinical standard, because the people who wear these devices are trusting us with their lives.
Privacy Policy
CirrusCare is a continuous-care platform that works with the smart devices you already own — wearables, glucose monitors, smart scales and more. This policy explains what we collect, why, and the control you keep over it.
1.1Information we collect
- Health & device data you choose to connect: heart rate, glucose, sleep, activity, weight, blood pressure and similar readings streamed from your compatible devices.
- Account & profile data: name, date of birth, contact details, care-team relationships and the family members you invite to your circle.
- Care & clinical data generated in the platform: medications and adherence, consult notes, care-plan goals and the consents you grant.
- Technical data: app version, device type, and security/audit logs needed to operate the service safely.
1.2How we use it
We use your information to deliver the care experience you signed up for — and nothing you haven't agreed to:
- Show you your own health picture and surface meaningful changes early.
- Let the clinicians, pharmacists and family members you have authorized support your care.
- Support reimbursement workflows (e.g. remote-patient-monitoring time and medication-therapy-management sessions) for your care providers.
- Keep the service secure, reliable and compliant, and respond to your requests.
1.3Consent & sharing
Sharing in CirrusCare is opt-in and revocable. You decide which data types each person on your care team or family circle can see, and you can change or withdraw that access at any time from your privacy settings. Granular, time-bound consents (for example, a pharmacist's read-only access to vitals for a medication review) are recorded and expire automatically.
1.4Your rights & choices
| Right | What it means |
|---|---|
| Access | Request a copy of the personal and health data we hold about you. |
| Correction | Ask us to fix inaccurate profile or care information. |
| Deletion | Request deletion of your account and associated data, subject to legal record-keeping requirements. |
| Portability | Export your data in a machine-readable format. |
| Withdraw consent | Revoke any sharing permission, or disconnect a device, at any time. |
To exercise any right, contact support@cirrus-care.com. We respond within the timeframes required by applicable law.
1.5Retention & children
We retain health information for as long as your account is active and as required to support your care and meet legal obligations, then delete or de-identify it. CirrusCare is intended for adults and is not directed to children under 13.
Terms of Service
These terms govern your use of the CirrusCare website and applications. By creating an account or using the service, you agree to them.
2.1The service
CirrusCare provides software for continuous health monitoring, care coordination and related billing workflows. The platform works with compatible third-party devices that you supply; we are not responsible for the hardware, accuracy or availability of devices we do not manufacture.
2.2Not a medical provider or emergency service
2.3Accounts & eligibility
- You must provide accurate information and keep your credentials secure.
- Clinical and organizational accounts must be operated by appropriately licensed professionals or authorized administrators.
- You are responsible for activity under your account and for the permissions you grant to others.
2.4Acceptable use
You agree not to misuse the service — including attempting to access data you are not authorized to see, reverse-engineering the platform, or using it to violate any law or another person's privacy.
2.5Partner & subscription terms
Provider, pharmacy and payer organizations access CirrusCare under a separate written agreement, which governs fees, service levels, and the Business Associate Agreement (BAA) described in Section 3. Where a partner agreement conflicts with these terms, the partner agreement controls for that organization.
2.6Disclaimers & liability
The service is provided "as is" to the fullest extent permitted by law. CirrusCare's aggregate liability is limited as set out in the applicable order or partner agreement. Nothing in these terms limits liability that cannot lawfully be limited.
2.7Changes
We may update these terms; material changes will be communicated in-app or by email. Continued use after an update means you accept the revised terms.
HIPAA & Security
CirrusCare is built to handle Protected Health Information (PHI) under HIPAA. When we process PHI on behalf of a covered entity (a clinic, pharmacy or plan), we act as a Business Associate and operate under a signed BAA.
3.1Safeguards
- Administrative: workforce training, access reviews, documented policies and a designated security contact.
- Technical: encryption in transit and at rest, granular role-based access, session controls and tamper-evident audit logs of every access to PHI.
- Physical: PHI is hosted with reputable cloud infrastructure providers operating under their own HIPAA-eligible, audited controls.
3.2Business Associate Agreements
Covered-entity partners receive a BAA before any PHI is exchanged. The BAA defines permitted uses, breach-notification obligations, subcontractor (sub-BA) flow-down, and return/destruction of PHI on termination. To request a BAA, contact support@cirrus-care.com.
3.3Breach notification
If a breach of unsecured PHI occurs, CirrusCare will notify affected partners without unreasonable delay and within the timeframes required by HIPAA and the applicable BAA, and will cooperate on remediation and required individual/regulator notifications.
3.4Compliance roadmap
Notice of Privacy Practices
This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.
4.1How we may use & disclose your health information
- For treatment — sharing your readings and care information with the clinicians and pharmacists involved in your care, as you have authorized.
- For payment — supporting your providers' billing for covered services such as remote patient monitoring and medication therapy management.
- For health-care operations — quality improvement, care coordination and required reporting, using the minimum information necessary.
4.2Uses that require your written authorization
Most uses beyond treatment, payment and operations — including any marketing or sale of information — require your explicit written authorization, which you may revoke at any time.
4.3Your health-information rights
- Inspect and obtain a copy of your health information.
- Request corrections to your record.
- Request restrictions on certain uses and disclosures.
- Receive an accounting of certain disclosures.
- Receive a paper copy of this notice on request.
4.4Complaints
If you believe your privacy rights have been violated, you may contact CirrusCare at support@cirrus-care.com or file a complaint with the U.S. Department of Health & Human Services Office for Civil Rights. You will not be penalized for filing a complaint.
Questions about your data?
Our team is the fastest path for any privacy, security or data-rights request. For partner BAAs and security questionnaires, reach the same address and we'll route it.