Skip to main content
Caregiver Readiness Passport

Consumer Health Data Privacy Notice

Last updated: August 16, 2026

This Notice supplements the Caregiver Readiness Passport Privacy Policy. It explains how Caregiver Readiness Passport (“we,” “us,” or “our”) handles information that may qualify as consumer health data under U.S. state privacy laws.

We provide the controls described below to U.S. users as a trust-forward default where operationally feasible. The exact legal rights available to you may depend on your state and circumstances.

1. What consumer health data we may collect

Caregiver Readiness Passport is a Type 1 diabetes caregiver training service. The Service may therefore process health-related information or inferences even though we intentionally minimize detailed medical data. Categories may include:

  • Health-condition context: the fact that training relates to Type 1 diabetes.
  • Age-band context: Preschool/Young Child, Elementary, or Teen, where selected for training.
  • Device and product context: training selections related to Dexcom G7, Omnipod 5, BAQSIMI, or other supported products.
  • Caregiver-responsibility context: whether a parent assigns training for finger sticks, sensor changes, Pod changes, emergency medication, or other procedures.
  • Training interaction data: modules assigned, progress, quiz answers, scores, retries, completion, practical-verification status, course expiration, retraining, and acknowledgments.
  • User-provided content: health-related information a user chooses to include in permitted free-text fields or support messages.
  • Derived/inferred context: the fact that a parent or caregiver is participating in Type 1 diabetes caregiver education may itself reveal or imply a health condition in the family/care relationship.

2. What health data we intentionally do not require

The core Service does not require:

  • Continuous glucose data or live CGM feeds.
  • Individual glucose readings.
  • Insulin dose history or bolus calculations.
  • Pump-control data.
  • Medical records or lab results.
  • Insurance information.
  • Precise geolocation.
  • Child user accounts.
  • Child photos or videos uploaded by families.

If the product changes to collect additional categories, we will update this Notice and obtain consent when applicable law requires it before the new collection or use begins.

3. Sources of consumer health data

We may receive health-related information from:

  • Parent/Admin users who configure caregiver training.
  • Caregivers who complete assigned training.
  • Information generated by the Service from training activity, such as progress or completion status.
  • Information voluntarily submitted in support or privacy communications.

We do not currently obtain live health data from CGMs, pumps, EHRs, pharmacies, insurers, or data brokers.

4. Why we collect and use consumer health data

We use the information to:

  • Provide Type 1 diabetes caregiver education requested by the user.
  • Tailor training by age band and supported device.
  • Assign and manage caregiver responsibilities and optional procedures.
  • Track training progress and completion.
  • Provide remediation and assessment functionality.
  • Support caregiver retraining and material curriculum updates.
  • Provide practical-verification records when used.
  • Secure the Service and prevent unauthorized access.
  • Provide user support and respond to privacy requests.
  • Comply with law and enforce our agreements.

We do not use consumer health data for targeted advertising, insurance underwriting, employment screening, credit decisions, or data brokerage.

5. Consumer health data we share

We share consumer health data only as necessary to provide the Service requested by users or as otherwise permitted by law. Depending on the data and feature used, categories shared may include:

  • Account/contact information.
  • Role and caregiver-relationship information.
  • Course assignments and progress.
  • Age-band and device-training selections.
  • Training completion and acknowledgment records.
  • Technical/security information required to provide the Service.

6. Service providers and third parties

Current service providers that may process relevant information include:

Supabase

Purpose: authentication, database, backend services, authorization/access control. Potential data: account information, caregiver relationships, training assignments, progress, quiz/assessment records, acknowledgments, audit/security information.

Vercel

Purpose: hosting and application delivery. Potential data: request metadata, IP/browser/device information, application traffic, limited server logs, and data processed transiently by application functions.

Resend

Purpose: transactional email. Potential data: email addresses, invitation/account email content, delivery metadata.

Third-party official training media

If a user chooses to load an embedded manufacturer video, providers such as YouTube/Google or Vimeo may receive technical information associated with loading their player. Manufacturer link-outs may send the user to Dexcom, Insulet/Omnipod, BAQSIMI's manufacturer, Wistia, or other official sources. Their independent collection is governed by their own privacy practices.

We configure third-party media to minimize unnecessary collection where practical and do not use manufacturer/video embeds for advertising profiling.

7. We do not sell consumer health data

We do not sell consumer health data.

We do not condition access to the Service on authorization to sell consumer health data.

If this policy ever changes, we will not begin a sale without the separate authorization required by applicable law.

8. No health-data targeted advertising or health-facility geofencing

We do not use consumer health data for targeted advertising.

We do not use geofencing around healthcare facilities to identify or target individuals seeking health services.

We do not collect precise location for the core Service.

9. Your consumer health data rights

Subject to applicable law and reasonable identity verification, you may request:

  • Confirmation whether we collect, share, or sell consumer health data concerning you.
  • Access to consumer health data concerning you.
  • A list of relevant third parties or affiliates with whom your consumer health data has been shared, where required.
  • Correction of inaccurate information where applicable.
  • Deletion of consumer health data concerning you.
  • Withdrawal of consent for future collection or sharing where consent applies.
  • An appeal if we deny a qualifying request.

We do not charge for ordinary privacy requests, subject to rights under applicable law regarding manifestly unfounded, excessive, or repetitive requests.

10. How to submit a request

You can submit a request through:

You do not need to create a new account solely to exercise privacy rights.

We will use reasonable methods to authenticate requests and will not request a government ID unless reasonably necessary and proportionate to the request.

11. Timing and appeals

We aim to respond to verified privacy requests without undue delay and within 45 days where applicable. If an extension is legally permitted and reasonably necessary, we will notify the requester of the reason and expected timing.

If we deny a qualifying request, the response will explain the reason and how to appeal. Appeals can be submitted through the same privacy-request page or privacy@carereadypassport.com with the subject “Privacy Appeal.”

We will respond to qualifying appeals within the time required by applicable law.

12. Deletion and processors

When a verified deletion request applies to consumer health data, we will delete the applicable data from active systems and notify relevant service providers/processors as required.

Data stored only in archived or backup systems may remain until the applicable backup is securely rotated or deleted. Where Washington's My Health My Data Act applies, backup deletion will not be delayed beyond the period allowed by that law.

We will not restore deleted consumer health data from a backup for ordinary business use. If a backup must be restored for disaster recovery, deletion instructions will be re-applied.

13. Changes to this Notice

We will clearly post material changes. We will not begin collecting, using, or sharing materially new categories of consumer health data for materially new purposes without the disclosures and consent required by applicable law.

14. Contact

Operator: Caregiver Readiness Passport

Privacy: privacy@carereadypassport.com

Web: carereadypassport.com/privacy-request