Back to CARE RCM
Back to CARE RCM
IMFUTECH ("IMFUTECH," "we," "us," or "our") develops and operates CARE RCM, a cloud-based healthcare practice management and revenue cycle management platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when healthcare practices, their staff, and authorized individuals ("Customers," "you," or "your") use the Service, and when patients of those practices interact with patient-facing features such as the Patient Portal.
This Policy applies to all users of CARE RCM, including practice administrators, providers, billing staff, and patients who access the Patient Portal. It does not apply to third-party websites or services that may be linked from within the Service, which are governed by their own privacy policies.
We collect information in the following categories:
On behalf of our Customers, we process PHI necessary to operate the Service, including patient demographics, appointment and scheduling data, clinical records (SOAP notes, vitals, diagnoses, medications, lab results, allergies), insurance and billing information, and claims data submitted via EDI 837P/835 transactions. We process this PHI strictly as a Business Associate, under the instructions of our Customers, and never for our own independent purposes.
PHI processed through CARE RCM is subject to heightened protections beyond this general Privacy Policy:
If you are a patient and have questions about how a specific healthcare practice uses your PHI, please contact that practice directly — they are the HIPAA Covered Entity and data controller responsible for your medical records. IMFUTECH acts only as their technology provider (Business Associate).
We use collected information to:
We do not sell personal information or PHI. We share information only in the following circumstances:
| Recipient | Purpose |
|---|---|
| Clearinghouses (Office Ally, Availity) | Submitting EDI 837P claims and receiving ERA 835 remittance files on behalf of the Customer |
| Payment processor (Stripe) | Processing patient payments and subscription billing |
| Cloud infrastructure providers | Hosting and storing data securely (subject to their own BAAs with IMFUTECH) |
| Insurance payers | Submitting claims and verifying eligibility, as directed by the Customer practice |
| Law enforcement / regulators | Where required by law, subpoena, or court order |
All third parties who may access PHI on our behalf are bound by their own Business Associate Agreements or equivalent contractual data protection obligations.
We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction, including:
No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
We retain PHI and account data for as long as the Customer's account is active, and thereafter as required to comply with legal, regulatory, tax, and audit obligations — typically a minimum of 6 years from the date of creation or last use, consistent with HIPAA recordkeeping requirements (45 CFR §164.316(b)(2)), or longer if required by applicable state law. Upon termination of a Customer's account, data is retained for a defined transition period to allow export, after which it is securely deleted or anonymized, except where retention is legally required.
Depending on your role and location, you may have rights including:
Patients seeking to exercise rights over their medical records under HIPAA should contact their healthcare practice directly, as the practice — not IMFUTECH — is the HIPAA Covered Entity responsible for fulfilling patient record requests. Practice administrators and staff may contact us directly using the information in Section 13.
We use strictly necessary cookies to maintain login sessions, enforce HIPAA-required session timeouts, and remember interface preferences (such as sidebar collapse state). We do not use third-party advertising cookies or trackers within the application itself. Our public marketing website (carercm.com) may use limited analytics cookies to understand site traffic; you can control cookie preferences through your browser settings.
CARE RCM is a business-to-business healthcare platform. Patient records for minors may be entered into the Service by healthcare practices under the practice's own authority and parental/guardian consent obtained by the practice. We do not knowingly collect personal information directly from children under 13 through our public marketing website.
CARE RCM is designed for use by healthcare practices located in the United States and is built around U.S. healthcare regulatory frameworks (HIPAA, CMS, X12 837/835 standards). We do not currently support practices operating outside the United States. Data is stored and processed within the United States.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Policy with a revised "Last Updated" date. Material changes affecting PHI handling will be communicated to Customers in advance as required under our Business Associate Agreements.
If you have questions about this Privacy Policy or our data practices, please contact us:
IMFUTECH
Attn: Privacy Officer
[IMFUTECH BUSINESS ADDRESS]
Email: [PRIVACY CONTACT EMAIL]
Phone: [PHONE NUMBER]