Plain 5-line summary (full terms below)

Version 2026-10-18: where.care is operated by Luis Diaz-Sendel (New York, NY) as a software registry and introduction service.
Not an agency or employer: you hire the independent caregiver directly; where.care is not a licensed home-care agency and does not employ caregivers.
10% platform fee: booked shifts include a 10% where.care fee (0% on tips); where.care does not hold funds in escrow.
Point-in-time checks: Checkr background badges and staff license reviews are point-in-time checks, not live board monitoring.
Contact, liability cap & venue: notices go to hello@where.care and privacy requests to privacy@where.care. Disputes are resolved by arbitration in Delaware, and liability is limited to the fees paid to where.care (zero if no fee was paid).

Privacy Policy

Last updated October 18, 2026. Document version 2026-10-18.

Key Takeaways & Summary

Direct-hire marketplace: where.care introduces families to independent caregivers and provides coordination software; we are not an employer or home care agency.
Zero advertising trackers: We do not load Google Analytics, Meta pixels, or third-party ad retargeting cookies.
No clinical chart storage: We do not store prescription records, vitals, medical charts, or DNR status.
Point-in-time verification: Caregiver background checks are conducted via Checkr; official reports remain stored securely at Checkr.
Full data control: You can download your data or request complete account deletion anytime by contacting privacy@where.care.

Who this covers

This notice describes personal information the where.care service stores. The service is offered in the United States, including New York, California, Arizona, and nationwide browse. It is not offered as a European Union service, and this page is not a GDPR notice.

The service is not for users under 18. Information about a care recipient is provided by the family account holder, who confirms they have authority to share it.

Account, profile, and hiring

We store account name, email, role, and Better Auth session cookies so you can sign in. Caregiver profiles store display name, phone, ZIP, rates, bio, languages, certifications, and an optional introduction video. Quotes and messages store the request, the thread, and message text. Waitlist rows store an email and a ZIP.

A license review stores the license number, the state, and the date a staff member checked the state board. Checkr candidate id, report id, package, and result are stored when Checkr is used. The report stays at Checkr. We do not ask for a Social Security number or a date of birth. A profile stays unpublished until Checkr returns a result. Google sign-in, when GOOGLE_CLIENT_ID is configured, shares the Google account identifier needed to sign in.

Location and health records

Visits can store a home address, target latitude and longitude, and clock-in and clock-out GPS coordinates from the phone. Those coordinates are a location log. They are not Medicaid electronic visit verification.

where.care does not store care charts: medications, vitals, assessments, dossiers, DNR or code status, or incident narratives. A family can download a remaining copy from /api/mp/me/clinical-export. An emergency SOS stores the visit, the time, and whether 911 was called. Care-circle membership is still stored.

This is not a HIPAA compliance program. There is no HIPAA badge.

Providers

Cloudflare Workers, D1, KV, and R2 host the application, the database, and media such as photos and documents. Stripe stores customer and payment-intent identifiers when card authorization is enabled. We do not store full card numbers.

Resend sends email. Twilio sends SMS to numbers that have a stored consent. Checkr, when configured, processes the background-check identifiers. State licensing boards are not queried automatically.

families.care cross-promo, when CROSS_PROMO_ENABLED is on, records coarse impression and click events so a placement can be counted. That feature is off until a mapped service has enough live caregivers nearby. Those events are an operational record with a service partner. They are not a sale of personal information. Counsel can reclassify that sharing later. where.care does not sell personal information.

Cookies and local storage

Better Auth uses session cookies, including __Secure-better-auth.session_token and session_data. The browser may store wc_lang for the language choice and cookie-consent to remember that you dismissed the cookie notice. cookie-consent does not turn on analytics. We do not load Google Analytics or a Meta pixel.

Requests, retention, and security

Email privacy@where.care to ask for a copy, a correction, or deletion. California requests are answered within 45 days after we check identity. We may keep FCRA adverse-action records, payment records, and security logs when the law or the dispute requires it. Account data is kept while the account is open and for a limited period afterward. In-platform messages, moderation logs, and contact access logs are retained for 7 years for safety review, dispute resolution, and legal compliance. Automated scanning of messages is performed for safety and anti-circumvention. On account deletion, shared contact pairs are dissolved and direct contact access is immediately revoked.

Data sits in Cloudflare D1 with access limited by account role. That is not a claim of HIPAA compliance.