Privacy Policy
This Privacy Policy explains how LeadTrap, Inc., a Delaware corporation doing business as Carelu (“Carelu,” “we,” “us,” or “our”), handles information in connection with our website at carelu.com and related marketing pages (the “Site”).
Scope. This policy covers the Site. Information processed through the Carelu product on behalf of a provider — including any Protected Health Information (PHI) — is governed by our Terms of Service and, where applicable, a signed Business Associate Agreement (BAA), not by this Site policy. We do not collect PHI through this Site. Three exceptions: our handling of data from email accounts a provider connects to the Carelu product (Google or Microsoft) is described in Connected Google and Microsoft accounts below; our handling of data from Meta (Facebook) accounts a provider connects is described in Connected advertising accounts (Meta); and our handling of data from Google Ads accounts a provider connects is described in Connected advertising accounts (Google Ads).
Information we collect
Information you provide. When you request a demo, contact us, or fill out a form, we collect the information you submit — such as your name, work email, phone number, organization, and practice size.
Information collected automatically. When you visit the Site, we and our providers automatically collect certain technical data, such as your IP address, device and browser type, pages viewed, referring URLs, and interactions with the Site, using cookies and similar technologies (see our Cookie Policy).
Business / firmographic data. We use a third-party visitor-identification service (Snitcher) that may infer the company or organization associated with a visitor’s IP address so we can understand which businesses are interested in Carelu. This identifies organizations, not named individuals, and runs only after you accept Marketing cookies.
How we use information
- to respond to your inquiries, schedule demos, and provide information you request;
- to operate, maintain, secure, and improve the Site;
- to measure and improve our marketing and understand which organizations engage with us;
- to comply with legal obligations and enforce our terms; and
- with your consent, for advertising and analytics as described in our Cookie Policy.
How we share information
We do not sell your personal information for money. We share information with:
- Service providers that operate the Site on our behalf, including hosting (Vercel), demo scheduling (Calendly), analytics and advertising (Google), visitor identification (Snitcher), and, for customers, payment processing (Stripe) — each authorized to use the data only to provide their service to us;
- Legal and safety recipients where required by law, legal process, or to protect rights, property, and safety; and
- Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
Some advertising and analytics cookies may constitute a “sale” or “sharing” of personal information under certain U.S. state privacy laws. You control these through the cookie banner and the Cookie preferences link in the footer.
Connected Google and Microsoft accounts
This section covers data we receive through Google and Microsoft APIs. A provider may connect a mailbox (described here) and, separately, a Google Ads account (described under Connected advertising accounts (Google Ads)). The Google API Limited Use commitments below apply to all Google user data we receive, including Google Ads data.
Providers using the Carelu product may connect a Google (Gmail) or Microsoft (Outlook) email account. With the account holder’s permission, Carelu accesses that mailbox only to provide user-facing features the provider has enabled — such as sending intake follow-up emails from the provider’s address, reading replies from families so they appear in the provider’s Carelu inbox, and organizing those messages (for example, marking them as read or labeled once handled). Providers can disconnect a mailbox at any time from their Carelu settings, which revokes our access; previously synced data is deleted on request.
Carelu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:
- we only use Google user data to provide and improve the user-facing features described in this policy — the mailbox features described above and the advertising-reporting features described under Connected advertising accounts (Google Ads);
- we do not transfer Google user data to third parties except as necessary to provide these features, to comply with applicable law, or as part of a merger or acquisition with notice;
- we do not use Google user data for advertising, including our own advertising and any ad targeting or retargeting (showing a provider their own Google Ads performance inside their dashboard is a user-facing reporting feature they asked for, not advertising use of their data);
- we do not allow humans to read Google user data unless we have the account holder’s affirmative agreement, it is necessary for security or compliance purposes, or the data has been aggregated and anonymized; and
- we do not use Google user data — including Google Workspace, Gmail, and Google Ads data — to develop, improve, or train generalized artificial intelligence or machine-learning models.
Microsoft account data accessed through Microsoft Graph is handled under the same restrictions. OAuth tokens for connected accounts are stored encrypted and are never shared.
Connected advertising accounts (Meta)
Providers using the Carelu product may connect a Meta (Facebook) account through our Meta app, Carelu Connector, so they can see how their Facebook and Instagram advertising performs alongside the leads and intakes those ads generate. Access is granted by the provider through Facebook Login and Meta’s permission dialogs, and Carelu accesses Meta data only through Meta’s official APIs (including the Marketing API).
What we receive. With the provider’s permission, we receive: basic profile information of the connecting user (such as name and email address); the ad accounts, Pages, and business assets the provider chooses to share; and advertising data from those assets — such as campaign, ad set, and ad names and settings, and aggregate performance metrics (for example spend, impressions, reach, clicks, and conversion counts).
How we use it. We use Meta data only to provide the features the provider has enabled: displaying advertising performance in that provider’s dashboard, attributing leads and intakes to the campaigns that generated them, and reporting on the results. We do not sell Meta data or use it for our own advertising; we do not share it with third parties except service providers who host and operate the product for us under contract, or where required by law; we do not use it to build or train generalized artificial-intelligence or machine-learning models; and access tokens for connected Meta accounts are stored encrypted and are never shared. Our collection, use, and deletion of Meta data (“Platform Data”) complies with the Meta Platform Terms and Developer Policies.
Disconnecting and data deletion. Providers can disconnect a Meta account at any time from their settings, which revokes our access. You can also remove the “Carelu Connector” app yourself in your Facebook settings under Settings & Privacy → Settings → Apps and Websites, which invalidates our access tokens. To have the Meta data we have stored deleted, disconnect (or remove the app) and email privacy@carelu.com from the account owner’s address with the subject “Meta data deletion request.” We will delete the stored Meta data associated with the connection within 30 days and confirm by email.
Connected advertising accounts (Google Ads)
Providers using the Carelu product may connect a Google Ads account so they can see how their Google advertising performs alongside the leads and intakes those ads generate. Access is granted by the provider through Google’s OAuth consent screen, and Carelu accesses Google Ads data only through the official Google Ads API, using the https://www.googleapis.com/auth/adwords scope.
What we receive. Read-only, and limited to the provider’s own advertising data: the list of Google Ads accounts the connecting user is able to access; basic details of the account the provider selects (account name, currency, and time zone); and campaign performance — campaign ID and name with daily spend, clicks, and impressions, refreshed nightly over roughly the last 35 days so late-reported figures and spend corrections are picked up. We do not request or receive the connecting user’s Gmail, contacts, calendar, Google profile, or any other Google data through this connection.
Read-only access. We only read. We never create, edit, pause, or delete campaigns, ad groups, ads, budgets, or bids, and we never spend money in a provider’s Google Ads account.
How we use it. We use Google Ads data only to provide the features the provider has enabled: displaying advertising performance in that provider’s dashboard, attributing leads and intakes to the campaigns that generated them, and reporting on the results (for example, cost per lead by campaign). We do not sell Google Ads data or use it for our own advertising; we do not share it with third parties except service providers who host and operate the product for us under contract, or where required by law, and each provider’s Google Ads data is visible only to that provider’s account; we do not use it to build or train generalized artificial-intelligence or machine-learning models; and we do not allow humans to read it except with the account holder’s affirmative agreement, where necessary for security or compliance, or where the data has been aggregated and anonymized. Our use and transfer of information received from Google APIs, including the Google Ads API, adheres to the Google API Services User Data Policy, including the Limited Use requirements listed above.
Disconnecting and stored data. Providers can disconnect a Google Ads account at any time from their settings, which stops the nightly sync, revokes our access, and clears the stored OAuth tokens for that connection. You can also revoke Carelu’s access yourself at any time at myaccount.google.com/permissions. Advertising performance already synced (daily spend, clicks, and impressions by campaign) is kept after disconnection so past reports remain intact; to have it deleted, email privacy@carelu.com from the account owner’s address with the subject “Google Ads data deletion request.” We will delete the stored Google Ads data associated with the connection within 30 days and confirm by email.
SMS / text messaging
Families may receive text messages from a provider via Carelu only after providing consent — for example, by submitting a form or chat conversation that discloses SMS follow-up, or by texting in first. Message frequency varies; message and data rates may apply. Reply STOP to opt out at any time and HELP for help. No mobile opt-in data is shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except as necessary to deliver the messages (e.g., our SMS carrier partners) or as required by law.
Cookies and your choices
We use strictly-necessary, analytics, and marketing cookies. Non-essential cookies (analytics and marketing, including Google Ads and Snitcher) load only after you consent through our cookie banner, and you can change or withdraw consent at any time using the Cookie preferences link in the footer. For details on each technology, see our Cookie Policy.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of certain processing (including targeted advertising and any “sale” or “sharing”). To exercise these rights, contact us using the details below; we will respond as required by applicable law. We will not discriminate against you for exercising your rights.
Data retention
We retain information for as long as needed to fulfill the purposes described in this policy, to comply with our legal obligations, resolve disputes, and enforce our agreements, after which we delete or de-identify it.
HIPAA and health information
The Site is a marketing website and is not intended to collect Protected Health Information. Please do not submit PHI through Site forms. In the Carelu product, PHI is handled under our Terms of Service and a signed BAA, with the safeguards described there.
Children’s privacy
The Site is directed to healthcare providers and businesses, not to children, and we do not knowingly collect personal information from children through the Site. (Carelu’s product serves provider organizations that care for children; any such information is handled by those providers under their own agreements and the BAA.)
Security
We use reasonable administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, provide additional notice.
Contact
Questions about this Privacy Policy or your information may be directed to Carelu at privacy@carelu.com.