CARETRAIN · BRIGHTPATH HOME CARE LLC
Privacy Policy
Draft for product-owner and legal review before production launch. Last updated September 23, 2026.
This draft describes how CareTrain, operated by BrightPath Home Care LLC, handles information when agencies and their authorized caregivers use the service.
Information used by CareTrain
CareTrain processes agency information, administrator and caregiver names and email addresses, account identifiers, roles, and membership information. Agency administrators may provide optional caregiver details such as a phone number, employee ID, hire date, or preferred language.
Training records include assignments, due dates, course and content versions, selected language, video progress, assessment answers and results, completion dates, credited duration, annual certificates, and relevant audit events. CareTrain is a training platform; it is not intended for storing client medical records or clinical documentation.
How information is used
Information supports authentication, agency administration, invitations and password recovery, training delivery, progress tracking, assessments, certificates, subscription management, service operation, and protection against unauthorized access. Agency administrators can view their agency’s caregiver training records. Caregivers access their own authorized training and records.
Service providers
- Supabase supports authentication and PostgreSQL data storage.
- Vercel hosts the application and processes requests needed to operate it.
- Mux delivers protected training video. Video requests involve technical information such as network and playback information. CareTrain uses an opaque viewing-session watermark for content protection.
- Resend delivers transactional messages, including invitations and password recovery emails.
- Stripe processes subscriptions and payment information through Stripe-hosted Checkout and Customer Portal. CareTrain stores limited billing references and subscription state; it does not collect or store raw payment-card numbers.
These providers process information needed for their services under their applicable terms and privacy practices. CareTrain may also disclose information when required by applicable law or to address security incidents and protect legitimate rights.
Cookies and technical information
Authentication uses cookies and session information to keep users signed in and support secure account recovery. Application, hosting, email, and video services may process operational information such as request times, delivery status, device or network information, and error events. This release does not add advertising trackers or marketing analytics.
Security and access
CareTrain uses server-side authorization, agency-scoped database controls, and protected file and video access. Access depends on a user’s verified identity and authorized agency membership. No service can promise absolute security.
Retention and billing changes
CareTrain preserves historical training evidence, including assessment attempts, completions, and certificates. Subscription cancellation or a payment issue does not by itself delete those records. Operational and account information is retained as needed for service operation, security, record integrity, and applicable obligations. A fixed retention schedule and account-closure procedures require final owner review before production launch.
Questions and requests
Caregivers should contact their agency administrator about corrections to agency-managed profile information or access to training records. Other privacy, access, or deletion requests may be directed to CareTrain through the contact page. Requests are reviewed in light of identity verification, agency responsibilities, preserved training evidence, and applicable requirements.
Contact
For questions about CareTrain or this document, visit our contact page. CareTrain is operated by BrightPath Home Care LLC.