Cara — Security & Privacy

Your Data Stays on Our Server

Cara runs on a virtual private server that we rent from IONOS. The same server also hosts the operator's other projects. All pilot participants keep their records in one shared database. Your login lets you see only your own records. The database is designed to be encrypted at rest with SQLCipher (AES-256). Files you upload to Documents are stored as ordinary files on the server disk. They are not separately encrypted.

There is no data mining. There is no selling. Your information is never shared with advertisers, insurance companies, employers, or data brokers. Not now, not ever. Your data exists to serve you — that's the only business model.

What We Collect and Why

Every piece of data Cara asks for serves a specific safety or organizational purpose. We don't collect things just because we can — if it doesn't help you manage your health, we don't want it.

Medications & Supplements

So Cara can check for drug interactions, track your refill schedule, and give you an accurate list to hand your doctor or pharmacist.

Vitals & Lab Results

Blood pressure, blood sugar, cholesterol, weight — tracked over time so you can see trends and walk into appointments with real data.

Symptoms & Conditions

Recorded so you have a dated history to look back on and can report them accurately to your care team.

Family Health History

Used to flag relevant screening recommendations and provide context when you're discussing risk factors with your care team.

Screening Answers

If you fill in the pilot screening questions, Cara keeps your answers, the result, and any appeal you send for 12 months, then deletes them. Cara keeps only anonymous counts by calendar quarter (for example, how many people were approved), with no name, email, age or answers. Only the Cara operator can see them, and they are not linked to any account.

Safety Flags

Cara scans what you type in check-ins and symptom notes for words that can mean a medical emergency, an overdose, or thoughts of self-harm. If it finds them, Cara shows a fixed message with emergency numbers (911, Poison Control, 988) and adds the text to a list the Cara operator reviews. For self-harm words, the operator is also alerted. Cara does not send those words to the AI, and this scan does not replace calling for help.

Wearable Data

If you connect an Omi pendant, Cara reads health mentions (such as a medicine or a symptom) from your conversations. Cara puts them in your Review list for you to check. Cara does not pull in sleep or activity data.

Appointments & Care Team

So Cara can help you prepare questions before visits and keep track of who's managing what part of your care.

Want the full breakdown of why each data point matters? See exactly why we ask.

What We Don't Collect

Just as important as what we collect is what we deliberately leave out. Cara has no use for the following — so we never ask for it, never store it, and never will.

Cara will never ask you for:

Social security numbers or government-issued IDs
Insurance policy numbers or claims information
Credit card numbers or payment details (the pilot is free)
Your physical location or GPS data
Your browsing history or app usage on other platforms

Registration doesn't even require an email address. We ask for as little as possible to get you started, because the less unnecessary data we hold, the less there is to protect.

How AI Is Used

Cara's AI conversations are powered by Anthropic's Claude API. When you chat with Cara, your messages are sent to Claude for processing and the response comes back to you. Here's what that means for your privacy:

Cara sends Claude these items: your list of medicines with doses and how often you take them, your conditions, your allergies and how severe they are, and the text of your check-in messages. When you ask for appointment prep, Cara also sends your recent symptoms, vitals, check-in summaries, saved questions, and the doctor's name and appointment date. Cara does not send your own name in your health profile. What you type may still contain personal details, so please avoid typing the names of other people. Cara does not send Omi conversation text to Claude.

Anthropic's API terms say customer inputs are not used to train its models. Ask the operator for Anthropic's current terms if you want to read them.

Cara scans every AI reply for 15 kinds of wording that sounds like a diagnosis, a dose, or an order to start or stop a medicine. If a reply matches, Cara asks the AI to rewrite it. If the rewrite still matches, Cara blocks it and shows a standard message instead. The scan is automatic. It does not catch everything.

Curious how the safety system works under the hood? Learn how Cara's AI safety works.

Your Control

Your data belongs to you. That's not a slogan — it's how the system is built. You have full control over everything Cara stores, and you can exercise that control at any time.

Export Everything

Download a copy of your main records as a JSON file or a PDF. It includes your profile details, medicines, allergies, conditions, family history, providers, appointments, drug interactions found, check-in summaries, symptoms, vitals and consent records. It does not yet include lab results, vaccinations, goals, uploaded documents, messages or reminders.

Delete Everything

Delete your account from the Tools page. Cara erases your account and your records from its database right away. Cara does not yet remove files you uploaded to Documents. The server also keeps a few recent backup copies of the database. Your records stay in those copies until newer copies replace them.

Review Consent Preferences

See what you agreed to on the Consent page, and accept or revoke each choice. Cara records your choice. Revoking does not yet switch off the matching feature. If you want the AI features stopped for your account, tell the operator.

No Lock-In

You can leave whenever you want. Download your records first, then delete your account.

Third-Party Services

Cara connects to a small number of external services to do its job well. Here's what they are, what they do, and what data (if any) leaves the server.

openFDA

Public FDA database for drug safety data, recall alerts, and label information. No personal data is sent — Cara queries by drug name only.

RxNorm

National Library of Medicine service for standardizing drug names. Ensures "Tylenol" and "acetaminophen" are recognized as the same thing. Public service, no personal data sent.

Anthropic Claude API

Powers Cara's AI conversations. Cara sends it the items listed under "How AI Is Used" above. Anthropic's API terms say your inputs are not used for model training. Cara saves your check-in conversations in your Cara account so you can read them later. Ask the operator what Anthropic keeps on its side.

Omi

Only if you connect an Omi pendant. Omi sends Cara text from your conversations. Cara can send short alert messages back to your Omi app.

IONOS

The company that hosts Cara's server. Your records are stored there.

unpkg.com

Your browser loads two chart and page-update scripts from this service. It sees your browser's network address, not your health data.

Cara does not use advertising pixels or social media scripts. If Cara adds a new service that receives your data, this page should be updated.

During the Pilot

Cara is currently in a limited pilot program with a small group of participants. That means a few things worth knowing:

Because the user base is small, you have direct access to the developer. If you have a question about how your data is handled, you can ask and get a real answer from the person who built the system — not a support ticket queue.

Cara is still a test. It has a login, a database designed to be encrypted, and a scan of AI replies. These protections are not perfect, and a small pilot is where we find the gaps. Tell the developer if something looks wrong.

The pilot is free. When paid features are introduced down the road, your data will never be the product. The business model is the service itself, not what we know about you.

Security & Privacy