Legal

Privacy Policy

Effective date: July 2, 2026  ·  Last updated: September 17, 2026

Covara (“Covara,” “we,” “us,” or “our”) operates a marketplace that connects families with independent Certified Nursing Assistants (“CNAs” or “caregivers”) for non-medical support at home. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have.

This Policy applies to our website, account portal, and related services (together, the “Services”). By creating an account or using the Services, you agree to the practices described here. This Policy should be read together with our Terms of Service, which govern your use of the Services.

1. Information we collect

Information you provide

• Account details: your name, email address, password (stored only in hashed form), and whether you register as a family or a CNA.
• Contact and address information: phone number and home address. Families may also provide a separate address for the person receiving care.
• Family profile and care information: a display name, a description of your care situation, the types of care and services you need, and the days and times you need coverage.
• CNA profile and credentials: professional bio, service offerings, weekly availability, travel radius, professional references, an optional profile photo, and license information (license number and state) used for verification.
• Verification information: details required to verify a caregiver’s license, and the information a screening partner needs to run a criminal background check (see Section 5).
• Payment information: payout details for caregivers, and card/billing details for families, both collected and processed by our payments provider. We do not store full card or bank account numbers on our own servers.
• Communications: messages you send within the Services to a matched family or caregiver, messages you send us (for example, to hello@covara.care), and information you provide in support requests or reported issues.
• Video interview data: if a family and caregiver schedule a video interview before engaging, the call runs on video software Covara operates on its own server rather than through an outside video service. The call is not recorded — recording and transcription are disabled — and no third-party video provider receives the audio or video.

Information we collect automatically

• Device and usage data: IP address, browser type and user agent, and activity on the Services, used for security, session management, and troubleshooting.
• Security and audit logs: records of key account actions (such as sign-in, profile updates, and scheduling changes) to protect accounts and maintain the integrity of the Services.
• Approximate location: we convert the addresses you provide into approximate map coordinates so we can match families and caregivers by distance.
• Visit verification (“EVV”): when a caregiver clocks in or out of a scheduled visit, we check their device’s location against the care address to confirm arrival/departure. We store only the resulting yes/no verdict and a distance rounded to a tenth of a mile — we do not store the precise GPS coordinates from a clock-in or clock-out.
• Mileage data (caregivers only): if a caregiver chooses to use the optional mileage tracker for their own tax records, we record trip start/stop points and distance while a trip is actively running. This is started and stopped by the caregiver — Covara does not track a caregiver’s location in the background or outside of an active, caregiver-initiated trip. We also calculate estimated mileage for visits that have already happened, from the scheduled care address and the home address on file, so a caregiver does not have to run the tracker to keep a record. Where a trip is tracked, we convert its start and end points into street addresses to label the trip.
• Push notification tokens: if you use our mobile apps, a device token used to deliver notifications (the notification itself never contains health information — you open the app to see details).

Information from third parties

• License verification results and background check results, from our screening partners.
• Payment and payout status from our payments provider.

2. How we use information

We use personal information to:

• Create and manage your account and verify your identity and eligibility;
• Match families with nearby caregivers based on location, availability, and the services needed;
• Verify caregiver licenses and run criminal background checks on caregiver accounts;
• Facilitate scheduling, offers, and coordination between families and caregivers;
• Verify a caregiver’s arrival at a scheduled visit, and let a caregiver track mileage for their own records, as described in Section 6;
• Process family billing and caregiver payouts and any applicable platform fees;
• Communicate with you about your account, matches, verification, billing, and support;
• Protect the safety and security of our users, enforce our Terms of Service (including with respect to arranging care outside the Services), and prevent fraud and abuse;
• Operate, maintain, analyze, and improve the Services; and
• Comply with legal obligations and enforce our terms.

3. How we share information

We do not sell your personal information. We share information only as described below:

• Between matched users: to make a match work, families and caregivers see limited information about each other. Before a connection is made, families see a caregiver’s first name and last initial, general area, services, availability, and distance — not their exact address. As a family and caregiver move toward working together, additional details are shared in stages: the specific address where care is provided is shared when an engagement begins, and full names are exchanged after the first completed visit.
• References: if a caregiver provides professional references, we store the reference’s name, relationship and contact details, and may share them with a family the caregiver has approved. A caregiver is responsible for having that person’s permission before providing their details.
• Service providers: with vendors who perform services on our behalf, such as background checks, payments, messaging, address geocoding, and security (see Section 4). They may only use the information to provide services to us.
• Legal and safety: when we believe disclosure is necessary to comply with law or legal process, enforce our agreements, or protect the rights, property, or safety of Covara, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

4. Service providers

We rely on trusted third parties to operate the Services. Depending on your role and activity, these may include:

• Payments: to collect payout details and process payments and transfers between families and caregivers.
• Background checks: to run criminal background screening for caregiver accounts (see Section 5).
• License verification: to confirm caregiver credentials.
• Messaging: to send email and text-message notifications and verification codes.
• Hosting: to provide the servers we run the Services on, including the server that carries an optional video interview between a family and a prospective caregiver.
• Address geocoding & mapping: to convert addresses into approximate coordinates for distance-based matching and to display coverage maps.
• Security: to protect sign-up and sign-in from automated abuse.

Each provider handles your information under its own privacy terms. We share only what is reasonably necessary for them to perform their function.

5. Caregiver verification & background checks

Every caregiver’s professional license is reviewed before they can offer care through the Services, through Checkr, Inc. where available, and otherwise manually by our team against the state licensing board’s public record (most states do not offer a real-time automated lookup).

Criminal background checks. Covara requires a criminal background check through Checkr, Inc. (checkr.com), a third-party screening partner, as a condition of every caregiver’s account becoming active. Checkr prepares a report on our behalf that may include criminal history and other public-record information, governed by applicable law including the Fair Credit Reporting Act (FCRA) where it applies. Before any report is requested, the caregiver is given a standalone disclosure and provides written authorization directly to Covara, separate from this Policy and our Terms of Service. A completed check may be recorded automatically from Checkr or, where it cannot be, confirmed manually by our team against Checkr’s own record, the issuing authority, or a document on file, with a recorded reason and an audit trail; the check itself is required either way and is never waived. Families should not assume a caregiver has passed a background check unless Covara affirmatively tells them so for that specific caregiver. The caregiver pays a one-time fee covering the cost of this check; see our Terms of Service for the fee amount and reimbursement terms.

6. Address, location & mileage data

We use the addresses you provide — including the care-recipient’s address, when different from the account holder’s — to calculate approximate distances between families and caregivers. When we display locations on maps or to other users before a connection is made, we generalize them (for example, to a neighborhood or city area) rather than showing an exact street address.

We do not continuously track your device’s real-time location. Two features use location in a limited, purpose-specific way: (1) when a caregiver clocks in or out of a visit, we check their device’s position against the care address to verify the visit happened, storing only a verdict and a rounded distance, never the raw coordinates; and (2) a caregiver may optionally start our mileage tracker to log a business trip for their own tax records, which records the trip’s path only while it is actively running and only because the caregiver started it.

7. Messaging & misuse detection

Messages between a matched family and caregiver are delivered through the Services and retained as part of your account records. To help enforce our Terms of Service — including the restriction on arranging care outside the Services described there — we use automated tools to screen message text and the free-text you enter elsewhere on the Services, including profile text, care-recipient notes, care-task notes and references, for patterns that look like contact information (phone numbers, email addresses, and similar). Profile text stays subject to this screening for as long as the profile exists, even after a family and caregiver have exchanged contact details. This is an automated pattern check, not routine human reading of your messages; it logs that a pattern was detected (and, depending on the surface, may block the message) without storing the underlying contact information itself. Covara staff may separately read message content as described in Section 8.

Activity patterns. To detect arrangements that have moved off the Services in breach of our Terms, we also look at patterns in scheduling activity — for example, a family and a caregiver who had a regular weekly booking both going quiet at the same time while the caregiver’s availability stays open. This produces a flag for a person at Covara to review. It is never the sole basis for charging the fee described in our Terms: a human reviews every flag, and we contact the family before invoicing.

8. How Covara staff access your account

Authorized Covara staff can view account information — including, where relevant to a support request or safety issue, your messages — to provide customer support, investigate reported issues or disputes, and maintain the safety and integrity of the Services. Staff may also, with a documented reason, temporarily open your account exactly as you see it to help diagnose a problem; this is logged, time-limited, and every action taken is attributed to the staff member, not to you. An administrator can also reset the two-factor method on an account — for example, when the account holder has lost the phone running their authenticator app. That reset requires a recorded reason, returns the account to emailed sign-in codes, cancels any backup codes, and signs the account out on every device; it does not give the administrator anything they could sign in with. All of this access is recorded in our security and audit logs (Section 1).

9. Cookies & local storage

The Services use browser local storage to keep you signed in and to remember basic preferences. We use minimal, functional storage necessary to operate the Services, along with a security check to guard against automated abuse. We do not use the Services to serve third-party advertising.

10. Data retention

We keep personal information for as long as your account is active and as needed to provide the Services. We may retain certain information after account closure where necessary to comply with legal obligations, resolve disputes, prevent fraud, maintain security and audit records, and enforce our agreements. Messages and administrative/security audit records are retained indefinitely and are not deleted even on request. When other information is no longer needed, we take reasonable steps to delete or de-identify it.

11. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit, hashing of passwords, multi-factor authentication, role-based access, and tamper-evident audit logging. Two-factor authentication is required on every account: unless you switch to an authenticator app, we use the email address on your account to send you a single-use sign-in code each time you sign in. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please protect your password and notify us promptly if you believe your account has been compromised.

12. Your rights & choices

You can review and update much of your profile information directly in your account. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. We do not sell personal information or share it for cross-context behavioral advertising.

To make a request, contact us at privacy@covara.care. We will verify your request and respond as required by applicable law. You will not be discriminated against for exercising these rights.

13. Children’s privacy

The Services are intended for adults 18 and older. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will take appropriate steps to delete it. Information about a care recipient should be provided by an adult authorized to share it.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised Policy.

15. Contact us

If you have questions or requests about this Policy or your personal information, contact us at:

Covara
Privacy inquiries: privacy@covara.care