Privacy Policy

1. Introduction

Caralyst Health, Inc. ("Caralyst," "we," "us," or "our") helps people find mental health providers who genuinely fit them. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our websites (including caralyst.io), the Caralyst matching platform (including my.caralyst.io and institution-specific sites such as wustl.caralyst.io), and related services (together, the "Services").

We built Caralyst for people in healthcare and the institutions that support them. We know exactly how sensitive it is to look for a therapist while you're a student or employee — this policy is written around that reality.

2. Information We Collect

Information you provide

• Account information — such as your name, email address, and the institution you're affiliated with.
• Matching questionnaire responses — your preferences about therapy needs, goals, identity, background, communication style, and practical factors (location, schedule, insurance). These responses exist for one purpose: matching you with compatible providers. We treat them as sensitive information with heightened protections, and they are never displayed publicly or shared with your institution.
• Appointment requests and communications — when you ask to connect with a provider or contact our team.
• Feedback and reviews — ratings or comments you choose to submit about providers or the platform.

Information collected automatically

• Device and browser information, IP address, and general location (e.g., city-level).
• Usage information, such as pages viewed, profiles clicked, features used, and session length.
• Cookies and similar technologies (see Section 9).

3. How We Use Your Information

• To match you with mental health providers based on your questionnaire responses and preferences.
• To connect you with providers you choose, and to facilitate appointment requests.
• To operate, maintain, secure, and improve the Services, including improving our matching algorithms.
• To produce aggregated, de-identified analytics about program adoption and engagement.
• To communicate with you about the Services (e.g., service updates, responses to your requests).
• To comply with legal obligations and protect against fraud, abuse, and unauthorized access.

4. How We Share Information

With providers — only at your direction

When you request an appointment or ask to connect with a specific provider, we share the information needed for that provider to respond to you. We do not otherwise give providers access to your questionnaire responses or account information.

With your institution — aggregate numbers only

If your access to Caralyst is sponsored by a school, hospital, employer, or other institution, that institution receives only aggregated, de-identified reporting — for example, overall adoption rates, engagement counts, and satisfaction statistics. We do not tell your institution whether you personally have used Caralyst, and we never share your name, questionnaire responses, matches, or appointment activity with them.

With service providers

We use trusted vendors to operate the platform — for example, cloud hosting (Amazon Web Services), analytics, and email delivery. They may process information only to provide services to us, under confidentiality obligations.

For legal reasons

We may disclose information if required by law, subpoena, or legal process, or where necessary to protect the rights, safety, or property of our users, the public, or Caralyst.

Corporate transactions

If Caralyst is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy's protections.

We do not sell your personal information, and we do not share your personal information with third parties for their own advertising or marketing.

5. Health Information & HIPAA

Caralyst is a matching and discovery platform — we are not a healthcare provider, we do not deliver therapy, and we do not create or hold your treatment records. Your relationship (and your records) are between you and the provider you choose.

Some of the information you give us — like why you're seeking therapy — is health-related and deeply personal. We protect all such information with safeguards aligned to the HIPAA Security Rule, including encryption in transit and at rest, role-based access controls, and audit logging, regardless of whether HIPAA formally applies to a given data flow. Where Caralyst processes protected health information on behalf of a covered entity under a business associate agreement, we comply with HIPAA as required by that agreement and applicable law.

6. Data Security

• Encryption of data in transit (TLS) and at rest.
• Role-based access controls and authentication for our systems.
• Logging, monitoring, and periodic security review of our infrastructure.
• Vendor diligence for the service providers that support the platform.

No method of transmission or storage is 100% secure, but protecting this particular kind of information is the core of our job, and we design for it.

7. Data Retention

We keep your information for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. You may request deletion of your account and personal information at any time (Section 8); we will delete or de-identify it unless we are legally required to retain it.

8. Your Rights & Choices

You may, at any time:

• Access the personal information we hold about you and request a copy.
• Correct inaccurate or outdated information.
• Delete your account and personal information.
• Opt out of non-essential communications.

To exercise any of these rights, email privacy@caralyst.io. We will respond to verified requests within 30 days. Depending on where you live, you may have additional rights under applicable law.

9. Cookies & Analytics

We use cookies and similar technologies that are essential for the platform to work (such as keeping you signed in), and analytics tools (such as Google Analytics) to understand how the Services are used so we can improve them. Analytics information is used in aggregate and is not used to advertise to you. You can control cookies through your browser settings; disabling essential cookies may affect platform functionality.

10. Children

The Services are intended for adults 18 and older and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will post the updated policy here with a new "Last updated" date and, where appropriate, notify you through the Services. Material changes will not retroactively reduce the protections described in Section 4 without your consent.

12. Contact Us

Questions, requests, or concerns about privacy:

• Email: privacy@caralyst.io
• Or use our contact form.

Caralyst Health, Inc. · Chicago, Illinois

See also our Terms of Service.