Privacy Policy

• Account and organization. Your name, email, password (hashed — we never see the plaintext), and your funeral home's name, license number, and phone. We store organization membership, roles, and teammate invitations. Sign in with Google and we receive your name and email from that provider.
• Case and decedent data. The decedent's identifiers (name, date and place of death, service date, demographics), the informant/family contact (name, relationship, phone, email, address), and the disposition and status recorded on the case — whether entered by your staff or submitted by the family through a secure link you send.
• Medical certification content (sensitive). When a physician, coroner, or medical examiner completes the cause-of-death worksheet through a secure link, or your staff upload a completed worksheet, we receive and store the medical content — the cause-of-death chain, contributing conditions, manner of death, autopsy findings, and the certifier's name, title, license number, and typed signature. We treat this as sensitive: it is encrypted, scoped to the submitting organization, and used only to prepare and progress the case. An uploaded worksheet may be read by an AI model to extract its fields, which your staff review before it is applied. We never use it for marketing, advertising, or model training.
• Contacts and office-behavior directory. The professional parties we contact for you — physician offices, coroner/ME offices, county registrars — with operational metadata: preferred channel, typical response time, hours, and phone-tree notes. Aggregate, anonymized office statistics (such as an office's typical turnaround) may be shared across customers to make chases more effective; that aggregate never includes decedent or case details.
• Call recordings, transcripts, and provenance. For each call the agent handles we store the recording, a transcript (automatically redacted for medical content before storage), the channel used, and the extracted outcome. We keep a provenance ledger — each fact the agent gathered, who asserted it, when, and from which call, email, or fax — so the case shows where every status came from.
• Documents and faxes. Documents uploaded to a case, worksheet PDFs the platform generates, and faxes sent (and, where enabled, received).
• Secure-link (magic-link) tokens. Some pages are reached through expiring tokenized links rather than a login — the certifier worksheet, the family intake form and status portal, and the one-off "ask" links the agent sends. We store the tokens, their expiry, and what is submitted through them. These links are unlisted and time-limited; anyone holding a link can open the page, so they should not be forwarded.
• Usage and logs. Server logs (IP, browser, timestamps), in-app actions, and the audit trail of every event on a case.

Some of this is "Sensitive Personal Information" under the California Consumer Privacy Act — the medical certification content and the contents of call recordings and transcripts. We do not collect Social Security numbers as part of the chase, and we use sensitive information only to provide the service you requested.

• Run the cases and chases you authorize — the calls, emails, and faxes to the parties you direct us to.
• Record and transcribe calls, and keep the provenance ledger of what was said and by whom.
• Prepare case documents, including the registry-ready worksheet content your staff enter into the state EDRS.
• Surface each extracted outcome for you to confirm — we do not act on it silently.
• Maintain the per-office behavior directory so future chases work better.
• Notify you about case progress and anything that needs you.
• Bill under your agreement with us (see the Terms; fees are set out in your invoice).
• Provide support, maintain security, prevent fraud, and meet legal obligations.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use case or medical data to train AI models.

We share information only with service providers under contracts that restrict their use to serving CaseChase:

• Supabase — database, file storage, and authentication.
• Vercel — application hosting.
• Vapi — places, receives, records, and transcribes calls; call audio is stored with Vapi, which uses telephony, speech, and AI-model subproviders to run the live conversation.
• AI model providers (currently Anthropic, and Groq via the voice platform) — run the assistant, extract worksheet fields, and classify outcomes.
• Resend — transactional email.
• Documo — fax transmission.
• Stripe — payments and invoicing (we do not store card numbers).

We also disclose information when required by law, and may transfer it to a successor in a merger, acquisition, or sale of assets, in which case the successor is bound by this policy. We do not share information with advertisers or data brokers. Our providers are in the United States; if you use CaseChase from elsewhere, your information is processed in the U.S.

CaseChase personnel can access customer workspaces to provide support, investigate problems, and administer the platform. That access is granted to named platform administrators, each session is logged in an internal audit trail, and actions taken this way are attributed to CaseChase in the case history — not to your staff. We access the minimum necessary.

• Recorded, and disclosed. We treat every call as an all-party-consent call regardless of the state called, consistent with California Penal Code § 632. The assistant's first words on every call disclose the recording and that the caller is an automated assistant, in substantially this form: “Hi, this is Chase, an automated assistant for [Funeral Home]. This call is recorded.” We do not impersonate a live person.
• Calls to families (TCPA). Where a call would reach a family member or other consumer, the funeral home is responsible for obtaining any consent required under the Telephone Consumer Protection Act before directing that call. When a contacted party asks not to be called again, the agent records that against the contact.

We keep account and case information while your account is active. Case records — worksheet content, documents, recordings, transcripts, and the audit trail — are kept as the account of exactly what was done on your behalf. After account closure we retain case records for up to seven (7) years, consistent with vital-records and funeral-home recordkeeping timeframes, or longer under a legal hold. Deletion within that window happens on verified request (Section 7). Call audio is stored with our voice provider and subject to its retention terms as our processor.

If you are a California resident, you may:

• Know — request a portable copy of the personal information we hold about you.
• Delete — request deletion, subject to the retention exceptions in Section 6.
• Correct inaccurate personal information.
• Limit our use of Sensitive Personal Information (we already use it only to provide the service).
• Opt out of sale or sharing — we do neither, so this is satisfied automatically.
• Non-discrimination for exercising any of these.

A self-serve data export and account deletion are available in your account settings — export downloads your account's data, and deletion closes the account immediately with case records following the retention schedule. To exercise any right that the settings lanes don't cover, email hello@casechase.co from the address on your account. We verify identity before processing and respond within 45 days (extendable once with notice).

We use reasonable safeguards, including encryption in transit and at rest, row-level access controls scoped to your organization, and audit logging. No safeguard is perfect; if we discover a breach of unencrypted personal information, we will notify affected California residents under California Civil Code § 1798.82. We use only strictly necessary cookies — primarily the session cookie that keeps you logged in — and no analytics, advertising, or cross-site tracking cookies.

We handle the medical certification content in Section 1 with encryption, organization-scoped access, and audit logging, and use it only to prepare and progress the case. A funeral home is generally not a HIPAA covered entity, so we do not operate as a HIPAA business associate; where the California Confidentiality of Medical Information Act applies to what we hold, we handle it consistently with that act. Transcripts are automatically redacted for medical content before storage; raw call audio is not yet redacted and is held with our voice provider under authenticated access.

CaseChase is a business product for licensed funeral homes and is not directed to anyone under 18; we do not knowingly collect information from children under 16. We may update this policy and will update the date above; for material changes we will notify you by email or in-app notice at least 30 days ahead.

Questions or requests: CaseChase Incorporated, hello@casechase.co.