This policy governs all access to the CareVP Data Gateway (https://carevp.com/api/v1), including the dataset API, the Workspace API, and the CareVP MCP server. Every Data Gateway response carries an X-CareVP-License header pointing to this page. This policy supplements the Terms of Service, which control in a conflict. It applies through the agreement governing your approved access; it does not grant additional products or permissions.
1. Keys are per-organization and non-transferable
Your API key (and each member key issued under your organization) identifies your organization under your agreement with Care Papers, Inc. (d/b/a CareVP). Do not share it with, resell it to, or proxy requests on behalf of any third party. Each organization gets its own key; each teammate should use their own member key.
2. Business work products, not bulk replication
The Terms of Service, particularly Section 6, govern retention and use of results. You may keep reasonable excerpts in authorized AI conversations, analyses, presentations, and business records. An HTTP Cache-Control: no-store directive controls intermediary and browser caching; it does not prohibit those permitted work products.
Systematic downloads, warehouse replication, resale, persistent bulk retrieval indexes, and model training or fine-tuning require written permission and any necessary source rights. A written agreement may grant additional rights. Source-specific restrictions still apply, including restrictions under K.S.A. 45-230 on using names and addresses derived from Kansas public records for sales solicitation. Retain the source dates, attribution, and qualifications attached to results.
3. Your Workspace data is yours
Rows your organization creates in the Workspace API (accounts, contacts, notes, activities) are your data. You may export, cache, and store them freely; the bulk-replication restrictions in section 2 apply to CareVP's datasets, not to your own Workspace rows. CareVP hosts Workspace data in an isolated tenant, does not use it for any cross-customer product feature, benchmark, or analytic, and deletes it on termination per your agreement. Core CareVP dataset fields returned alongside Workspace rows (for example, enrich=core responses) remain governed by section 2.
4. No PHI or sensitive personal data in the Workspace
The Workspace is a business-relationship (B2B CRM) surface. Do not store protected health information (PHI), patient/resident data, or any data requiring HIPAA-grade handling in Workspace fields. CareVP provides no BAA for this surface. Business contact details of professional personnel (names, titles, work emails and phones) are within scope.
5. Throttling and revocation
CareVP may throttle, suspend, or revoke a key as reasonably necessary to respond to abuse, anomalous usage, a security concern, or a breach of this policy, subject to the notice and termination provisions in the Terms of Service. Rate limits and daily quotas for your tier are stated in the Data Gateway documentation and are enforced automatically.
6. Data carries vintages and no warranty
CareVP data products draw on public and other lawfully available sources. Review the source, reporting period, qualifications, and limitations supplied with a result. Data may change as publishers revise releases, and some requested information may be unavailable or held for review. Data and estimates are subject to the warranties and limitations in the Terms of Service; no additional data-quality warranty is created by this policy.
7. Attribution
Public-facing uses of gateway dataset content must carry the line: Data via CareVP (carevp.com); sources: CMS and other U.S. public releases as cited. Identify the actual sources rather than implying every result comes from CMS.
8. Contact
Questions, permission requests (including bulk-use requests under section 2), and security reports: legal@carevp.com / security@carevp.com.