> ## Documentation Index
> Fetch the complete documentation index at: https://docs.carescale.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These guides connect a treatment facility's website forms to Carescale. Each facility has one website forms endpoint: an endpoint address and a secret, both copied from Carescale under Settings, Website forms.
> Send every submission as an HTTPS POST with a JSON body and the header Authorization: Bearer <secret>. Use the endpoint address exactly as Carescale shows it. Never put it behind a redirect or a proxy that redirects.
> Keep the secret out of committed code and out of client-side JavaScript. Put it in wp-config.php or a server-side environment setting.
> Gravity Forms Elite and Nonprofit licenses can use the Webhooks Add-On with no code. Basic and Pro licenses use the snippet. Any other form tool follows the payload contract on the Other form tools page.
> Never use real patient or client details in examples, logs or test submissions. Use made-up names, the 555 phone range and example.com addresses.
> Labels in bold match the Carescale app and Gravity Forms exactly. Quote them as written.

# Privacy checklist

> Settings a facility's website needs before its forms send real inquiries to Carescale, to keep health information off the website.

A website inquiry to a treatment program is health information, and some of it is covered by 42 CFR Part 2. Carescale stores it securely, but a copy also sits on the website: in its database, its uploads folder, its emails and any service the form shares data with. This checklist keeps that copy small and short-lived.

Gravity Forms doesn't sign Business Associate Agreements and stores entries unencrypted. Your website host is the party that can sign one.

## Before real inquiries arrive

<Steps>
  <Step title="Delete entries after 1 day">
    In each form, open **Settings**, then **Personal Data**. Turn on retention and set entries to be deleted after **1** day. This also deletes uploaded files. Carescale has its copy within seconds, and the day leaves time for a late delivery.
  </Step>

  <Step title="Don't store IP addresses">
    In the same **Personal Data** settings, turn on the option that prevents storing the user's IP address.
  </Step>

  <Step title="Keep answers out of notification emails">
    Notification emails travel and sit in inboxes. Remove `{all_fields}` and any field merge tags from each form's notifications, so the email says only that a form was submitted. Staff get the details in Carescale.
  </Step>

  <Step title="Don't pass entries to other services">
    Don't connect these forms to Zapier, a CRM add-on, a mailing list or Akismet. Each one sends the answers to another company. Carescale is the only place the entry should go.
  </Step>

  <Step title="Block spam without sharing content">
    Keep Gravity Forms' honeypot on (it's on by default), and add a Cloudflare Turnstile field with the Turnstile add-on. Both work without sending the form's answers anywhere.
  </Step>

  <Step title="Keep logging off">
    Gravity Forms logging writes full entries to a file on the server, and the Webhooks Add-On's log also records the request headers, Carescale secret included, in plain text under `wp-content/uploads`. Leave it off. If you turn it on while troubleshooting, turn it off again with **click here to disable logging and permanently delete your log files**, and rotate the secret in Carescale.
  </Step>

  <Step title="No ad or analytics pixels on the form">
    Don't run advertising or analytics pixels, such as Meta, Google Ads or TikTok, on the form page or its confirmation page. They can send the page's contents and the visitor's identity to the ad network. Measure campaigns with the tracking keys Carescale records instead.
  </Step>

  <Step title="Get a BAA from your host">
    Ask your website host for a Business Associate Agreement, and serve the whole site over HTTPS.
  </Step>
</Steps>

## Ask only what the first call needs

A contact form needs a name, a way to reach the person, who the inquiry is for and an optional message. Admissions staff collect the rest on the call.

A "Verify insurance" form may also ask for date of birth, the insurance carrier, the member ID and insurance card photos, but only when:

* the website host covers the site under a BAA,
* entries and uploads are deleted after 1 day, and
* the form is served over HTTPS.

Never ask for a diagnosis, treatment history, medications or substance use on any public form. If the form has a free-text box, keep its prompt general, such as "How can we help?"

## Uploaded files

Gravity Forms saves uploads at public addresses on your site until retention deletes them. Anyone with the address can open the file. Carescale downloads each file within the hour and keeps its own copy on the lead, so 1-day retention is safe.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.