Privacy Policy
CareCircle holds health information about people who did not install the app themselves. This policy explains, in plain terms, what we collect, why, who can see it, and how to get it back or get rid of it.
The short version
- Your care circle's information is visible to the members of that circle and to nobody else. We do not sell it, rent it, or use it for advertising.
- We never use your care data to train AI models. AI assistance is off by default and, when you turn it on, only the text you select is sent.
- You can export everything we hold about you, and delete your account, from inside the app.
- Deleting your account does not delete the care records other members rely on — it removes your name from them. Section 8 explains exactly why.
- Data is stored in the United Kingdom on infrastructure operated by Supabase.
1. Who we are
CareCircle is published by zenski ("we", "us"), operating from Nepal. For the purposes of data-protection law we are the controller of the information described in this policy — we decide what is collected and why.
You can reach us about anything in this policy at info.zenski@gmail.com.
2. What we collect
We collect only what the app needs to work. There is no advertising identifier, no location tracking, no contact-list upload, and no advertising of any kind. We never sell or share your information, and we never use care content for analytics.
The app includes optional, off-by-default product analytics and crash reporting. Both stay switched off until you turn them on in Settings, and both are limited to a fixed list of events and fields that cannot carry care content — see 2.2.
2.1 Information you give us
| Category | What it includes |
|---|---|
| Account | Your name, email address, a securely hashed password, and your language preference. If you sign in with Apple or Google, we receive the identifier and email address that service returns — never your password. |
| Care circle | The circle's name, who is in it, each member's display name, role (administrator, caregiver, viewer) and stated relationship, and invitations you send. |
| Care recipient | The name, relationship and time zone of the person being cared for, plus anything you record about them (see 2.2). |
| Health information | Medications and schedules, doses given or missed, symptoms, vital signs, meals and hydration, mood, sleep, toileting, mobility, personal care, incidents and general notes; appointments, tasks, shift handovers and caregiver shifts; and the emergency profile (conditions, allergies, blood type, emergency contacts). |
| Documents | Files you upload — prescriptions, discharge letters, insurance papers and similar — together with their titles, categories and expiry dates. |
| Support correspondence | What you write to us, and the optional reason you give when deleting your account. |
2.2 Information collected automatically
| Category | What it includes |
|---|---|
| Device and session | A device label and platform, the time a session was last active, and a notification token so reminders can reach your device. Notification tokens are stored encrypted and are never returned to any app. |
| Subscription | Whether you hold a subscription, which plan and store it came from, the product identifier and renewal dates, and a record of each verification event. We never receive your card number or billing address — Apple and Google handle payment and tell us only whether the purchase is valid. |
| AI usage records | If you use AI assistance: who made the request, when, the type of request, the consent version accepted and whether it succeeded. The text you sent and the text that came back are not stored by us. |
| Product analytics (optional) | Only if you turn analytics on: which parts of the app are opened, whether onboarding finished, whether a subscription screen was seen or a plan started, and which plan limit was reached. Events come from a fixed list and carry a fixed set of fields — never a medication, a name, a note, or anything you have recorded. We do not attach your account to these events, so they count how the app is used rather than what you did. This is off unless you enable it. |
| Crash diagnostics (optional) | Only if you turn crash reporting on: the error, the technical stack trace, and basic device and app-version details. Messages are filtered before sending to strip web links, file paths, email addresses and long tokens, so care content does not travel with a crash. This is off unless you enable it. |
3. Information about other people
Most of what CareCircle holds is about somebody else — the person you care for, and sometimes their doctors or emergency contacts. Those people usually have not installed the app and cannot agree to this policy themselves.
Before you enter another person's health information, you must have the right to do so — because they have asked you to, because you hold power of attorney or an equivalent legal authority, or because you are their parent or guardian. If they are able to understand it, tell them their information is being kept in CareCircle and who in the circle can see it.
If you are recorded in a CareCircle circle and want to know what is held about you, or want it removed, write to us at info.zenski@gmail.com. We will normally need to work through the circle's administrator, because they hold the records and we cannot verify a relationship we cannot see — but we will act on a valid request.
4. How we use it
- To run the service — showing your circle's records, keeping devices in sync, and letting the right members see the right things.
- To send reminders — medication times, appointments, tasks and document expiry, including escalation to another member when a reminder goes unanswered.
- To keep an accurate care history — recording who entered or amended what, so a shared record can be trusted.
- To manage subscriptions — checking a purchase with Apple or Google and unlocking the corresponding features.
- To keep accounts secure — sign-in, session management, and letting you sign other devices out.
- To fix problems — responding to your messages, and (only with your consent) receiving crash reports.
- To meet legal obligations — responding to lawful requests and keeping records where the law requires it.
We do not sell or rent your information, use it for advertising or profiling, build a profile of you across other apps or websites, or use your care data to train any AI model.
5. Legal bases
If the UK or EU GDPR applies to you, these are the bases we rely on. Health information is a "special category" of data, which needs a stronger basis than ordinary data — for us that is your explicit consent, given when you create a circle and start recording care.
| Purpose | Basis |
|---|---|
| Providing the app and syncing your data | Performance of our contract with you |
| Storing and sharing health information within your circle | Explicit consent (Art. 9(2)(a)) |
| Reminders and push notifications | Performance of contract; device permission is consent you can withdraw |
| AI assistance | Consent — separate, versioned, and off by default |
| Crash reporting | Consent — off unless you enable it |
| Subscription verification and fraud prevention | Performance of contract; legitimate interests |
| Security, abuse prevention and service integrity | Legitimate interests |
| Responding to legal requests | Legal obligation |
Where we rely on consent, you can withdraw it at any time — that does not undo processing already carried out.
6. Who we share it with
We share information with the small number of providers needed to operate the app, each acting on our instructions, and with nobody else except as described below.
| Provider | What they process | Where |
|---|---|---|
| Supabase Database, storage, authentication |
Your account and all care data, and the documents you upload | United Kingdom (London region) |
| Google Firebase Push delivery, crash reporting |
Notification tokens and the notification payload; crash diagnostics if you enabled them | Google infrastructure, including the United States |
| Apple, Google Play Payments |
Your purchase; they tell us only whether it is valid | Per their own policies |
| AI provider (only if enabled) | Only the text you selected — see section 7 | Per the provider named in the app at the time you consent |
Push notification content. Reminders are delivered as data-only messages containing identifiers and a message type, not care details. Your device builds the visible text locally, and you can hide sensitive content on the lock screen in Settings.
Other members of your circle see the records in that circle according to their role. Administrators can invite and remove members, change roles, and see the full circle. Viewers can read but not change records. Choose who you invite carefully.
Temporary shares. If you create a temporary share link for a document, anyone holding that link can open it until it expires or you revoke it.
We may also disclose information if we are legally required to, or where it is necessary to protect someone's life or safety, or to establish or defend legal claims.
Where your data is stored. Your care records are held in the United Kingdom, on infrastructure operated by Supabase.
- If you are in the UK, your data does not leave the country.
- If you are in the EEA, your data is transferred to the UK, which the European Commission has recognised as providing an adequate level of protection.
- If you are anywhere else — including the United States and Canada — your data is transferred to the UK when you use the app.
We are established in Nepal, so we are outside the UK and the EEA even though your data is stored inside the UK. Where onward transfers to our providers are needed, they rely on adequacy decisions or on Standard Contractual Clauses.
7. AI assistance
CareCircle includes an optional AI writing aid that can tidy up a note, draft a handover summary, or translate text you have selected. It is not a medical tool and gives no diagnosis, treatment advice, interpretation of symptoms or vitals, or emergency guidance.
It is off unless two separate things happen: an administrator turns AI on for the circle, and you personally accept the current AI consent notice.
What is sent: the text you selected (up to 8,000 characters), the type of request, an identifier for the circle and care recipient, and the consent version.
What is never sent: your sign-in credentials, uploaded files or links to them, notification tokens, other members' data, or your circle's wider care history.
Nothing is saved automatically. Every suggestion is editable and becomes a record only when you confirm it.
Your text is passed through our own gateway, which holds the provider credentials; the app never contacts an AI provider directly. We do not use your content to train models and we require the same of our provider.
8. Retention and deletion
We keep information for as long as your circle is active. When you delete your account, the following happens.
8.1 A seven-day grace period
Deletion is scheduled seven days ahead, not carried out immediately, and requires you to have signed in recently. During those seven days you can cancel it from inside the app. This exists because deletion cannot be undone afterwards, and because it protects you if someone else gets a few minutes with your unlocked phone.
8.2 What is permanently deleted
- Your sign-in credentials, linked Apple/Google identities, sessions and any two-factor factors — the account can never be used again.
- Your email address, phone number and profile details.
- Your circle memberships, notification settings and notification tokens.
- Your subscription and purchase history, AI consents and AI usage records.
- Any data export archives previously generated for you.
8.3 What is kept, and why
Care records you wrote — a dose you logged, a symptom you noted, a handover you completed — are not deleted. They are kept for the circle, with your name replaced by "Removed member" everywhere it appears.
We do this because those records are the care recipient's health history, not yours alone. Other caregivers rely on them daily, and a clinician may too. If one caregiver leaving erased their share of the record, the remaining family would be left with a care history full of holes — and the person being cared for would lose information about their own health because of somebody else's decision.
After deletion those records can no longer be traced back to you through the app. If you are the only member left in a circle, there is nobody left to rely on the records, so the circle and everything in it is deleted outright.
8.4 Data exports
An export archive is available for seven days, then deleted automatically from our storage. Download links are generated fresh each time you tap download and expire after five minutes, so a copied link cannot be reused later.
8.5 Other retention
Backups are retained on a rolling basis and overwritten in the ordinary course; data deleted from the live service is removed from backups as they roll over. We keep the minimum records needed to show we complied with a deletion or export request, and anything the law requires us to keep, such as tax records relating to subscriptions.
9. Your rights
Depending on where you live, you may have the following rights. We honour all of them for every user, regardless of location.
- Access and portability — request a machine-readable copy of your data. In the app: Settings → Privacy & security → Export my data. It contains your own information and the records you authored; it does not contain records written by other members, because those are the care recipient's information rather than yours.
- Deletion — Settings → Privacy & security → Delete account, subject to section 8.
- Correction — edit your profile and records directly in the app, or write to us.
- Withdraw consent — turn off AI assistance, crash reporting or notifications at any time in Settings.
- Objection and restriction — ask us to stop or limit a particular use.
- Complain — to your local data-protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk).
If you are a California resident: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we will not discriminate against you for exercising your rights.
We respond to requests within 30 days. We may ask you to confirm your identity first — for health information, we would rather be slow than hand it to the wrong person.
10. Security
- Access is enforced at the database. Every table applies row-level security, so a member of one circle cannot read another circle's data even if the app is modified or the network traffic is replayed.
- Encryption in transit for everything, and at rest on our providers' infrastructure. Notification tokens are additionally encrypted before storage.
- Administrative keys never ship in the app. Credentials that bypass access control exist only on the server.
- Session control — see your active devices and sign out the others from Settings.
- Deletion requires recent sign-in, so an unattended unlocked phone cannot be used to destroy an account.
No system is perfectly secure. If a breach affects your rights we will notify you and the relevant regulator as the law requires.
11. Data on your device
CareCircle works offline, so a copy of your circle's data is stored on your device and synchronised when you reconnect. This copy is protected by your device's own security, which is why we ask you to keep a screen lock on it.
Signing out clears the local copy. You can also clear cached data and remove downloaded documents from Settings → Privacy & security. Uninstalling the app removes the local copy but does not delete your account — use the in-app deletion for that.
12. Age requirement
CareCircle is for people aged 16 or over. If you are under 18, you may use it only with the knowledge and permission of a parent or guardian, and you must not enter another person's health information unless your parent or guardian has confirmed you are entitled to.
The app is not directed at children under 16 and we do not knowingly collect their information as account holders. A care recipient may of course be a child, in which case their parent or guardian is responsible for what is recorded. If you believe a child under 16 has created an account, contact us and we will remove it.
13. This website
These pages set no cookies, run no analytics, and load nothing from a third party. Our host records standard server logs, including IP addresses, for security and reliability.
14. Changes
If we change this policy we will update the date at the top and raise the version number. For changes that materially affect your rights we will tell you in the app or by email before they take effect, and where the law requires it we will ask for your consent again.
15. Contact
Questions, requests or complaints: info.zenski@gmail.com. Please say which of your rights you are exercising so we can respond quickly.