Privacy

What this is

Care-Full is not a medical service and not a substitute for a doctor or pharmacist. It also hasn't been audited or certified against HIPAA or any other compliance standard, so don't rely on it where you must meet one.

What we store

• Your email address and password (sign-in is handled by Supabase's authentication service).
• For each profile you create: a name, an optional relationship and photo link.
• What you add to a profile: medications, doses you mark as given, restrictions, reminders, appointments and notes. Appointments and notes can contain anything you type, so keep sensitive details to what you need.
• Documents you upload (photos or PDFs of prescriptions or labels), and the information read from them, including a record of how you reviewed each field.
• A count of how many documents you've had read in the last 24 hours, to enforce a daily limit.

Who can see it

Your data is kept separate from other accounts. The database only lets a signed-in person read or change the data that belongs to their own account, and uploaded files are in a private file store that is opened only through short-lived links (15 minutes in the current code).

The people who run Care-Full manage the database and hosting, so they can technically reach stored data. [TO CONFIRM: who has that access, and how it is controlled and logged.]

Documents and the AI service

When you upload a document, the file is sent to an AI service provided by Anthropic, which reads it and suggests what it finds. Those suggestions are only drafts: you review every field and nothing is saved to a profile until you've confirmed, edited or discarded each one. Anthropic's own terms govern how it handles what we send. [TO CONFIRM: which Anthropic terms apply to our account, and whether data is retained or used for training.]

Other services we use

• Supabase: database, sign-in and file storage.
• Vercel: hosting the website.
• Resend: sending sign-up and password-reset emails. [TO CONFIRM]

[TO CONFIRM: where each of these stores data, and any other services involved.]

Cookies

We use cookies only to run the app: to keep you signed in, to remember which profile you're working in, and to remember your device's time zone so dates and reminders line up with your day. We don't use them for advertising. [TO CONFIRM: that no analytics or advertising tools are added.]

Deleting your information

You can delete a single appointment or note from its page. You can delete a document, which removes the uploaded file and the information read from it, from the Documents page. You can delete a profile, which removes its medications, dose history, restrictions, reminders, appointments, notes and documents, from that profile's settings. Deleting is permanent: there is no undo and no recycle bin.

To delete your whole account, email support@carefull.app. [TO CONFIRM: account deletion process and timing.]

[TO CONFIRM: whether backups exist, how long they last, and how deleted data leaves them.]

What we haven't settled yet

• [TO CONFIRM] How data is protected in transit and at rest.
• [TO CONFIRM] How long we keep data after you stop using Care-Full.
• [TO CONFIRM] Whether we ever share or sell data. (Nothing in the app does today.)
• [TO CONFIRM] Minimum age, and how we handle questions from people in other countries.