Privacy Policy

Last updated: September 9, 2026

CareAria is a patient-led personal health journal. We do not sell your personal information. This policy describes what we collect and how we use it.

1. Information we collect

Account information: name, email, and profile photo from your sign-in provider (Google).
Health journal data you enter: medications, appointments, allergies, providers, visit notes, documents, and family sharing settings.
Optional Google Calendar data: if an owner connects Google Calendar, appointment titles, start times, durations, locations, and cancellation state sync both ways with a dedicated CareAria calendar. Clinical notes, visit summaries, diagnoses, attendees, and attachments are not sent to Google.
Usage data: basic analytics events (feature usage) and error reports to improve reliability.
Payment data: processed by Stripe; we store subscription status and customer identifiers, not full card numbers.

2. How we use information

We use your information to operate CareAria: authenticate you, store your journal, send reminders and invitations, process subscriptions, and improve the product. AI features send visit notes and audio you submit to Google Gemini to generate structured summaries. Google Calendar sync runs only after an owner explicitly connects it, and it can be disconnected from the appointments page.

3. Service providers

We use trusted processors to run CareAria, including:

Supabase — authentication, database, and file storage
Google Gemini — AI transcription and visit summary generation
Google Calendar — optional two-way appointment sync for a dedicated CareAria calendar created after owner consent
Stripe — subscription billing
Resend — transactional email
Google Places — provider and pharmacy search
Sentry — error monitoring when configured (with health-field scrubbing on the server)
Vercel — application hosting

4. Sharing

You control caregiver access to patient profiles. We do not sell personal information. We may disclose data if required by law or to protect rights, safety, and security.

5. Data retention and deletion

We retain your data while your account is active. You may request account deletion by contacting support. Backups may persist for a limited period after deletion. Disconnecting Google Calendar pauses sync and, after Google token revocation, removes CareAria's stored Calendar credentials. Local appointments remain. Choosing to forget the connection also drops CareAria's mapping records; it does not delete the Google calendar or CareAria appointments.

6. Security

We use industry-standard measures including encrypted transport (HTTPS), authenticated API access, and role-based sharing controls. Calendar tokens are encrypted at rest on the server. No online service can guarantee absolute security.

7. Your choices

You can update profile information, manage caregiver access, disconnect Google Calendar, and review AI-generated content before sharing it with family members. Connecting Calendar is owner-only.

8. Children

CareAria is intended for adults managing their own care or family care. Accounts must be created by an adult responsible for the patient profile.

9. International users

Data may be processed in the United States where our service providers operate.

10. Changes

We may update this policy. The "Last updated" date reflects the current version.

11. Contact

Privacy questions: support@carearia.com