Privacy Policy

CareRunner ("we", "us") provides software and a small concierge team that helps families coordinate care for a loved one. You can reach the privacy team through the in-app "Message the privacy team" page (/contact-privacy).

• Account information — your name, email, password (hashed), and the roles you take on (family admin, concierge, etc.).
• Care Circle data — the name and basic details of the person you care for, the family members and helpers you add, and the tasks you ask us to handle.
• Documents and attachments — anything you upload, such as bills, letters, prescriptions, or appointment paperwork. These may contain health or financial information.
• Medication records — names, doses, schedules, refills, and any side-effect notes you log.
• Provider call logs — notes from calls our concierges make to providers on your behalf, including the family-visible summary and internal notes.
• Rosie processing records — what was sent to Rosie, Rosie's response, and which user requested it.
• Usage and device data — pages you visit, basic device information, and error reports needed to keep the app running.

• To provide the service you asked for (contract — GDPR Art. 6(1)(b)).
• To protect the safety of the care recipient, e.g. consent guards and audit logs (legitimate interests — Art. 6(1)(f)).
• To process health-related information when you upload medical documents or medication records (your explicit consent — Art. 9(2)(a)). You can withdraw this consent at any time.
• To meet legal obligations such as breach notification (Art. 6(1)(c)).

• Members of your Care Circle, according to the role and permission you grant them.
• CareRunner concierges assigned to your tasks. Concierges only see the circles and documents they need for their work.
• Sub-processors that host or power the service. See our Sub-processors page for the current list.
• We do not sell your data and we do not share it with advertisers.

Some features use Rosie — for example, summarizing a document or drafting a call script. See the Rosie Processing Disclosure for the specific features, providers, and data sent. Rosie's suggestions are never acted on automatically; a human reviews them.

• Ambient Context is opt-in. You start each session yourself by tapping "Start an Ambient session" and re-affirming the Capture Notice. A red "Recording" chip stays pinned to the top of every page until you tap Stop, so you always know when capture is active.
• What's captured: short audio of the conversation, the names of any speakers you label, and any moments you tap "Remember this" on.
• Where it goes: audio is sent over TLS to ElevenLabs (our transcription sub-processor, see the Sub-processors page) for a one-off, private transcription. ElevenLabs does not use your audio to train its models. The audio is then deleted from CareRunner's storage; only the text transcript, a short plain-language summary, and the draft tasks you review are retained inside your Care Circle.
• What we never do: diagnose, change medications, triage "is this an emergency," or rank eligibility for benefits or healthcare. Those topics are stripped from the transcript before it's saved.
• Consent for other people on the call: laws on recording vary. In "all-party" jurisdictions everyone present must be told and agree before you record. You are responsible for getting that consent; in Call mode CareRunner plays an audible notice for all parties. You can stop or discard any session at any time.
• Deleting it: "Discard now" on a session removes the raw audio immediately. Deleting the session from the Review screen also removes the transcript, summary, and any draft tasks that haven't been accepted into the Care Circle.

• Account records: while your account is active, plus up to 30 days after deletion to recover from accidental deletion.
• Care Circle data, documents, and medication records: until you or a family admin deletes them, or until the account is deleted.
• Audit logs: kept for at least 6 years to meet HIPAA and similar record-keeping expectations. Audit entries are append-only and are not removed when you delete other data.
• Backups: encrypted and rotated regularly.

• Access — see what we hold about you.
• Export — download a copy of your data.
• Correction — fix anything that's wrong.
• Deletion — close your account and remove your data, subject to the legal-hold limits above.
• Withdraw consent — for any optional processing (e.g. marketing email or Rosie processing of new documents).
• Lodge a complaint with your data protection authority.
• To exercise any of these, message the privacy team through the in-app "Message the privacy team" page (/contact-privacy). We will respond within 30 days.

We use TLS in transit, encryption at rest, role-based access control, and an append-only audit log. We are not yet HIPAA-certified — see the Rosie Processing Disclosure for important limits on uploading US patient PHI.

Your data may be processed in the United States or the European Union depending on where our infrastructure providers are located. Where required, we rely on Standard Contractual Clauses.

CareRunner is intended for adults coordinating care for adults. We do not knowingly collect data from children under 16.

• Access — Settings → Privacy & Consents → "Download my data" gives you a JSON copy of everything we hold on you.
• Erasure — Settings → Privacy & Consents → "Delete my account" schedules permanent deletion 30 days out. You can cancel any time before that date by signing back in.
• Rectification, restriction, objection, portability — message the privacy team through the in-app "Message the privacy team" page (/contact-privacy) and we will respond within 30 days.

When this policy changes in a way that affects your consent, we will ask you to review and accept the new version the next time you sign in.