Privacy Policy

Carearoo (“we”, “us”) provides software for allied health professionals. This policy explains how we handle personal information for customers in United Kingdom, under UK GDPR and the Data Protection Act 2018.

Privacy enquiries: info@carearoo.com

This distinction matters, and it is worth being precise about:

• Carearoo is the data controller for YOUR data: your name, email, practice details, registration number and billing records.
• YOU are the data controller for YOUR CLIENTS’ data, and Carearoo is your processor. That covers anyone you name on an invoice, and in future anyone you write a report about. You decide what is collected and why; we only process it to provide the service to you.

The obligations to inform your clients, to obtain any consent required, and to respond to their requests rest with you as the treating clinician. We support you in meeting them.

• Account information: name, email address, and the professional and practice details you enter.
• Invoice content: what you billed, to whom, and your own bank and tax details, so the invoice can be produced.
• Payment information: handled by Stripe. We never see or store full card numbers.
• Usage data: which features are used and when, to keep the service working and improve it.
• Support messages: anything you send us by email or the contact form.

We do not currently collect client health information from United Kingdom customers, because report drafting is not enabled in United Kingdom.

• Performance of a contract: to provide the service you signed up for and to take payment.
• Legitimate interests: to secure the service, prevent fraud and misuse, and improve the product. We balance this against your rights and do not use it for intrusive profiling.
• Legal obligation: where we must keep records, for example for tax.
• Consent: for optional marketing email only, which you can withdraw at any time.

When United Kingdom report drafting opens, client health information will be special category data under Article 9, and the Article 9 condition will rest with you as the treating clinician under Article 9(2)(h), which covers health or social care provided by a professional bound by professional secrecy. We will set this out in full before that feature is enabled.

Error monitoring (Sentry) is hosted in the EU, and personal information is stripped from error reports before they are sent.

We do not sell, rent or trade personal information. We use a small number of service providers, each under a written agreement:

• Supabase: database and authentication (Sydney, Australia).
• Stripe: payment processing.
• Resend: transactional email.
• Sentry: error monitoring (EU region, personal information stripped).
• Vercel: website hosting and delivery.

We may also disclose information where we are legally required to.

Your data and your clients’ data are never used to train AI models, not ours and not any third party’s. This is a contractual commitment with our AI provider, not a preference setting.

• Account data: for as long as your account is open, and then deleted or anonymised.
• Invoices: retained while your account is open so you can find them again; you can delete an invoice at any time.
• Billing records: kept as long as tax law requires.
• Error logs: a short rolling window, with personal information already stripped.

You have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased
• Restrict or object to processing
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these, email info@carearoo.com. We respond within one month, as the law requires.

If you are not satisfied with our response you can complain to the Information Commissioner's Office (ICO) , ico.org.uk, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

• Encryption in transit (TLS) and at rest (AES-256)
• Row-level security on every database table
• Authentication required on every server function
• Error monitoring configured to exclude personal information

No system is perfect. If we become aware of a breach affecting you, we will notify the Information Commissioner's Office (ICO) where required and tell you directly where the breach creates a real risk of significant harm.

We use only the cookies needed to keep you signed in and to keep the service working. No advertising cookies, no tracking pixels, and no third-party analytics that identify you personally.

We will tell you by email before any material change takes effect, and always before United Kingdom report drafting is enabled.