Privacy Policy

Carearoo (“we”, “us”) provides software for allied health professionals. This policy explains how we handle personal information for customers in United States, under applicable United States federal and state privacy laws.

Privacy enquiries: info@carearoo.com

This distinction matters, and it is worth being precise about:

• Carearoo is accountable for YOUR data: your name, email, practice details, registration number and billing records.
• YOU remain accountable for YOUR CLIENTS’ personal information under PIPEDA and your provincial health privacy law. Carearoo processes it on your behalf and under your instructions. That covers anyone you name on an invoice, and in future anyone you write a report about.

The obligations to inform your clients, to obtain any consent required, and to respond to their requests rest with you as the treating clinician. We support you in meeting them.

• Account information: name, email address, and the professional and practice details you enter.
• Invoice content: what you billed, to whom, and your own bank and tax details, so the invoice can be produced.
• Payment information: handled by Stripe. We never see or store full card numbers.
• Usage data: which features are used and when, to keep the service working and improve it.
• Support messages: anything you send us by email or the contact form.

We do not currently collect client health information from United States customers, because report drafting is not enabled in United States.

PIPEDA allows collection, use and disclosure only for purposes a reasonable person would consider appropriate, and generally requires your knowledge and consent. Our purposes are:

• To provide the service you signed up for and to take payment.
• To secure the service and prevent fraud and misuse.
• To meet record-keeping obligations, for example for tax.
• To send optional marketing email, where you have opted in. You can withdraw that at any time.

By creating an account you consent to these purposes. We will not use your information for a new purpose without telling you first.

When United States report drafting opens, client health information will be involved, and provincial health privacy law such as Ontario’s PHIPA may apply to you as a health information custodian. We will set out the arrangements in full before that feature is enabled.

Error monitoring (Sentry) is hosted in the EU, and personal information is stripped from error reports before they are sent.

We do not sell, rent or trade personal information. We use a small number of service providers, each under a written agreement:

• Supabase: database and authentication (Sydney, Australia).
• Stripe: payment processing.
• Resend: transactional email.
• Sentry: error monitoring (EU region, personal information stripped).
• Vercel: website hosting and delivery.

We may also disclose information where we are legally required to.

Your data and your clients’ data are never used to train AI models, not ours and not any third party’s. This is a contractual commitment with our AI provider, not a preference setting.

• Account data: for as long as your account is open, and then deleted or anonymised.
• Invoices: retained while your account is open so you can find them again; you can delete an invoice at any time.
• Billing records: kept as long as tax law requires.
• Error logs: a short rolling window, with personal information already stripped.

You have the right to:

• Access the personal information we hold about you and be told how it has been used and disclosed
• Challenge the accuracy of that information and have it corrected
• Withdraw consent, subject to legal and contractual restrictions
• Ask for your account and information to be deleted
• Complain to us, and then to the Office of the Privacy Commissioner of Canada

To exercise any of these, email info@carearoo.com. We respond within 30 days, as the law requires.

If you are not satisfied with our response you can complain to the Federal Trade Commission (FTC) , www.ftc.gov.

• Encryption in transit (TLS) and at rest (AES-256)
• Row-level security on every database table
• Authentication required on every server function
• Error monitoring configured to exclude personal information

No system is perfect. If we become aware of a breach affecting you, we will notify the Federal Trade Commission (FTC) where required and tell you directly where the breach creates a real risk of significant harm.

We use only the cookies needed to keep you signed in and to keep the service working. No advertising cookies, no tracking pixels, and no third-party analytics that identify you personally.

We will tell you by email before any material change takes effect, and always before United States report drafting is enabled.