Privacy Policy

• About you: your name, email address, phone number (if you add it), your role in the circle, and your private weekly check-ins (only you can see those).
• About the person you care for: what the circle adds, such as name, birthday, conditions, allergies, medicines and doses, appointments, care notes, photos, voice notes, documents, emergency contacts, visits, costs, and answers to the benefits questions.
• When you use it: Activity (who viewed or changed what, and when), alert settings for each phone, and, for aides, where a visit was checked in, if they allow it.
• Payments: whether the circle has Premium, and the payment provider's reference. Card details stay with the payment provider.
• The waitlist: if you join it on our home page, your email address, who you are (family, agency, employer) and, if you give it, your ZIP code. We use it only to tell you when Heartfelt opens.

• We don't sell or rent information, and don't share it for advertising.
• There are no ads, no tracking pixels, no third-party analytics and no session recording in Heartfelt.
• We don't use the circle's information to train AI models.
• Alerts on the lock screen say only “You have a new update in Heartfelt”, never names or health details.

• Your circle: family members see the circle's information. Aides see only their visits and what they need for them.
• Agencies you connect see their own visits, check-ins and the notes you choose to share, and requests you send them. Nearby agencies you ask without connecting see an unnamed request.
• Care advisors see your messages, and the circle's information only while you share it. Each look is in Activity.
• Employers that sponsor Premium see totals only (how many people joined and used it), never names or anything about anyone's care. Figures under 5 are hidden, and nothing is shown below 50 people.
• Anyone with an emergency-sheet link you create sees that sheet for up to 24 hours, until you turn it off.
• Heartfelt staff only when needed to run or support the service, and every staff change is logged.
• When the law requires it, for example a valid court order. We'll tell you unless we're not allowed to.

They may handle information only to provide their service to us:

• Hosting, database, file storage and sign-in: [Supabase, under a Business Associate Agreement]
• The web app: [web host]
• Sign-in and invite emails: [email provider]
• Push alerts: Apple, Google or Mozilla carry the alert to your phone, encrypted so they can't read it.
• Payments: [Stripe]. We send only a reference to the circle, never health information.
• Voice notes typed as text: your phone's browser may send the recording to its maker's speech service (Apple or Google). Heartfelt asks first, and you can choose to just record.

• Care records: until the family deletes them or the circle.
• A deleted circle: 7 days (so it can be undone), then everything, files included.
• In-app updates: 90 days. Records of alerts sent: 30 days.
• Waitlist addresses: one year after you join.
• Activity, billing records and the staff log: 7 years [Lawyer: confirm periods].
• Backups roll over within [backup window].

• See and download everything about your circle (Settings, Your information): a full file and a short PDF summary.
• Correct anything directly in the app.
• Delete your account (anyone) or the circle (the main caregiver), from Settings.
• Stop sharing with an agency, advisor or emergency link at any time.
• Turn alerts off on any phone, and turn off voice-to-text.
• Depending on where you live, you may have more rights (for example in California or Washington, including under Washington's My Health My Data Act). Ask us at [privacy email]; we won't treat you differently for asking. [Lawyer: state-by-state notices and consent requirements for consumer health data]

Information is encrypted when it travels and when it's stored. Each person sees only their own circles, enforced by the database itself. Activity can't be edited by anyone, Heartfelt staff included. Shared tablets can sign out by themselves. If something goes wrong that affects your information, we'll tell you as the law requires [Lawyer: breach notice, including HIPAA where it applies].

Families use Heartfelt for themselves, so HIPAA usually doesn't apply to what a family keeps. When Heartfelt works on behalf of a home health agency or an employer health plan, we act as their business associate under a signed agreement and follow HIPAA for that information. [Lawyer: confirm after the HIPAA review]

Heartfelt is for adults. Accounts are for people 18 and older. Please don't add information about children.

• We'll show changes to this policy in the app before they apply, and ask again if a change affects how information is shared.
• Questions or requests: [privacy email], [mailing address].