Privacy Policy

We built carilys for families like ours

We know what it's like to manage a parent's medications, dig through a drawer for an insurance card at midnight, and wonder if anyone remembered the afternoon pill. That's why we built carilys, and that's why we take your privacy as seriously as you take your loved one's care. This policy explains what data we collect, why, and exactly how we keep it safe.

What we collect

We only collect what's needed to coordinate care effectively. Nothing more.

• Account information: your name, email address, and phone number so your care team can identify and reach you.
• Health data: medications, conditions, allergies, appointments, and documents you choose to store, because that's the whole point of the app.
• Care activity: dose logs, calendar events, notes, and updates shared within your care circle.
• Crash reports: only if you turn them on in Settings (off by default), and never with health information. The app contains no usage-analytics tool.

How we protect it

Here's how we protect your family's health data.

• Encryption: your data is encrypted in transit and at rest by our cloud infrastructure. Health insurance and private insurance numbers get an extra layer of application-level encryption.
• Your data: we protect your personal information, ask for parental consent for children under 14, and you can request access to your data or its deletion at any time. Our application servers are hosted in Montreal (Google Cloud). Some processing (AI verification calls, telephony, email, notifications, crash reports) goes through providers outside Canada, described in our privacy policy.
• Biometric lock: the app requires fingerprint or Face ID. No one opens it without authorization.
• Auto-logout: the app locks automatically after inactivity to prevent unauthorized access if your phone is left unattended.
• No health data in analytics: our usage analytics never touch medications, conditions, or any personal health information. Ever.

Who can see your data

Your care circle, and only your care circle. Here's how it works.

• Only care team members you explicitly invite can see your loved one's information. Each member has specific permissions you control.
• We never sell your data. Not to advertisers, not to insurance companies, not to anyone. Full stop.
• Our infrastructure partners (Google Cloud and Firebase for hosting and real-time updates, in the Canadian region) process data under their terms of service and cannot use it for their own purposes.
• A very small number of people administer carilys's infrastructure and, as a result, technically have access to the hosted data. That access is used only for technical support, security and meeting our legal obligations, never for any other purpose.

Quebec Privacy Law (Loi 25)

carilys is built in Quebec, for Quebec families first. It is designed around the Loi modernisant des dispositions legislatives en matiere de protection des renseignements personnels (Loi 25), which gives you strong rights over your personal information.

• You have the right to know exactly what personal information we hold about you.
• You can request corrections to any inaccurate information at any time.
• You can ask for your account to be deleted: it's erased along with your profile. Information already shared in a care circle stays with your loved one's record, like the rest of their history.
• You can send any question or request about your personal information to privacy@carilys.app.

Children and young people

Very often, the person whose care is coordinated in carilys is a child. The account holder must always be an adult, and a child's information is protected with the same care as anyone else's.

• Children under 14: in Quebec, the law provides that consent to collect and use their personal information is given by the holder of parental authority or by the tutor. When a caregiver creates the profile of a child under 14 in the app, they confirm that they hold that authority, and the app records that confirmation, date and account, on the child's profile.
• Young people 14 and over: from age 14, a young person can consent for themselves. A parent can still create the profile and manage it with them.
• Automated voice calls: for a child under 14, they can only be turned on once that parental consent has been recorded. A parent can turn them off at any time.
• Access, correction and deletion: a parent can ask to see, correct, or delete their child's information at any time by writing to privacy@carilys.app.

Your rights

Your data belongs to you. These rights are promises, not fine print.

• Access: email privacy@carilys.app to ask what we hold about you or your loved one. A person on our team handles it, this isn't an automated feature in the app.
• Portability: on written request to privacy@carilys.app, a person on our team prepares a copy of your care data in a readable format. It's yours, not ours.
• Delete: ask us to delete your account. We erase it, along with your profile; care info already shared in a circle stays with your loved one's record.
• Withdraw consent: you can revoke data processing consent at any time by contacting us.

Changes to this policy

If we make meaningful changes to how we handle your data, we'll notify you by email and through the app at least 30 days before they take effect. We won't bury changes in fine print. you'll always know what's changing and why.