What we're building

Care Colab helps people coordinate care situations together. As we develop our platform, we're focused on:

• Keeping your information secure and private
• Building features that respect your privacy needs
• Storing data in Canada and following Canadian privacy best practices
• Giving you control over what you share and with whom
• Being transparent about how we handle your information

What information we collect

Information you give us

• Account details - your email address, profile name, avatar, and preferences
• Lab content - the names, notes, tasks, calendar events, and messages you add to a Lab
• Files you upload - documents, images, and other attachments you add to a Lab, along with any labels or notes you give them
• Anything you choose to record about a care situation, which may include health-related details such as medications, appointments, or medical notes
• Messages you send us through the contact form or by email

Information we collect automatically

• Basic technical information needed to serve the app - IP address, browser type, and device type
• Aggregate usage information, such as which pages are viewed
• Error reports and diagnostic logs, so we can find and fix problems
• Your subscription status - which plan you're on and whether it's active

What we don't collect

• Precise location data
• Your contacts or address book
• Advertising identifiers or cross-site browsing history
• Your credit card number - payments are handled entirely by Stripe

How we use your information

We use your information to run Care Colab and for nothing else. Specifically:

• To provide the service - creating and managing Labs, tasks, calendar events, files, and sharing
• To sign you in and keep your account secure
• To send you the emails the product depends on - sign-in codes, Lab invitations, and important account notices
• To generate AI summaries and extract text from images, when you ask for them
• To manage your subscription and apply the limits of your plan
• To fix bugs, keep the service reliable, and understand which features people use
• To answer your questions when you contact us

We do not use the contents of your Labs for advertising, profiling, or anything unrelated to running Care Colab.

Canadian data storage

We know data residency matters to the people who use Care Colab. That's why:

• Your Labs, documents, and conversations are stored in Canada, on Canadian infrastructure
• We follow Canadian privacy best practices in how we handle your information
• We're committed to maintaining Canadian data residency as we grow

What crosses the border, and when

Storage is Canadian, but a few parts of running the service involve providers outside Canada. We think you should know exactly which:

• AI features - when you request an AI summary or text extraction, that specific content is processed by Google's Gemini service, which may run outside Canada
• Email delivery - sign-in codes, invitations, and account emails are sent through Resend, a US provider, which receives your email address and the message contents
• Payments - Stripe processes subscription payments and handles your billing details
• Site delivery - our website and web app are served through Vercel's global network, which sees the technical details of your requests

While information is held by a provider in another country, it may be accessible to the courts and authorities of that country under its laws. We choose providers with strong privacy commitments and contractual protections, and we share only what each one needs to do its job.

How we share your information

Running Care Colab depends on a handful of specialist companies that handle parts of the service for us. They act on our instructions, they only ever receive what their specific job requires, and none of them may use your information for their own purposes. Here's the complete list:

What people in your Lab can see

The other kind of sharing is the one you do yourself. When you share a Lab or join someone else's, the other people in that Lab can see:

• Your profile name and avatar
• The content you add - tasks, notes, calendar events, files, and messages
• Your activity in that Lab, such as completing a task or uploading a document

This is how Care Colab works - it's what lets a group coordinate care together. Labs are private by default, and you decide who gets in and what they can do. Sharing inside a Lab is always your choice.

Sign-in and your account

Care Colab supports several ways to sign in, each with different privacy considerations:

• Google, Microsoft, and Apple sign-in - these providers authenticate you and share basic profile information (name and email) with Care Colab. We don't receive your passwords or payment information from them
• OTP sign-in - we send a one-time verification code to your email address
• Guest access - you can join a shared Lab without creating an account. Guest sessions are temporary and tied to your browser. Guests can upgrade to a full account at any time to preserve their access
• We store your profile name, avatar, and preferences to personalize your experience

AI features and data handling

Care Colab offers AI features to help generate summaries and organize information when you choose to use them.

• AI features such as summaries and image text extraction are only used when you choose to activate them
• We use Google Gemini behind the scenes to process the relevant content needed for those features
• Only the content needed for that specific request is sent - not your entire Lab, and not the Labs you haven't asked about
• Care Colab defines the structure and templates used for summaries; Gemini helps generate the output
• We do not use your Labs or conversations to train AI models
• Our paid Google setup is designed so your data is not used for training

AI summaries are a convenience for organizing what you've already written down. They are not medical advice, and they're not a substitute for guidance from a healthcare professional. Always check anything important against the original source.

Learn more about Google's data usage policies.

Where HIPAA fits in

People sometimes ask whether Care Colab is HIPAA compliant, so here's a straight answer.

Care Colab is a tool for families and care circles - not a healthcare provider, health plan, or clearinghouse. That means we aren't a "covered entity" or a "business associate" under HIPAA, the US health privacy law, and the information you keep in a Lab isn't regulated as Protected Health Information. We don't sign Business Associate Agreements.

What matters more is what we actually do with it. We treat everything in your Labs as sensitive personal information:

• Stored in Canada and encrypted in transit and at rest
• Visible only to the people you've chosen to share a Lab with
• Never sold, never used for advertising, never used to train AI models
• Handled under Canadian privacy law, which applies to us regardless of where you live

If you're a healthcare organization with specific compliance requirements, get in touch and we'll tell you honestly whether Care Colab is a fit today.

How we protect your information

We take security seriously and use industry-standard practices to protect your information.

• Secure connections (HTTPS/SSL) for all data transmission
• Your data is encrypted at rest in our database and file storage
• Secure authentication to protect your account
• Row-level security enforced at the database layer
• Sharing PINs are hashed with bcrypt and never stored in plain text
• Rate limiting on sign-in to guard against brute-force attempts
• Regular security updates and monitoring
• Access controls help ensure only authorized users can access shared information
• Labs are private by default, with PIN-protected sharing when you choose to share

You're in control

Your information belongs to you. With Care Colab, you can:

• Choose exactly what information you add to your Labs
• Control who can see and access your shared Labs with granular permissions
• Delete your account at any time - all Labs you own and their contents are permanently removed. In shared Labs where you're a collaborator, your contributions remain visible as "Deleted User"
• Keep Labs completely private or share them only with people you trust
• Ask us questions about how your data is used

Your rights under Canadian privacy law

Care Colab operates under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Under it, you have the right to:

• Know what personal information we hold about you and how it's being used
• Access a copy of that information
• Correct anything that's inaccurate or incomplete
• Withdraw your consent at any time, subject to legal and contractual limits - in practice, deleting your account withdraws it completely
• Delete your account and its contents
• Receive your information in a portable format you can take elsewhere

To exercise any of these, email us at support@carecolab.ca from the address on your account. We'll confirm it's you and respond within 30 days.

If you're not satisfied with how we've handled a privacy concern, you can complain to the Office of the Privacy Commissioner of Canada. We'd rather hear from you first, though - we'll do our best to put it right.

If you live outside Canada, you may have additional rights under your local privacy law, such as the GDPR in Europe and the UK. We'll honour those requests on the same terms.

How long we keep your information

• While your account is active, we keep your information so the service works as you'd expect
• Your Labs and files stay until you delete them or delete your account - we don't remove content on our own schedule
• Changing or cancelling a paid plan never deletes anything. Your existing files stay where they are; your plan's storage limit applies to what you add next
• When you delete your account, all Labs you own and their contents are permanently removed. Your contributions to other people's shared Labs remain, attributed to "Deleted User"
• Deleted content may persist in encrypted backups for a short period - up to 30 days - before those backups are cycled out
• Calendar subscription URLs are deleted along with your account
• Emails you send us through the contact form or to our support address are kept as long as we need them to answer you and keep a record of the conversation

Calendar subscriptions

You can subscribe to your Care Colab calendar from Apple Calendar, Google Calendar, Outlook, or any iCal-compatible app. Here's what to know:

• Your subscribe URL uses a unique token as its only credential - anyone with the URL can read your calendar data, so treat it like a password
• The feed includes calendar event details, notes, locations, and tasks with due dates
• You can revoke and regenerate your subscribe URL at any time from the Calendar settings
• Calendar subscription URLs are automatically deleted when you delete your account
• Lab owners can restrict collaborators from accessing a lab's calendar, which also disables the iCal feed for that lab

Payments and subscriptions

• The Free plan needs no payment information at all - we never ask for a card to get started
• If you upgrade to Pro or Max, checkout is handled entirely by Stripe. Stripe collects your payment method and billing details directly and handles them under its own privacy policy
• We never see or store your credit card number
• What we receive back from Stripe is your subscription status - which plan you're on, whether it's active, and the billing email tied to it - so we can apply the right plan to your account
• You can cancel at any time from your account settings

Renewal, cancellation, refunds, and what happens if a payment fails are covered in our Terms of Service.

Cookies and analytics

We keep this deliberately minimal.

• Essential storage only - your browser stores your sign-in session and your preferences, so you stay logged in and the app remembers your settings. The service can't work without these
• We use Vercel Web Analytics to understand which pages people visit. It's cookieless, doesn't set a persistent identifier, and can't follow you to other websites - we see aggregate page views, not individual people
• No advertising cookies, no cross-site trackers, no session recording, no data brokers

We're planning to move analytics onto our own Canadian infrastructure so that even this aggregate data stays in Canada. We'll update this policy when that's live.