Privacy Policy

MyCareCompanion is a registered DBA of JB2S Enterprises, LLC, a Texas limited liability company based in the United States ("we," "us," or "our"). We make an app that parents and caregivers use to keep a day-to-day record of a child's care. This Privacy Policy explains what information we collect, how we use and protect it, where it is stored, who we share it with, and the rights you have. It applies to everyone who uses our website, our iOS and Android apps and related services (together, the "Service"), wherever you live. The country-specific sections near the end add the rights and details that apply to you under the law of your country.

1. Who is responsible for your information

JB2S Enterprises, LLC d/b/a MyCareCompanion is the controller (the organization responsible) for the personal information described in this policy. Our privacy contact is:

• Privacy Officer, JB2S Enterprises, LLC d/b/a MyCareCompanion
• Email: privacy@mycarecompanion.net
• Mail: JB2S Enterprises, LLC, PO Box 694, Helotes, TX 78023, United States

Where the law of your country requires us to appoint a local representative, that representative is named in the country section below.

2. Information we collect

2.1 Information you give us

• Account information: your name, email address, password, time zone, language and unit preferences, and your country.
• Family information: the names, dates of birth and relationships of the family members and caregivers you add.
• Child health information: the care records you choose to keep — medications and doses, behaviour, sleep, meals, health events, therapy notes, mood and any notes you write. This is health information and, in many countries, a special category of personal information that we protect accordingly.
• Provider information: contact details of healthcare providers you choose to connect.
• Communications: family chat messages, community posts, and support requests including any pictures you attach.
• Visit recordings: if you use visit transcription, the audio you record or upload of a healthcare appointment and the transcript made from it (section 5.3).
• Journal photographs and files: if you import records you kept elsewhere, the photographs or files you upload (section 5.2).
• Payment information: your billing name, address and card details are collected directly by our payment processor, Stripe; we see only the card brand, last four digits, country and the amounts charged.

2.2 Information collected automatically

• Device information (device type, operating system, browser, screen size) and the language your device reports.
• Log data (access times, pages viewed, IP address) kept for security and troubleshooting.
• Approximate location at the country level, derived from your IP address when you visit our public website, so we can show local prices, emergency numbers and legal terms. The IP address itself is not stored for this purpose.
• Usage of features inside the app, so we can see what is working.

We do not use third-party advertising or analytics trackers. Our visitor statistics are first-party and anonymous.

2.3 Mobile app data

• Push notification token: a device identifier used to send you push notifications (medication reminders, alerts, messages). It is stored on our servers against your account; it contains no personal information and cannot be used to track you across other apps.
• Device platform and name: whether you use iOS or Android, and an optional label (for example "iPhone") so you can manage your devices.

Both our iOS and Android apps use Firebase Cloud Messaging (a Google service) to manage push tokens, and deliver notifications through Apple Push Notification service or Google's service respectively. No health data is sent to Apple or Google. Only the device token and the notification itself (title, message text and a link identifier) pass through these services. Neither Apple nor Google has access to your health records, care logs or any child information.

3. How we use information and on what legal basis

We use your information to:

• Provide, maintain and improve the Service, including syncing your family's records across devices and caregivers;
• Generate insights and pattern analysis to help you understand your child's care (section 5.1);
• Send notifications, alerts and reminders you have asked for;
• Answer your questions and provide support;
• Process payments and prevent fraud;
• Keep the Service secure and investigate misuse;
• Meet our legal obligations.

Where your country's law requires a legal basis for each use (for example in the European Economic Area and the United Kingdom), we rely on: performance of our contract with you to provide the Service; your explicit consent for processing health information about your child, which you give when you create a child profile and can withdraw at any time by deleting the profile or the account; your consent for optional features such as AI reading of free-text notes and visit recordings; our legitimate interests in securing and improving the Service in ways that do not override your rights; and legal obligation for tax, accounting and lawful requests.

4. We do not sell or share your personal information

We do not sell, rent, trade or otherwise share your personal information or your children's health data with third parties for marketing purposes or any commercial gain.

Your family's data belongs to you. We will never sell your information to data brokers or advertisers, share your children's health information for marketing, use your data to build advertising profiles, or disclose your information to third parties without your explicit consent, except as described in section 5 or required by law.

5. Limited circumstances for disclosure

• With your consent: when you explicitly authorize us, for example to share a report with a provider you designate.
• Service providers: trusted vendors who help us operate the Service — Amazon Web Services (cloud hosting, storage, speech-to-text and AI processing), Stripe (payments), Microsoft (transactional email) and Google/Apple (push delivery, as described above). They are bound by contract to protect your data and use it only to provide their services to us. For health information, our AWS services operate under a signed Business Associate Agreement.
• Legal requirements: when required by law, court order or governmental authority, or to protect the rights, safety or property of you, us or others. We review every request and resist those that are overbroad.
• Business transfers: in a merger, acquisition or sale of assets, in which case you will be notified of any change in who controls your information and of the choices you have.

5.1 AI-assisted pattern analysis

To generate insights and identify patterns in your family's logged data, we use Anthropic's Claude models hosted on Amazon Web Services (AWS) Bedrock. AWS is our service provider for this processing and operates under a signed Business Associate Agreement. Anthropic does not receive or retain your inputs; Claude on Bedrock runs entirely within AWS infrastructure, and AWS does not use your data to train AI models.

What we send to the AI:

• By default: de-identified data only — your child's age band, broad diagnosis categories, medication classes (for example "stimulant" rather than the brand name) and numeric daily logs (sleep duration, behaviour counts, mood scores). We strip first and last names, exact dates of birth and free-text notes before the data leaves our servers.
• If you opt in (Settings → AI Insights → "Allow AI to read my notes"): we additionally include your free-text notes so the AI can interpret context that numbers alone cannot convey. This is off by default and can be turned off at any time. Opting in does not send historical notes retroactively.

Insights are stored in your account and shown only to you and the family members you have invited. Text produced by AI is labelled as such in the app. We do not make decisions about you or your child by automated means that have legal or similarly significant effects; insights are information for you and your child's care team to weigh, not conclusions.

5.2 Importing and exporting your data

Export. A parent on the account can download a copy of the family's data at any time, in several formats. The copy is built when you ask for it and sent directly to you; we do not keep it and never send it to anyone else. It does not include login credentials or payment card details.

Import. If you import records you kept elsewhere, the same AI service described above reads what you upload so it can suggest log entries. Nothing is added to your child's record until you have reviewed and confirmed it. Each import requires your consent at the time:

• Files (CSV, spreadsheet, text): your child's first name is replaced with a placeholder before the text is sent. Other details in the file — dates, notes, medication names — are sent as written, because they are what is being read.
• Photographs of a paper journal: the pictures are sent exactly as taken. We cannot remove a name or other detail written on the page, so anything visible in the photograph is seen by the AI service. Please photograph only the pages you want read.

Uploaded files and photographs are deleted from our storage as soon as the import is saved, and in any case within 30 days; you can also discard an import at any time. An import never adds or changes a medication on its own.

5.3 Visit recording and transcription

If you record a healthcare appointment in the app, or upload a recording, the audio is stored in your child's record on our servers and transcribed by Amazon Transcribe, a speech-to-text service provided by AWS under the same Business Associate Agreement. The transcript is then read by the AI service so it can suggest log entries. Nothing is added until you confirm each suggestion. Recordings can be transcribed in the language you set for your account.

Recording a conversation may require the consent of everyone in the room under the law where you are; the app reminds you of this and it is your responsibility to ask. The recording and transcript are shown only to you and the family members you have invited, are never used to train AI models, and are kept until you delete the visit. Deleting the visit deletes the audio, the transcript and the transcription job at AWS.

6. Where your information is stored, and international transfers

Your information is stored and processed in the United States, in Amazon Web Services data centres in the US East (Northern Virginia) region, and is accessed by our team in the United States. If you live outside the United States, your information is transferred to and processed in the United States, where privacy law may differ from the law of your country. We protect it there with the same safeguards described in this policy regardless of where you live.

• Canada: information about Canadian users is stored in the United States and may be accessible to US authorities under US law. Section 7 describes the safeguards we apply, and section 12.1 your rights under Canadian law.
• European Economic Area, United Kingdom and Switzerland: we transfer personal information to the United States under the European Commission's Standard Contractual Clauses (and the UK Addendum / International Data Transfer Agreement), supplemented by the technical safeguards in section 7. Our processors (AWS, Stripe, Microsoft, Google) are bound by the same mechanisms or are certified under the EU-US Data Privacy Framework. You can request a copy of the relevant clauses from privacy@mycarecompanion.net.
• Australia and New Zealand: by using the Service you acknowledge that your information is disclosed to our service providers in the United States. We take reasonable steps to ensure they handle it in a way consistent with the Australian Privacy Principles and the New Zealand Information Privacy Principles.

7. Data security

• Encryption of data in transit (TLS) and at rest (AES-256);
• Secure authentication, session controls and per-device sign-out;
• Access controls that limit our staff's access to personal information to what is needed to support you, with every administrative action logged;
• Regular security assessment and monitoring;
• Encrypted, redundant backups.

No method of transmission or storage is completely secure. If a breach affects your information we will notify you, and the authorities we are required to notify, without undue delay and within the time limits set by the law that applies to you.

8. How long we keep information

We keep your personal information for as long as your account is active or as needed to provide the Service. You can delete your account at any time: in the app or on the website, open Settings → Delete My Account, confirm with the six-digit code we email you, and the account enters a 30-day deletion window during which you can restore it (within the first 14 days, from the email we send). If you cannot sign in, you can request deletion at www.mycarecompanion.net/delete-account. After the window we remove your personal information from our active systems within 30 days, and from encrypted cold backups within a further 90 days, except where retention is required by law or to resolve a dispute. Payment records held by Stripe are retained by Stripe as financial regulations require; they contain your name, email and billing details but no health information.

9. Your rights

Wherever you live, you can:

• Access the personal information we hold about you and your family;
• Correct inaccurate or incomplete information (most of it directly in the app);
• Delete your information (section 8);
• Export your data in a portable, machine-readable format (Settings → Data Services);
• Withdraw consent for optional processing at any time, for example AI reading of notes or visit recordings, without affecting the rest of the Service;
• Object to processing based on our legitimate interests, and ask us to restrict processing while a question is resolved;
• Complain to the privacy regulator in your country (named in section 12). We would appreciate the chance to address your concern first.

To exercise a right, use the controls in the app or email privacy@mycarecompanion.net. We may need to verify your identity. We respond within 30 days (one month in the EEA and UK), and tell you if we need longer. There is no charge unless a request is manifestly unfounded or excessive.

10. Children's privacy

The Service is designed for adults — parents, guardians and caregivers — to record the care of children. We do not knowingly collect personal information directly from children, and children do not have accounts. All information about a child is entered by a parent, legal guardian or caregiver they authorized, who is responsible for having the authority to do so. Where your country sets a minimum age for consenting to online services (13 in the United States, 16 in parts of the EEA, 18 elsewhere), you confirm that you are above it by creating an account. If you believe a child has provided us information directly, contact us and we will delete it.

11. Third-party links

The Service may link to third-party websites or services (for example a drug authority's public monograph). We are not responsible for their privacy practices and encourage you to review their policies.

12. Country-specific information

12.1 Canada

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where it applies, substantially similar provincial private-sector law (Québec, Alberta, British Columbia). Our Privacy Officer, reachable at privacy@mycarecompanion.net, is accountable for our compliance and answers access and correction requests within 30 days. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner.

Québec (Law 25). We do not currently offer the Service to residents of Québec, and the registration form does not accept a Québec address. If we hold information about you anyway (for example because you moved), the person in charge of the protection of personal information is our Privacy Officer, above; your information is stored in the United States with the safeguards in sections 6 and 7; you have the rights to access, rectification, withdrawal of consent, de-indexing and portability under the Act respecting the protection of personal information in the private sector, and may complain to the Commission d'accès à l'information du Québec. This policy and our Terms are available in French.

If you connect a healthcare provider who is a custodian of health information under Ontario's PHIPA or Alberta's HIA, that provider remains responsible for the records they hold; our Service holds only what you and your family enter.

12.2 United Kingdom

We comply with the UK GDPR and the Data Protection Act 2018. The legal bases we rely on are in section 3; health information about your child is processed on the basis of your explicit consent. You have the rights in section 9 and may complain to the Information Commissioner's Office (ico.org.uk). International transfers are described in section 6. If we are required to appoint a UK representative, their details will be published here.

12.3 European Economic Area and Switzerland

We comply with the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection. The legal bases we rely on are in section 3; health information about your child is a special category processed on the basis of your explicit consent (Article 9(2)(a)). You have the rights in section 9 and may complain to the supervisory authority of the country where you live or work (for example the CNIL in France, the AEPD in Spain, the BfDI or a state authority in Germany, the CNPD in Portugal, the APD in Belgium, the DSB in Austria, the DPC in Ireland). Our representative in the European Union under Article 27, once appointed, will be named here with their contact details. International transfers are described in section 6.

12.4 Australia

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Health information is sensitive information collected only with your consent. Information is disclosed to our service providers in the United States (APP 8), as described in section 6. You may complain to us first and then to the Office of the Australian Information Commissioner (oaic.gov.au). We will notify you and the OAIC of an eligible data breach as the Notifiable Data Breaches scheme requires.

12.5 New Zealand

We comply with the Privacy Act 2020 and its Information Privacy Principles. Your information is disclosed to our service providers in the United States (IPP 12) with the safeguards in sections 6 and 7. You may complain to the Office of the Privacy Commissioner (privacy.org.nz).

12.6 United States

We are not a covered entity under HIPAA; the information you enter is yours, and we protect it with HIPAA-grade practices and Business Associate Agreements with our health-data processors. Residents of states with consumer privacy laws (including Texas, California, Colorado, Connecticut and Virginia) have the rights in section 9 and may appeal a decision by writing to privacy@mycarecompanion.net with "Appeal" in the subject line. We do not sell personal information or use it for targeted advertising.

12.7 Other countries where we offer the Service

If you live in a country not listed above where we offer the Service (including Hong Kong, Singapore, Israel, Bermuda, and countries in Central America, South America and the Caribbean), your information is collected with your explicit consent, stored and processed in the United States as described in sections 6 and 7, and protected by the same safeguards. You have the rights in section 9, including access, correction, deletion and withdrawal of consent, whatever your local law calls them. Where your country's privacy law grants you additional rights or the right to complain to a local authority, those rights are unaffected by this policy. Hong Kong: we handle personal data in line with the Data Protection Principles of the Personal Data (Privacy) Ordinance. Singapore: we follow the Personal Data Protection Act 2012; our designated data protection officer can be reached at privacy@mycarecompanion.net. Israel: we handle data in line with the Protection of Privacy Law, 5741-1981. The English version of this policy governs; translations are provided for convenience.

13. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "Last updated" date and, for material changes, notify you in the app or by email before they take effect. Continued use of the Service after the effective date means you accept the updated policy.

14. Contact us

Questions, concerns or requests about this policy or our privacy practices:

Privacy Officer, MyCareCompanion
Email: privacy@mycarecompanion.net
JB2S Enterprises, LLC, PO Box 694, Helotes, TX 78023, United States