Controller: CareCircle, currently operated within the University of Michigan by its employees ("CareCircle", "we", "us", or "our").
What this policy covers. This Privacy Policy explains how we collect, use, disclose, and protect information when you use CareCircle's website and apps, including private Circles and community Circles that are visible to logged-in users (the "Services").
Not medical advice / no HIPAA. CareCircle is a communication and coordination tool for caregiving. We do not provide medical advice, diagnosis, or treatment. We are not a HIPAA covered entity or business associate and do not sign BAAs. Use the Services at your own risk and do not store protected health information (PHI).
1. Notice at Collection (US state laws)
We collect the following categories of personal information for the purposes shown below. We do not "sell" personal information or "share" it for cross-context behavioral advertising, and we do not use or disclose sensitive information for purposes that require a "Limit Use" link under California law. If this ever changes, we will update this Policy and provide required opt-outs.
| Category | Examples | Purpose(s) | Retention (default) |
|---|---|---|---|
| Identifiers | Email, display name, login credentials, account/circle IDs | Account creation, authentication, support, security | Life of account + 30 days |
| Profile & Circle metadata | Circle memberships, roles, invitations, privacy settings | Provide private & logged-in-only community features; role-based access | Life of account |
| User content | Posts, comments, reactions, images/video you upload | Communication among Circle members; community participation | Until you delete; backups purge within 30–45 days |
| Device/usage data | App/OS versions, language, crash/diagnostic events, IP-derived region | Security, fraud prevention, debugging, service improvement | 12 months |
| Push notification tokens (if opted in) | Device token for notifications | Deliver notifications you opt into | Rotated or deleted when you opt out/uninstall |
| Moderation artifacts | Temporary image-safety signals/results | Safety and abuse prevention | Up to 90 days |
2. Who we are & roles
- Controller (default). For consumer use of the Services, CareCircle is the "controller" of your personal information.
- Current operational structure. CareCircle is presently developed and operated within the University of Michigan by U-M employees. However, the Service itself is not an official University service or healthcare product.
- No enterprise processor role. We do not sign BAAs and are not acting as a processor for healthcare providers; the Services are for personal and family use.
3. What we collect and how we get it
Information you provide
- Account & profile. Email and display name.
- Circle participation. Memberships, roles, privacy settings.
- User content. Posts, comments, reactions, media you upload. Only share what you're comfortable sharing with your audience.
- Invitations. Invitations are shared through QR codes (we do not import contacts).
Information collected automatically
- Device & diagnostics. Device type/OS, app version, crash logs.
- Usage logs. Feature use, timestamps, limited IP-based region for security.
From service providers
We use reputable cloud infrastructure and content delivery providers to host, store, deliver, and protect the Services. They act only on our instructions and under contract.
About "public" Circles. Community Circles are visible only to logged-in users. They can view posts within those Circles and may comment only after joining. Choose your audience carefully.
4. Legal bases (EEA/UK)
- Contract to provide the Services you request.
- Legitimate interests to maintain security and improve features.
- Consent for optional community posting and push notifications.
- Legal obligations to comply with law or enforce Terms.
Special categories (health-related content). If you voluntarily share health-related information, we process it only to provide the feature you use. We do not use such content for advertising or profiling.
5. How we use information
- Provide, operate, and secure accounts and Circles
- Deliver notifications you opt into
- Prevent abuse and maintain community safety
- Debug, repair, and improve the Services
- Communicate about updates or support
- Comply with law and enforce our Terms
We do not run third-party ads and do not build advertising profiles.
6. When we disclose information
- Service providers. Cloud hosting, content delivery, communications, diagnostics—bound by contract and acting on our behalf.
- Circle recipients. Other members of your Circles, consistent with your audience settings.
- Legal/law enforcement. When required by law or to protect rights and safety.
- Corporate transactions. If we merge, sell, or transfer assets, subject to this Policy.
We do not sell personal information and do not share it for advertising.
7. International data transfers
The Services are operated from the United States. If you use them from outside the U.S., your information may be processed there or in other countries. Where required, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) with our providers.
8. Retention
- Account & profile: life of account
- Deleted content: removed from active systems promptly; in backups 30–45 days
- Logs/diagnostics: 12 months
- Moderation data: up to 90 days
- Legal holds: as required
9. Your choices & privacy controls
- Audience controls. Share only with private or logged-in Circles.
- Notifications. Opt in at signup; turn off anytime in settings or device OS.
- Access, correction, deletion.
- Delete: You can delete your account in-app anytime.
- Access/port/correct: Email us from your account email.
- Appeal: If we decline a request, reply "Appeal" to our decision email.
10. Children & minors
The Services are for individuals 13 years and older. We do not knowingly collect data from children under 13. Caregivers posting about minors must have legal authority to share that information.
11. Security
We use technical and organizational measures to protect information, including encryption in transit and at rest, role-based access, least-privilege staff access, environment isolation, and backups. No system is 100% secure; please use strong passwords and updated devices.
12. Region-specific disclosures
EEA/UK
You have rights to access, port, rectify, erase, restrict/object, and withdraw consent. You may lodge a complaint with your local data authority.
EU/UK Representative: [To be added if required]
United States (state privacy laws)
We extend access, correction, deletion, and opt-out rights as required (CA, CO, CT, UT, VA, IA, TX, etc.). We do not sell or share information for advertising; if this changes, we will add a "Do Not Sell or Share" link.
Consumer Health Data (WA, NV, OR)
Where applicable, we collect health data only when you share it, use it solely to provide features, and do not sell or publish it.
Other regions
CareCircle applies the same privacy principles globally. Where local laws — such as Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Brazil's Lei Geral de Proteção de Dados (LGPD), Australia's Privacy Act, Singapore's Personal Data Protection Act (PDPA), Japan's Act on the Protection of Personal Information (APPI), and similar frameworks — provide additional rights, we honor those rights and aim to exceed their standards.
13. Automated decision-making
We do not make decisions with legal or significant effects using only automation. Automated image-safety checks may temporarily hold content for review.
14. University of Michigan Notice
CareCircle is currently developed and operated by employees within the University of Michigan as an independent innovation initiative. The University of Michigan does not provide clinical services through CareCircle, does not control the content users share, and does not assume responsibility or liability for any communications, actions, or information exchanged within the platform. All data processing and user interactions occur under the CareCircle project's responsibility and governance, not as an official University program or healthcare service.
15. Changes to this Policy
We may update this Policy as our Services or legal requirements change. Material updates will be announced via in-app notice or email. Continued use after notice means you accept the updated Policy.
16. Contact us
Email: support@carecircle.co
Appendix — Service Providers
We use trusted cloud and communications service providers to host, store, and deliver the Services. They act only on our instructions and under written agreements. If you need a full vendor list for due diligence, contact us; we will provide one under NDA or publish a public list when appropriate.
Plain-English Summary
- CareCircle is not a medical service.
- Operated within the University of Michigan, but not an official U-M program or provider.
- No ads, no selling or sharing of data for marketing.
- Invitations use QR codes only (no contacts import).
- Push notifications are opt-in.
- You can delete your account in-app anytime.
- The University of Michigan is not responsible for user activity or data in CareCircle.