THE CARE APP INC.
PRIVACY POLICY
Applies to the CARE mobile applications, websites, connected device features, and CARE+
Effective Date: August 9, 2026 | Supersedes the Privacy Statement dated February 10, 2026
1. Introduction and Scope
At The CARE App Inc. and its wholly-owned subsidiaries ("CARE," "we," "us," or "our"), our mission is to unlock human care and extend health span through personalized data insights. We exist to improve your life, not invade it. We take your privacy seriously, and this Privacy Policy explains what personal data we collect, how we use and share it, and the choices and rights you have.
"Personal Data" means any information that identifies you or that can reasonably be linked to you, or that is otherwise treated as "personal information," "personal data," or "consumer health data" under applicable law.
This Privacy Policy applies to Personal Data we collect when you:
This Privacy Policy does not cover the practices of companies or people we do not own, control, or manage. We are not responsible for the policies or practices of third parties, and we do not control or endorse information, products, or services offered by third parties or accessible through the Services. We are responsible for the practices of the service providers and processors that handle Personal Data on our behalf, in accordance with applicable law.
1.1 CARE+ and Organization-Sponsored Access
If your access to CARE is sponsored by an employer, insurer, team, or other organization, that organization determines certain aspects of the program and may be a separate or joint controller of some data. We do not share your individual health data, scores, or CARE Coach conversations with your sponsoring organization. We share only aggregated or de-identified reporting that cannot reasonably be used to identify you, and, where a group is small enough that aggregation would not protect identity, we apply a minimum reporting threshold of [___] participants. Your relationship with your sponsoring organization is also governed by that organization's own privacy notice.
2. Summary of Key Practices
3. Who We Are and How to Contact Us
The CARE App Inc. is incorporated in Delaware and has its principal place of business at 530 Bridge Creek Blvd, Ocoee, FL 34761, United States. For the purposes of the EU and UK General Data Protection Regulation ("GDPR"), CARE is the controller of Personal Data processed in connection with the Services, except as described in Section 1.1.
Privacy contact: privacy@thecarecompany.co
Postal: The CARE App Inc., Attn: Privacy, 530 Bridge Creek Blvd, Ocoee, FL 34761, USA
EU / UK representative (GDPR Articles 27): [TO BE APPOINTED — name and address]
CARE has designated an internal privacy lead responsible for overseeing this Privacy Policy. [CONFIRM whether a statutory Data Protection Officer is required under GDPR Article 37; if one is appointed, list the DPO and contact details here.]
4. Personal Data We Collect
4.1 Data You Provide
4.2 Data Collected Automatically
4.3 Data from Other Sources
5. Health, Wellness, and Biometric Data
Providing the Services requires processing information about your body and behavior. We treat this as the most sensitive category of data we hold.
5.1 What We Collect
5.2 How We Use It
5.3 Apple Health (HealthKit)
Where you grant permission, CARE reads data from Apple HealthKit. Consistent with Apple's requirements:
5.4 Google Health Connect and Google Fit
Where you grant permission, CARE reads data from Google Health Connect or Google Fit. Our use of that data adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use this data only to provide and improve the health and fitness features you request, we do not transfer it except as necessary to provide those features, comply with law, or in connection with a merger or acquisition with your consent, and we do not use it for advertising or allow humans to read it except with your explicit consent, for security purposes, to comply with law, or where the data has been aggregated and de-identified.
5.5 Consumer Health Data
Some of the information above is "consumer health data" under state laws including the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, and the Connecticut Data Privacy Act. We do not sell consumer health data, and we do not use it for targeted advertising. Residents of Washington and Nevada have additional rights described in Section 12, and we maintain a supplemental Consumer Health Data Privacy Notice available at [URL].
5.6 Revoking Access
You may grant or revoke CARE's access to any of these data points at any time through your device settings (for example, the Health app on iOS, Health Connect on Android) or within CARE app settings. If you revoke access to metrics such as heart rate or sleep data, CARE will be unable to calculate your scores or provide personalized insights, because those calculations require a continuous data stream. Revoking access does not by itself delete data already collected; to delete it, see Section 14.
6. How We Use Personal Data
6.1 Legal Bases (EEA, UK, and Switzerland)
7. CARE Coach, Automated Processing, and AI Features
CARE Coach and certain other features use automated systems, including third-party large language model providers, to generate responses, summaries, insights, and suggestions.
8. How We Share Personal Data
We share Personal Data only as described below.
Since it was founded, CARE has received zero government requests for user information. [CONFIRM this statement remains accurate as of the effective date, and consider maintaining it in a separate transparency report rather than the Privacy Policy so it can be updated independently.]
9. Cookies, Analytics, and Advertising
We use cookies, SDKs, pixels, local storage, and similar technologies (collectively, "Cookies") to operate and improve the Services.
Important clarification. We do not sell Personal Data for money, and we do not use health data for advertising. However, our use of advertising and analytics Cookies on our marketing website may constitute a "sale" or "share" of Personal Data for cross-context behavioral advertising, or "targeted advertising," under the California Consumer Privacy Act and similar state laws. The categories of data involved are limited to device identifiers, IP address, and website activity — not health data, biometric data, or CARE Coach conversations.
To opt out, you may: use the "Your Privacy Choices" or "Do Not Sell or Share My Personal Information" link at [URL]; enable a Global Privacy Control signal in your browser, which we honor as a valid opt-out request for that browser; limit ad tracking in your mobile device settings; or block Cookies in your browser. If you are in the European Economic Area or the United Kingdom, we obtain your opt-in consent before setting any Cookie that is not strictly necessary.
10. Referral and Ambassador Programs; Access to Contacts
CARE offers programs that let you invite others and, in some cases, receive a benefit such as free or discounted access or a reward for redemptions of your code.
11. International Transfers
CARE is headquartered in the United States, and Personal Data we collect is processed and stored in the United States. By using the Services, you understand that your Personal Data will be transferred to and processed in the United States, which has not received an adequacy decision from the European Commission under Article 45 of the GDPR.
Where we transfer Personal Data from the EEA, the UK, or Switzerland, we rely on appropriate safeguards under Article 46 of the GDPR, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, supplemented by additional technical and organizational measures informed by guidance from the European Data Protection Board. We also enter into data processing agreements with our vendors. [CONFIRM whether CARE intends to certify under the EU-U.S. Data Privacy Framework; if so, add the required disclosures.] You may request a copy of the relevant safeguards by contacting privacy@thecarecompany.co.
12. Your Rights and Choices
12.1 Rights Available to All Users
To exercise these rights, email privacy@thecarecompany.co or use the tools in your account settings. We will verify your request using the information associated with your account and will respond within the timeframes required by applicable law. Access is provided free of charge, except where a request is manifestly unfounded or excessive. An authorized agent may submit a request on your behalf with proof of authorization.
12.2 United States State Privacy Rights
Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights described in Section 12.1, and additionally the right to opt out of targeted advertising, the sale of Personal Data, and profiling in furtherance of decisions producing legal or similarly significant effects, and the right to limit the use of sensitive Personal Data. We do not knowingly process Personal Data in a manner that would constitute profiling with legal or similarly significant effects.
Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@thecarecompany.co with the subject line "Privacy Appeal." We will respond within [45] days. If your appeal is denied, you may contact your state attorney general.
Notice at collection (California). The categories of Personal Data we collect, the purposes for which we collect them, the categories of third parties to whom we disclose them, and our retention periods are described in Sections 4 through 8 and Section 13. We disclose the following categories for business purposes: identifiers, customer records, commercial information, internet activity, geolocation, sensory data, and inferences, together with sensitive Personal Data consisting of health and biometric information and precise geolocation. We do not sell or share sensitive Personal Data, and we do not use or disclose it beyond the purposes permitted under Section 1798.121 of the California Consumer Privacy Act. We do not knowingly sell or share the Personal Data of consumers under 16 years of age.
Washington and Nevada consumer health data. Residents of Washington and Nevada have the right to confirm whether we collect, share, or sell their consumer health data, to access a list of third parties with whom it has been shared, to withdraw consent, and to have it deleted. We do not sell consumer health data and therefore do not seek the separate valid authorization that a sale would require.
Shine the Light (California). We do not disclose Personal Data to third parties for their own direct marketing purposes.
12.3 EEA, UK, and Swiss Rights
In addition to the rights in Section 12.1, you have the right to restrict processing, the right to object to processing based on legitimate interests or to direct marketing, and rights relating to automated decision-making and profiling. You may also lodge a complaint with your national supervisory authority or, if applicable, the European Data Protection Supervisor. We would appreciate the opportunity to address your concerns before you do so.
13. Data Retention
We retain Personal Data for as long as necessary to provide the Services and for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Our general periods are:
[CONFIRM each period above against actual system configuration — a published retention schedule that does not match practice is a compliance risk in itself.]
14. Deleting Your Personal Data
You have the right to remove your information from CARE at any time, through either of two methods.
Once processed, deletion is permanent and the data cannot be recovered. We may retain a limited record of the deletion request itself, and data we are required to keep by law (such as transaction records) or that has been de-identified. Deleting your CARE account does not delete data held in Apple Health, Google Health Connect, or any third-party platform; you must delete that separately within those services.
15. Security
We employ physical, technical, and administrative safeguards designed to protect Personal Data, including encryption in transit and at rest, access controls and least-privilege permissions, logging and monitoring, vendor security review, and employee training. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for enabling available account security features. If we become aware of a breach affecting your Personal Data, we will notify you and applicable regulators as required by law.
16. Children's Privacy
The Services are intended for users who are at least 18 years old. We do not knowingly collect Personal Data from anyone under 18, and persons under 18 may not register for or use the Services. If we learn that we have collected Personal Data from a person under the age at which they can consent in their jurisdiction, we will delete it as quickly as possible. If you believe a child has provided us with Personal Data, contact privacy@thecarecompany.co.
[NOTE: the prior Privacy Statement listed privacy@careapp.com here, which does not match any other CARE address. Corrected above. If CARE later opens the Services to users aged 13–17, this section, the Terms of Service eligibility clause, and parental consent flows must all be revised together.]
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where the changes are material, provide additional notice by email or in-app notification before the changes take effect. Where required by law, we will obtain your consent.
18. Questions, Concerns, or Complaints
The CARE App Inc., 530 Bridge Creek Blvd, Ocoee, FL 34761
privacy@thecarecompany.co | thecarecompany.co