Privacy Policy

• Account details: name, email, password hash, sign-in method, tier, and role.
• Care profile and health-related entries you choose to add: the care recipient’s first name, age, relationship, conditions, medications and doses, appointments, vitals, insurance card details, emergency plans, and care logs.
• Assessment and coaching data: readiness answers, ROOTS scores, Zarit burden responses, self-care check-ins, and messages you exchange with the AI coach.
• Community and circle data: posts, replies, hearts, invites, tasks, and respite scheduling.
• Technical data: device/browser type, IP address, timestamps, and basic usage events used for security and reliability.

FLIP Care Companion is a direct-to-consumer platform. We are not a HIPAA Covered Entity or a Business Associate, and information you enter is generally not Protected Health Information under HIPAA, unless we have signed a Business Associate Agreement with your organization. You store health-related details at your own discretion. Read the full HIPAA & Health Data Notice.

• To operate your account, care plan, reminders, and family circle.
• To generate ROOTS, readiness, and burden results and personalize suggestions.
• To send transactional email (verification, invites, resets, beta welcome).
• To keep the service secure, prevent abuse, and debug problems.
• To understand aggregate, de-identified usage so we can improve features.

We do not sell your personal information, and we do not use your care entries or AI coach conversations to train third-party foundation models for their own purposes.

• You, and the family members or helpers you explicitly invite, at the access level you assign them.
• Other members, only for what you post in the community (post anonymously if you prefer).
• Service providers under contract: our cloud database and authentication host, email delivery, and AI model providers that process coach messages to generate a reply.
• Authorities, when legally required, or to prevent imminent harm.
• A successor, if the business is acquired, with notice to you.

Row-level security rules mean other users cannot read your care records through the app or API.

You are entering another adult’s information. Please only enter what is necessary, and confirm you have their permission or the legal authority (power of attorney, guardianship, or similar) to do so. You are responsible for that authority.

Data is encrypted in transit and at rest, access is scoped per-account with row-level security, admin access is role-restricted and audited, and passwords are checked against known breach lists. No system is perfectly secure; use a strong, unique password and remove circle members who no longer need access.

• We keep your data while your account is active.
• You may edit or delete individual records at any time, and request full account deletion, we remove or irreversibly de-identify your data within 30 days, apart from records we must keep for legal or accounting reasons.
• You may request a copy of your data, correct it, object to certain processing, or withdraw consent. Residents of California, the EU/UK, and other regions with privacy statutes have these rights explicitly, and we honour them for everyone.

To exercise any of these, email privacy@flipcareapp.com.

You don’t have to email us to exercise those rights. Signed in, open Profile → Your data to download a complete JSON export of your account, care profile, medications, appointments, logs, assessments, and coach history, or to permanently delete your account and all associated records. Deletion is immediate and irreversible.

We rely on a small set of vendors to run FLIP. They process your data only to deliver these features, under contract, and may not use it for their own purposes:

• Cloud database, authentication, and file storage, hosts your account and care records (Supabase infrastructure running on AWS).
• Application hosting and CDN, serves the app itself (Lovable / Cloudflare edge infrastructure).
• AI model providers, messages you send to the “Auntie Mary” coach are transmitted to large-language-model providers (Google Gemini via the Lovable AI gateway) to generate a reply. Your conversations are not used to train their models. Please avoid pasting identifiers you would not want processed by a third party.
• Email delivery, sends invites, verification codes, and notifications (Resend); recipients’ email addresses and message contents are processed for delivery.
• Payments, if and when you subscribe, card details go directly to our PCI-DSS compliant payment processor; we never see or store your card number, CVV, or bank credentials.

If you decline optional cookies in our consent banner, we do not load non-essential analytics or personalization tracking.

Every reply from Auntie Mary is generated by an artificial intelligence model, not by a human being. The text you type, plus a short window of the recent conversation for context, is transmitted over an encrypted connection to a secure third-party AI API (Google Gemini, accessed through the Lovable AI gateway) which returns a generated response. Providers process this content solely to produce your reply and do not use it to train their models.

Your conversation history is stored in your account so the coach can remember context and so you can revisit past advice. It is visible only to you, is included in Download my data, and is deleted when you delete your account or clear the conversation. Auntie Mary is offered for information, organization, and peer-style support only, it is not a healthcare professional and its output is not medical, legal, or financial advice. Please avoid pasting full names, insurance identifiers, or other details you would not want processed by a third-party AI service.

The service is for adults 18+. We do not knowingly collect information from children. If a child’s data has been entered, contact us and we will remove it.

We will post updates here and notify you of material changes. Questions or concerns: privacy@flipcareapp.com.