Privacy Policy

‍Last Updated: September 14, 2026

‍

CareTabs (“we,” or “us”) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you visit our website and use our services. By using our website, you agree to the collection and use of your information in accordance with this policy.

2. Whose information this policy covers

• Account holders. People who create and use a CareTabs account.
• Care recipients. People whom a care profile is about. The account holder must have legal authority, permission, or
another lawful basis to collect, store, and share that person’s information.
• Invitees. People invited by an account holder or authorized Admin to access a care profile.
• People who contact us. People who submit support, AfterCare, or other inquiry forms.

If you are a care recipient and want to access, correct, or request deletion of information about you, contact the person
managing the profile or Support@Caretabs.com.

‍

3. Information We Collect

We may collect various types of information in connection with your use of our services, including:

•  Name, email, phone number, profile photo, account role, subscription and invoice information, support communications, and marketing preferences. Payment card details are handled by Stripe and are not stored by CareTabs.
• Account holders decide what to place in a care profile. Content may include identity information; medical conditions,
  medications, physicians and insurance; financial accounts, assets and insurance; wills, deeds, advance directives and
  other legal records; passwords and PINs; property records; and uploaded documents.
• Important user choice. CareTabs does not require users to store a Social Security number, password, PIN, financial
  credential, medical record, or any other particular sensitive item.
• Users should store only information reasonably necessary for their purposes.
• Technical and usage information may include IP address, device/browser information, session data, application
  diagnostics, feature usage, and page/route information.
• Our own product analytics are designed not to record care-profile contents, document names, search terms, or free-text profile content.
• When an address is entered into an autocomplete-enabled field, the address text may be transmitted to Google Places
  API.‍

4. How We Use Your Information

CareTabs uses the information collected for purposes including:

• Provide, secure, authenticate, maintain, troubleshoot, and improve the Service.
• Store, display, export, and share care profiles at the user’s direction.
• Process subscriptions and purchases.
• Provide support and essential account, billing, security, and legal communications.
• Operate optional features requested by the user.
• Comply with law, enforce our Terms, prevent fraud and abuse, and protect rights and safety.

We do not sell care-profile content. We do not use care-profile content to train machine-learning models or for behavioral
advertising.

5. Advertising and analytics safeguards

Recommended production configuration: CareTabs will not intentionally run Meta Pixel, Google Ads
remarketing/conversion tags, or comparable advertising trackers inside authenticated care-profile pages or other screens
that display or reveal sensitive profile content or profile-specific identifiers.

On public marketing pages, CareTabs may use analytics or advertising technologies subject to applicable consent and
opt-out requirements. Where California or other applicable law treats such activity as a sale or sharing of personal
information, CareTabs will provide the required opt-out mechanism, including a “Do Not Sell or Share My Personal
Information” mechanism where required.

CareTabs will honor legally required browser/device-based opt-out preference signals, such as Global Privacy Control,
where applicable.

‍

6. Sharing and invitees

An account holder may invite another person to a profile as Admin or Read access. Unless the product interface
expressly states otherwise, access to a profile may expose all information in that profile, including highly sensitive
information.

Users are responsible for inviting only trusted people whom they are legally authorized to give access. CareTabs cannot
retrieve or undo information an invitee lawfully viewed, copied, downloaded, photographed, or otherwise retained while
access was active.‍

7. Security

Sensitive care-profile fields are encrypted at rest using profile-specific encryption controls, with keys protected using
Microsoft Azure Key Vault. Uploaded documents are encrypted at rest using Azure storage encryption, and data in transit
is protected using TLS.

CareTabs uses access controls designed to restrict profile contents to authorized account holders and invitees. Security
measures may also include logging, monitoring, authentication controls, least-privilege access, vendor controls,
vulnerability management, backups, and incident-response procedures.
No system is completely secure. CareTabs cannot guarantee that unauthorized persons will never defeat safeguards or
that information will never be lost, corrupted, or disclosed. Users are responsible for protecting their credentials and
devices and should maintain independent copies of information they cannot afford to lose.‍

8. Security incidents and breach notification

If CareTabs discovers or reasonably suspects unauthorized access to, acquisition of, use of, or disclosure of personal
information, CareTabs will investigate, contain, remediate, document, and assess the incident under its
incident-response procedures.

CareTabs will provide notices to affected individuals, regulators, law enforcement, business partners, or others when and
within the time required by applicable law. Nothing in this policy promises notice where the law does not require it or
within a period shorter than applicable law requires.

CareTabs will maintain a process for users and security researchers to report suspected security issues at Support@Caretabs.com.

‍

9. Retention and deletion

While an account is open, CareTabs retains information as needed to provide the Service. When a user deletes a profile
or account, active records should be removed promptly and profile-specific encryption keys destroyed where technically
applicable. Associated uploaded files and profile photos should be erased from active file storage within 7 days. Profile
export files should expire and be erased within 7 days of creation. Backups may retain encrypted residual copies for a
limited rolling period, such as 7 days, before overwrite.

Billing, tax, fraud-prevention, security, legal-hold, and compliance records may be retained longer where reasonably
necessary or legally required. Product analytics may be retained in de-identified or pseudonymized form according to a
documented retention schedule.

10. Privacy rights

Subject to applicable law, individuals may have rights to know/access, correct, delete, obtain a copy of, or restrict certain
uses of personal information; opt out of certain sale/sharing or targeted advertising; withdraw consent where processing
is based on consent; and appeal certain privacy decisions.

Requests may be submitted to Support@Caretabs.com. CareTabs may verify identity and authority before acting.
CareTabs will respond within the period required by applicable law.

California residents may have rights under the CCPA/CPRA, including rights relating to sensitive personal information
and sale/sharing. CareTabs does implement all required notices and opt-out mechanisms before activating covered
advertising or sharing practices.

11. Health information and HIPAA

CareTabs is generally designed as a consumer-directed organizer. CareTabs does not represent that it is a HIPAA
covered entity or business associate merely because users choose to store health information.

If CareTabs enters a relationship in which it creates, receives, maintains, or transmits protected health information on
behalf of a HIPAA covered entity or business associate, CareTabs will evaluate the relationship and enter any required
Business Associate Agreement before handling that information in that capacity.

Health information may be protected by other federal or state privacy and breach-notification laws even when HIPAA
does not apply. CareTabs will evaluate and comply with laws applicable to its actual products, users, data flows, and
jurisdictions.

12. Children and minors

CareTabs accounts are for adults age 18 or older. An adult may create a profile containing information about a minor
only when the adult has appropriate legal authority or permission. CareTabs does not knowingly permit a person under
18 to create an account.

‍

13. Changes to Our Privacy Policy

We may update this Privacy Policy to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will notify you of any significant changes by posting the updated policy on this page with an updated date. We encourage you to review this page periodically to stay informed about our practices.

‍

14. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

‍Email: Support@Caretabs.com

‍