Privacy Policy

Summary of key points

• What we collect. Account and profile information; the care information you and your circle members enter (care-recipient details, medications, allergies, appointments, tasks, journal entries, messages, contacts, wellbeing check-ins); documents you upload (which may include health-related files); billing information; and technical/device information for notifications and security.
• Sensitive information. Because Vardfolk is used to coordinate care, the information you provide may include health-related details about a care recipient. You provide this voluntarily to coordinate care.
• How we use AI. Vardfolk uses artificial intelligence to power features such as document scanning, summaries, and suggestions. To do this, relevant content — which may include health information — is sent to our AI provider, Anthropic, to generate the result. Anthropic does not use this content to train its AI models.
• Who we share with. We share information with the service providers that operate Vardfolk. Within the app, your care-circle information is visible to the members of that circle according to their role. We do not sell your personal information.
• Your choices. You can review, update, export, or delete your information, and delete your account, at any time.

1. Information we collect

Information you provide directly

• Account and profile information — your name, email address, and a password, or authentication through Apple or Google sign-in. Optionally, a profile photo.
• Care-circle and care-recipient information — the name and details of the person being cared for, and the members you invite to the circle.
• Health-related care information — medications, dosages and schedules, allergies, appointments, and the contents of documents you upload (such as discharge summaries, after-visit summaries, insurance cards, and other health-related files).
• Coordination content — tasks, journal entries and care updates, messages you send within a circle, important contacts, and wellbeing check-ins.
• Billing information — when you subscribe to a paid plan, your payment details are collected and processed by Stripe. Vardfolk does not store your full card number.

Information collected automatically

• Device and technical information — including push-notification tokens (for Apple and web push), and basic information needed to operate and secure the Services.
• Usage and diagnostic information — when you use the app, we and our analytics and crash-reporting providers automatically collect limited information about how the Services are used (such as which features are opened and general device and session information) and diagnostic information (such as crash reports and performance data), to help us understand usage and fix technical problems. This information is associated with a randomly generated identifier rather than your name or email address. We configure these providers so that location derived from your IP address is discarded and is not stored, and so that the care content you store in Vardfolk — documents, messages, medications, and journal entries — is excluded from what they collect. See Section 4 for the providers we use for this purpose.

Sensitive information. The care information you enter may be considered sensitive in some jurisdictions because it relates to health. You provide this information voluntarily in order to coordinate care. Vardfolk is not a HIPAA-covered entity, and the Services are not designed to comply with HIPAA, and should not be used in any way that would require HIPAA compliance.

2. How we use your information

We use your information to:

• Create and maintain your account and authenticate you.
• Provide the Services — store and display your care circle’s tasks, appointments, medications, documents, messages, and updates to the members of that circle.
• Provide AI-assisted features (see Section 3).
• Send notifications and service-related communications.
• Process payments and manage subscriptions.
• Maintain the security and integrity of the Services and prevent fraud or abuse.
• Comply with legal obligations.
• Understand how the Services are used, and detect and fix technical problems, so we can keep the app reliable and improve it.

3. How we use artificial intelligence

Vardfolk uses artificial intelligence to make care coordination easier. AI-assisted features include scanning and reading uploaded documents to extract medications, appointments, and tasks; generating summaries and briefings; suggesting tasks from journal entries; suggesting document tags and contacts; and helping draft notes and messages.

To provide these features, relevant content is sent to our AI provider, Anthropic (the maker of Claude). Depending on the feature, this content may include text extracted from documents you upload (which may contain health information), journal entries, messages, appointment and medication details, and other care information.

Anthropic processes this content to generate the feature’s output and, under its commercial API terms, does not use it to train its AI models.

How we handle the results:

• Document scanning and extraction. The text read from your uploaded document and the structured information extracted from it (such as medications, appointments, and tasks) are saved in your care circle’s records, so you can review and use them. They are deleted when you delete the document or the care circle.
• Other AI features (summaries, suggestions, drafting help) process your information to generate a response in real time. The response is shown to you and is only saved if you choose to keep it (for example, by accepting a suggested task).
• We do not keep separate logs of the content sent to, or received from, the AI provider.

AI-generated output can contain mistakes. Vardfolk does not provide medical advice, and AI-assisted features are aids to coordination, not clinical guidance. Always verify important details — especially dates, dosages, and medical information — against your original documents and your healthcare providers.

4. How your information is shared

Within your care circle. Information you add to a care circle is visible to the other members of that circle, according to each member’s role (administrator, contributor, or viewer). This sharing is how Vardfolk works — it lets your family and care team stay coordinated. Your care-circle information is not public and is not shared outside your circle except as described below.

With service providers (subprocessors). We share information with the third-party providers that operate Vardfolk on our behalf. They are permitted to use the information only to provide their services to us:

For legal reasons. We may disclose information if required by law, to respond to lawful requests, or to protect the rights, safety, and security of our users, the public, or Vardfolk.

Business transfers. If Vardfolk is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

5. Where your information is stored

Vardfolk is operated in the United States, and your information is stored and processed in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.

6. How long we keep your information

We keep your information for as long as your account is active or as needed to provide the Services. When information is deleted (see Section 7), it is removed from our active systems. Residual copies may persist temporarily in routine backups before being overwritten, and we may retain limited information where required to comply with legal obligations, resolve disputes, or enforce our agreements.

7. Deleting your information and your account

You can delete your account at any time from the app’s account settings, or by contacting us at privacy@vardfolk.com. Here is what happens when you delete your account:

• If you are the only member of a care circle, that circle and all of its data are permanently deleted — including tasks, appointments, medications, journal entries, messages, contacts, and the uploaded files stored for that circle.
• If a care circle has other members, the circle and its shared records remain so the other members can continue using them. Your membership is removed, and your personal connection to content you created is removed (your authorship is cleared). Comments you posted on tasks and appointments, your wellbeing check-ins, your notifications, and your notification settings are deleted.
• If you are the only administrator of a circle that still has other members, you will be asked to make another member an administrator, or to remove the other members, before you can delete your account — so the circle is not left without an owner.
• Your profile, your authentication account, and your device/push tokens are deleted.

You may also delete individual documents, messages, and other items at any time, and delete an entire care circle you administer.

8. How we protect your information

We use technical and organizational measures designed to protect your information, including encryption in transit, access controls, and authentication. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

9. Children’s privacy

The Services are intended for adults (18 and older) coordinating care. We do not knowingly collect personal information from children under 18. A care recipient’s information is entered by the adult members of a care circle. If you believe a child under 18 has provided us with personal information, contact us at privacy@vardfolk.com and we will delete it.

10. Your privacy rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information;
• Receive a copy of your information in a portable format;
• Withdraw consent where processing is based on consent;
• Opt out of the sale or sharing of personal information (note: we do not sell or share personal information for advertising); and
• Appeal a decision we make about a privacy request.

To exercise any of these rights, email privacy@vardfolk.com. We will respond as required by applicable law. We will not discriminate against you for exercising your rights.

United States — state privacy rights. Residents of states with comprehensive privacy laws (including California, Colorado, Connecticut, Virginia, and others) have the rights described above. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use or disclose sensitive personal information for purposes other than providing the Services. California residents may designate an authorized agent to make requests on their behalf.

Do Not Track. Our Services do not currently respond to “Do Not Track” browser signals.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will provide additional notice (such as by email or in the app). Your continued use of the Services after an update means you accept the revised policy.

12. Contact us

If you have questions or requests regarding this Privacy Policy or your information, contact us at privacy@vardfolk.com — Vardfolk, California, United States.