Please review this policy carefully. This English version is intended to explain ComfiCare’s current privacy practices in accessible language. Before publication, confirm that every statement matches the production app, actual service-provider configuration and applicable law.
1. Scope and service operator
This Privacy Policy applies to the ComfiCare Caregiver app, the ComfiCare companion app used by a person receiving care, and related services. The service is operated by Dalian Chengfu Trading Co., Ltd. (“ComfiCare,” “we,” “us,” or “our”), located in Dalian, China. Contact: support@comficare.co.
ComfiCare is an auxiliary digital tool for families supporting older adults or other people experiencing memory loss or cognitive changes. An adult caregiver creates and manages the caregiver account and enters the care recipient’s profile information. Caregivers must have the authority to provide that information and should explain the service and its data practices to the care recipient or their legal representative.
ComfiCare is not a healthcare provider. It does not provide medical diagnosis, treatment advice, clinical assessment or emergency response.
2. Information we collect
- Account and household information: email address, name, role, relationship to the care recipient, language, time zone, household name, invitation code, multi-factor authentication status, trusted-device information, login attempt records, referral source and referral code.
- Care recipient profile: name, preferred name, birth year or date of birth, preferred language, profile photo, relationship labels, feature settings, schedule and daily routines.
- Care content: reminder titles and text, categories, times, recurrence rules, tone, written content, cover images and display settings.
- Usage and interaction data: time spent in the app, whether text-to-speech was played or completed, reminder-view and confirmation records, device heartbeat information (such as battery level, charging status, foreground status, whether the device is face down, and timestamps), and app events.
- Device and technical information: device name and type, operating system, app version, pairing codes and pairing-session information, last online time, push notification token, IP address, device or browser identifiers, access times and diagnostic logs.
- Support information: issue category, subject, message, contact details and attachments you choose to provide.
- Device permissions: notification permission; photo-library access only when you select a cover image; and camera access on the companion app only to scan a pairing QR code. The app does not save a photo from that scan. The current version does not record or upload audio.
Care recipient profiles, care-stage settings and interaction responses may qualify as health data or sensitive personal information under applicable laws. We process them only as necessary to provide the service and where we have an appropriate legal basis.
3. How we use information
We use information to:
- Create and manage accounts, households and paired devices.
- Sync reminders, schedules, photos and care recipient settings.
- Display care content and provide text-to-speech on the companion app.
- Send caregivers reminders, status information and notifications.
- Handle data export, correction, deletion and support requests.
- Protect accounts, devices and data, and investigate faults or misuse.
- Perform necessary audits, meet legal requirements and handle disputes.
- Analyze service use in de-identified or aggregated form and improve features.
We do not sell or rent personal information, use it for ad targeting, or use it for cross-context behavioral advertising. In the current version, we do not use care content to train generative AI models.
4. Legal bases for processing
Where required by applicable law, we rely on one or more of the following legal bases: performance of a service contract; consent (including, where applicable, consent for notifications, photo uploads and sensitive information); our legitimate interests in security, troubleshooting and service improvement; compliance with legal obligations such as audit and security recordkeeping; or another legal basis permitted by law.
For processing care recipient health information, caregivers must ensure that the care recipient or their legal representative has provided the required authorization. Where the law requires separate or explicit consent, we will obtain it as required.
5. Sharing and third-party service providers
We do not sell personal information. To operate the service, we may share necessary information with the following providers:
- Supabase: account authentication, database, file storage and edge functions.
- PowerSync: synchronization between devices and the cloud.
- Expo Push Service: push notifications, ultimately delivered through Apple or Google notification channels.
- Resend: verification, export, deletion and support-related emails.
We provide service providers only the information needed to perform their services and require appropriate safeguards. A link to a card cover image may be forwarded, and anyone with access to the link may be able to view the image. Do not upload identity documents, medical records, financial information or other highly sensitive images.
We may also disclose information to comply with law or valid legal process; protect the safety of users, care recipients or others; investigate fraud or security incidents; support a merger, acquisition or asset transfer; or where you have expressly agreed.
6. International data transfers
Our service providers may process information in different countries or regions. Where cross-border transfers occur, we will use contractual safeguards, standard contractual clauses or other lawful transfer mechanisms as required by applicable law. Before publication, specify the actual hosting regions and provider configurations here: [TO BE COMPLETED — confirm actual data storage and processing locations].
7. Data retention
- Account and household data: retained while the account remains active.
- Emotional interaction data: physically deleted within 24 hours after a deletion request is submitted, with no grace period, as currently designed.
- Other household data: enters a 30-day grace period after a deletion request and is deleted when that period ends.
- Audit logs: retained for six years where required for compliance, and de-identified after account deletion.
- Crash reports: retained for 90 days.
- Support tickets and deletion-request records: retained as needed to resolve the request, handle disputes and comply with legal obligations.
- Backups: deleted or overwritten according to the backup rotation cycle. They are not used to restore data deleted at a user’s request, except where legally required.
Information may be retained after account deletion where required by law or needed for dispute resolution or security audits. Confirm these retention periods against actual system behavior before launch.
8. Data security
We use safeguards intended to protect information, including TLS encryption in transit, encryption at rest provided by cloud services, database row-level access controls, encrypted local database storage, access controls, secure token storage and audit logs.
No system can be guaranteed completely secure. Please protect your password, multi-factor authentication devices and pairing information. Do not forward images or links that contain care recipient information to people who should not see them.
9. Your privacy rights
Subject to applicable law, you may have the right to:
- Understand what information we process.
- Obtain a copy of your data. The app currently supports a JSON export of household data, usually completed within 72 hours.
- Correct inaccurate information.
- Request deletion of an account and household data.
- Withdraw consent, without affecting processing that occurred lawfully before withdrawal.
- Object to or restrict certain processing.
- Request data portability.
- Complain to your local data protection authority.
We may verify the requester’s identity. The care recipient, their legal representative or an authorized caregiver may submit a request. We generally respond within 30 days, or within another period required by law.
Users in the European Economic Area or United Kingdom may complain to their local data protection supervisory authority. California residents may have rights to know, delete and correct personal information under applicable California law. We do not sell personal information or use it for cross-context behavioral advertising.
10. Minors and care recipients who need representation
Caregiver account holders must be at least 18 years old and legally capable of entering into a contract. Where a care recipient is a minor or lacks full legal capacity, a legal representative or other person legally authorized to act on their behalf must provide consent and manage their information as required by law.
11. Changes to this policy
We may update this policy when features, service providers or legal requirements change. We will notify users of material changes through in-app notices, email or other reasonable means. Where the law requires renewed consent, we will request it.
12. Contact us
For privacy questions, data access, correction or deletion requests, or complaints, contact:
ComfiCare Privacy Support
support@comficare.co
Dalian Chengfu Trading Co., Ltd.
Dalian, China