Privacy
policy.

Definitions

Personal Information

Information that identifies you as an individual, such as your name or email address. Under the GDPR this is called “personal data”.

Protected Health Information (PHI)

Health-related information you choose to share. Under the GDPR, health data is a special category of personal data that receives extra protection.

Non-Personal Information

Data that does not identify you directly.

Website

www.careflick.com, including the Oak1 pages, the Oak1 reservation flow and the Agent Store pages.

1. Who We Are

CareFlick, Inc. is the controller of the personal information described in this policy. This means we decide why and how it is processed. You can contact us about anything in this policy at hello@careflick.com.

If we appoint a data protection officer or a representative in the EU or UK, we will add their contact details here.

2. Information We Collect

Sections 2.1 to 2.3 apply if you use the CareFlick AI companion. What this Website collects is described in Section 3.

2.1 Personal Information

If you register for the CareFlick AI companion, we collect personal information directly from you, such as:

• Name
• Email address
• Contact information
• Date of birth
• Languages spoken

2.2 Behavioral Data

If you use the CareFlick AI companion, we may collect data points to enhance interactions, such as:

• Speech patterns
• Emotional cues
• Engagement preferences
• Interaction history

2.3 Protected Health Information (PHI)

If you choose to share health-related information with the CareFlick AI companion, we may collect and process PHI, including:

• Medical history
• Medication details
• Care plans
• Health status updates

Health information is special-category data under Article 9 of the GDPR. We process it only with your explicit consent, which you can withdraw at any time.

CareFlick is HIPAA compliant (the US Health Insurance Portability and Accountability Act). See Section 6.

2.4 Technical and Usage Information

Automatically collected information includes the items below. This information can be personal data when it relates to an identifiable device or person, and we treat it as such.

• Browser type and device details
• Usage statistics
• Analytics data, collected on this Website only with your consent (see Section 10)

3. This Website and Oak1

This section describes the personal information handled through the Website. The Website itself sets cookies only for Google Analytics, if you consent to analytics, and for Stripe on our payment page (see Section 10).

3.1 Oak1 Reservations

Reserving an Oak1 requires a $50 USD refundable deposit, paid on our payment page (careflick.com/reserve/checkout) through a secure payment form provided by Stripe. Your card, Apple Pay, Google Pay or UPI details are entered into Stripe’s own fields and go straight to Stripe; we never receive or store your full card number or your UPI details. Outside the US, Stripe can show you the deposit in your local currency (for example, Indian rupees), and we then also receive the amount and currency you paid in.

To keep payments secure and prevent fraud, Stripe’s script on the payment page collects information about your device and how you use the payment form, sets cookies (see Section 10), and may run a bot check provided by hCaptcha (Intuition Machines, Inc.). This happens only on the payment page.

We receive your name, email address, the delivery country you choose when you reserve, the billing address details Stripe asks for (usually your country and, depending on your card, your postal code) and the payment status of your reservation, together with the amount paid (and the currency you paid in) and a checkout reference. We use this information to confirm your reservation, to contact you about pricing, any subscription terms, delivery (including any delay or cancellation) and your choice to proceed or request a refund, and to process refunds. Stripe keeps a customer record for each reservation (your name, email address and billing details) in our Stripe account, and your delivery country is kept with your reservation in Stripe. Outside Stripe, we keep only your billing country, not the rest of your billing address. We keep a record of each paid reservation and any refund (your name followed by your delivery country, email address, billing country, the amount, the payment status and the Stripe references) in an access-restricted internal spreadsheet in Google Workspace (Google Sheets). We send you two emails through Amazon Web Services (Amazon SES): a confirmation of your reservation (your deposit and the amount you paid, your payment method, for a card its brand and last four digits, the payment date, a link to your Stripe receipt, your delivery country, the next dates and how to cancel), and a short thank-you note from our CEO. Our team is notified of each paid reservation and refund in our team messaging workspace (Slack); the notification contains your name followed by your delivery country, email address, billing country, the amount (and, if you paid in another currency, the amount in that currency), your payment method (for a card, its brand and last four digits; for UPI, only that you used UPI), and the checkout reference. Our server logs contain only the checkout reference, the amount and a pseudonymised reference.

When you reserve, you can also tick an optional box to receive email updates about Oak1. It is unticked unless you choose it, and reserving does not depend on it. If you tick it, we use your email address to send you news about Oak1 and its launch. Your choice, and the version of the wording you agreed to, are kept with your reservation in Stripe, and our team notification shows whether you opted in. You can withdraw at any time through the unsubscribe link in any of these emails or by emailing us at hello@careflick.com; withdrawing does not affect your reservation.

Stripe also processes payment information for its own purposes, such as fraud prevention and its legal obligations, as described in Stripe’s privacy policy.

Reservations are currently open only to people located in the United States and India. When you open the reservation window or start checkout, our hosting provider (Vercel) tells us which country it locates your IP address in. We use the country only to check whether reservations are open there. We do not store it, and it is not sent to Stripe or included in our reservation records or team notifications. It is separate from the delivery country you choose, described above. Our hosting provider’s own request logs are described in Section 3.3.

3.2 Agent Store Partner-Interest Form

If you request an invitation to the Agent Store, we collect:

• Name
• Work email
• Organization
• Role
• Website (optional)
• A description of what your agent or service will do
• Geographies you serve
• Your current stage
• A record of your consent to be contacted (the time and the version of the consent wording)

The Website does not store your submission in its own database. It is delivered to our team’s messaging workspace (Slack) and recorded in an access-restricted internal spreadsheet in Google Workspace (Google Sheets), together with a random reference number that links the two, and our team reviews it there. We use it to assess your interest and to contact you about the developer and service partner program.

3.3 Server and Security Logs

When you visit, our hosting provider receives technical information with each request, such as your IP address, browser and device type, the page requested and the time, so that it can deliver the Website, and its request logs contain this information, including your IP address. Where our own code records an IP address, for example to limit repeated form submissions, it uses only a salted one-way hash (a pseudonymised value), never the address itself. These logs are kept for about 30 days.

3.4 Website Analytics

With your consent only, we measure visits and page performance with Vercel Web Analytics and Speed Insights. See Section 10.

3.5 Contacting Us

If you email us, we keep your message and our reply so that we can help you.

3.6 Live Try-On (Camera)

If you choose to use the live try-on at careflick.com/try-on, your browser will ask for permission to use your camera. The camera picture is processed only on your device, inside your browser, by a body-position model that runs on your device. It is used only to place an image of Oak1 on the picture you see. No video, images or body-position data are sent to us or to anyone else, and nothing is recorded or stored. The camera turns off when you leave the page or close the tab. If you tap “Take a photo”, the photo is created on your device. It is saved only if you tap Save, and shared only if you tap Share and choose where to send it. We never receive it. The try-on files, including the on-device model, are served from our own website, and the page is not allowed to connect to any other service. You can withdraw camera permission at any time in your browser settings.

3.7 Links to Other Sites

Some links open a separate website. That website has its own privacy practices and is not covered by this policy.

4. How We Use Information

4.1 Personal Information

• Personalize interactions
• Provide insights to caregivers
• Communicate updates or support
• Take, manage and refund your Oak1 reservation
• Send you Oak1 updates by email, if you asked for them
• Check whether Oak1 reservations are open in your country
• Respond to Agent Store partner interest

4.2 Behavioral and Non-Personal Information

Supports personalized experiences and improves AI companion technology and user engagement.

4.3 Our Legal Bases

If the GDPR or UK GDPR applies to you, we rely on the following legal bases. We do not rely on your use of the Service as consent.

• Oak1 reservations (payment, confirmation, pricing, delivery and refund communication): performance of a contract with you, or steps you ask us to take before entering into one (Article 6(1)(b)).
• Oak1 update emails (only if you ticked the optional box when reserving): your consent (Article 6(1)(a)), which you can withdraw at any time.
• Checking whether Oak1 reservations are open in your country (from the country of your IP address): our legitimate interests in taking reservations only where we currently offer them (Article 6(1)(f)).
• Providing the CareFlick AI companion to you once you register: performance of a contract (Article 6(1)(b)).
• Protected Health Information: your explicit consent (Articles 6(1)(a) and 9(2)(a)).
• Sharing insights with care partners: your consent (Article 6(1)(a)).
• Website analytics: your consent (Article 6(1)(a)).
• Contacting you about the Agent Store partner program: your consent (Article 6(1)(a)).
• Remembering your cookie choice and keeping records of consent (such as the consent record kept with an Agent Store submission): compliance with our legal obligation to be able to demonstrate consent (Article 6(1)(c)) and our legitimate interests (Article 6(1)(f)).
• Security logs, fraud prevention and abuse prevention: our legitimate interests in keeping the Website and Service secure (Article 6(1)(f)).
• Improving the AI companion using behavioral and non-personal information: our legitimate interests in improving our services (Article 6(1)(f)), or your consent where the law requires it.
• Answering your emails: our legitimate interests in responding to you (Article 6(1)(f)).
• Accounting, tax and other legal requirements: compliance with a legal obligation (Article 6(1)(c)).

Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect processing that took place before you withdrew. Where we rely on legitimate interests, you can object (see Section 9).

5. Sharing Your Information

We do not sell or trade personal information. Data may be shared under these conditions:

5.1 Service Providers

Vendors may access data only to perform tasks for us and must adhere to privacy policies and our instructions. They include:

• Stripe, which processes Oak1 reservation payments and refunds. For payment processing, fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy.
• Vercel Inc., our hosting provider, which serves the Website and processes server logs, tells us the country of your IP address for the reservation check (Section 3.1), and provides Vercel Web Analytics and Speed Insights when you consent to analytics.
• Slack, our team messaging provider, which receives Agent Store partner-interest submissions and internal reservation notifications.
• Google LLC (Google Workspace and Google Analytics), which hosts the internal spreadsheet (Google Sheets) in which we record Oak1 reservations and refunds and Agent Store partner-interest submissions, on our behalf, and provides Google Analytics when you consent to analytics (Section 10.3).
• Amazon Web Services, Inc. (Amazon SES), which sends our Oak1 reservation emails (your name, email address and the content of those emails) on our behalf.

5.2 Legal Obligations

Data may be disclosed if required by law.

5.3 Care Partners

With consent, insights may be shared with caregivers or organizations to improve care.

6. Protecting Your Information

Security measures include:

• An information security management system (ISMS) certified to ISO/IEC 27001:2022
• HIPAA compliant handling of protected health information (PHI)
• Encryption for data in transit and at rest
• Secure authentication protocols
• Regular privacy audits
• On this Website: HTTPS everywhere, strict browser security headers, signature-checked payment notifications, rate limiting and input validation on forms, and IP addresses replaced by salted hashes (pseudonymised) in our application logs

Our compliance status, security controls and policies are published in our Trust Center, where you can request our ISO/IEC 27001 certificate and HIPAA report.

Note: No system is completely secure, and we cannot guarantee absolute security. If you find a security issue, please see our security contact.

7. Data Retention

We retain personal information as long as necessary unless longer retention is required by law. You may request deletion at any time. In particular:

• Reservation and payment records (in Stripe and in our internal reservation records): as long as needed for your reservation and any refund, and then as required by tax and accounting law (for example, up to 7 years).
• Oak1 update email consent: your choice is kept with your reservation record. If you opted in, we use your email address for these updates until you withdraw.
• Agent Store partner-interest submissions (in Slack and in our internal spreadsheet): up to 24 months, unless a partnership begins or you ask us to delete them sooner.
• Server and security logs: about 30 days.
• Website analytics: kept only in aggregated form.
• AI companion account data: as long as necessary to provide the Service to you, unless longer retention is required by law.

8. Children’s Privacy

The AI companion is not intended for users under 13. If such data is collected, it will be deleted. Contact: hello@careflick.com.

In the EEA, we do not knowingly process personal information of children under 16 without the consent of a parent or guardian where the law requires it (some countries set a lower age).

9. Your Rights

You may:

• Access and review your data
• Correct or update inaccuracies
• Request deletion (erasure) of your data
• Ask us to restrict how we use your data
• Receive your data in a portable format (portability)
• Object to processing based on our legitimate interests
• Withdraw consent at any time, without affecting the lawfulness of processing before you withdrew
• Complain to a data protection supervisory authority, in particular in the country where you live or work or where you think an infringement occurred

To exercise these rights, contact hello@careflick.com. We may need to confirm your identity. We will respond within one month. Where a request is complex, we may extend this by up to two further months and will tell you why. Some rights have limits; for example, we must keep payment records required by tax law.

Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

10. Cookies and Tracking

10.1 What Are Cookies?

Small files stored on your device to help recognize preferences and analyze usage. Similar technologies, such as your browser’s local storage, work in a comparable way.

10.2 What This Website Uses

This Website itself sets cookies only for Google Analytics, if you consent to analytics (Section 10.3), and on its payment page (see below). We store your consent choice on your device, in your browser’s local storage under the key cf-consent, so that we do not ask you again on every page. It is valid for 12 months, after which we ask again. Storing this choice is strictly necessary and does not identify you. If our hosting provider needs to check that you are not an automated attacker, it may set a short-lived, strictly necessary security cookie.

Only on our payment page (careflick.com/reserve/checkout), Stripe’s payment script sets two cookies on this Website’s domain to prevent fraud and keep your payment secure: __stripe_mid (kept for one year) and __stripe_sid (kept for 30 minutes). Stripe, and the bot-check service it uses (hCaptcha), may also set cookies on their own domains. These cookies are strictly necessary for the payment you ask for, so they do not need your consent. They are covered by Stripe’s privacy policy.

10.3 Analytics, With Your Consent

Only if you agree, we use two analytics services to count visits, see which pages are read and how visitors arrive at the Website, and measure how quickly pages load. Neither is used for advertising, and there is no cross-site tracking. Our legal basis is your consent (Article 6(1)(a) GDPR).

Vercel Web Analytics and Speed Insights, provided by Vercel Inc., are cookieless. They receive:

• The page URL, without its query string
• The referring page (as your browser reports it)
• Your approximate country
• Your device and browser type
• Performance metrics, such as page load timings
• Your network connection type (for example 4G) and, when measuring how quickly the page responds, which part of the page you interacted with
• Your IP address and browser user agent, which reach Vercel with each request and which, according to Vercel, are used on receipt to work out your approximate country and the daily-rotating visitor hash and are not stored

According to Vercel, visitors are counted using a hashed identifier that is rotated daily, rather than a cookie. See Vercel’s privacy policy.

Google Analytics (Google Analytics 4), provided by Google LLC, sets two cookies on this Website’s domain, _ga and _ga_ followed by an identifier, each kept for up to two years. They hold a random identifier that tells your visits apart; they do not contain your name or email address. Google receives:

• The page URL and title. We have configured Google Analytics to remove the payment-session reference that our reservation confirmation page carries in its URL before the URL is sent
• The referring page (as your browser reports it)
• Your device and browser type, screen size and browser language
• The random identifier from the cookies and the times of your visits
• Your IP address and browser user agent, which reach Google with each request. According to Google, Google Analytics 4 does not log or store IP addresses and uses them only to derive your approximate location (city or region)

We load Google Analytics through Google Tag Manager, a Google service that loads the analytics code described here and sets no cookies of its own. We have turned off Google Signals and all advertising features, so this data is not linked to your Google account and is not used to personalise ads. Google processes it on our behalf (see also Section 11) and explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites. See Google’s privacy policy.

10.4 Managing Your Choice

You can change or withdraw your choice at any time using the “Cookie settings” link in the footer of every page. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics. It overrides any earlier choice to allow them, for as long as your browser sends it. You can also clear your browser’s storage for this Website at any time. Google also offers a browser add-on that blocks Google Analytics on every website.

10.5 Other Sites and Apps

If a payment needs an extra step, such as your bank’s security check or your UPI app, you may briefly be taken to Stripe’s or your bank’s pages, which have their own cookies and policies. CareFlick apps may use their own storage, as described in the app.

The film on our home page is hosted by Vimeo (Vimeo.com, Inc.). Nothing is loaded from Vimeo until you press play. When you do, your browser connects to Vimeo, which receives your IP address and browser details. We load Vimeo’s player with its Do Not Track setting on, to limit player tracking; Vimeo still receives the connection information it needs to serve the film and may use essential security cookies. Vimeo’s handling of data is described in Vimeo’s privacy policy.

11. International Users

Your information may be transferred and processed in other countries. CareFlick is based in the United States, and our service providers (Stripe, Vercel, Slack, Google and Amazon Web Services) process data in the United States and other countries.

When we transfer personal information from the EEA, UK or Switzerland to a country that does not have an adequacy decision, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and their UK and Swiss equivalents) or, where the recipient participates in it, the EU-US Data Privacy Framework. You can ask us for details of the safeguards that apply.

12. Changes to This Policy

We may update this policy. Material updates will be notified 30 days in advance, and we will update the “Last Updated” date at the top of this page. Where a change affects processing that relies on your consent, we will ask for your consent again where the law requires it; continuing to use the Service will not be treated as consent.