Privacy notice

Last updated July 14, 2026

What CareLog stores

CareLog stores health notes, symptoms, vitals, sleep information, conditions, allergies, medication history and current medication references, care contacts, and other information you choose to enter. An immutable identifier from Auth0 keeps each account's records separate.

Optional account preferences can include profile-specific note templates, appointment questions, pinned or archived profile identifiers, profile markers, reviewed-activity timestamps, recent-profile ordering, and accessibility settings. Templates and appointment questions may contain health information and receive the same authenticated account scoping as notes. Device sync diagnostics remain on the device unless a fixed, content-free telemetry event is sent.

Caregiver profiles

You may create a profile to organize notes for another person. The profile can contain a familiar name or label and your relationship to that person. Only record information you have permission to keep. Creating a profile does not establish guardianship, healthcare authority, or consent from the person represented.

Sharing and permissions

Profile owners may invite a specific email address as a Viewer or Contributor. CareLog checks whether the address uniquely matches an existing, verified, unblocked CareLog identity. If it does, access is added directly and the account is notified. CareLog returns the same private, addressed backup-link workflow whether or not a matching account was found, reducing account-existence disclosure. CareLog stores the invited email address, role, invitation status, expiration, and a one-way hash of the invitation token. Links expire and can be used only by the addressed account.

Viewers can read a shared profile. Contributors can read and add new notes. An owner may separately authorize a Contributor to maintain conditions, allergies, current medications, and care contacts. Contributors cannot edit existing daily notes, delete records, export the profile, or manage sharing.

Ownership transfers

A profile owner may offer ownership to a specific verified CareLog email. CareLog stores the current owner identifiers, addressed email, expiration, status, and a one-way token hash. Nothing transfers until the addressed verified account accepts. Acceptance moves the profile and historical records to the new owner, removes other shared users and pending invitations, removes profile-linked medication reminders, and lets the new owner decide whether the previous owner retains Viewer, Contributor, or no access. Device caches and notification preferences do not transfer. Completed, canceled, and long-expired transfer records are removed after a limited 30-day operational period; the content-free profile audit event remains.

Authorship and sharing activity

CareLog records limited activity for invitations, role changes, note creation, revocation, and doctor-ready profile updates. Health-reference history identifies the authorized account that made a change but does not copy the changed medical values into the activity record. Medical content must not be written to operational logs.

How information is used

Your information is used only to provide the journal, synchronization, search, sharing, printing, export, and deletion features. CareLog does not sell medical information or use it for advertising.

Where information is stored

Authoritative records are stored in Cloudflare D1. Temporary drafts, cached records, checklist flags, and pending synchronization operations may be stored in your browser.

Optional notifications

If you enable notifications, CareLog stores a device-specific browser push endpoint, encryption keys, your verified account email for addressed invitation delivery, selected reminder times, time zone, opaque profile and medication identifiers for medication schedules, and broad technical delivery status. Generic sharing events may remain in a retry queue for up to 24 hours and contain only a recipient account identifier or verified invitation email—not profile labels, roles, or record content. Notification text does not include profile names, medication names, doses, or other medical details. Your browser or device provider processes delivery. You may disable notifications per device or turn off individual notification categories at any time.

Device caching and revoked access

Shared records may be cached temporarily. When CareLog learns that shared access was revoked, it removes the shared-note snapshot and stops blocked retries. An unsynced draft may remain so its author can copy it. Clear device data before transferring or disposing of a device.

Retention and deletion

Records remain until the applicable owner deletes them. Account deletion atomically removes profiles and notes owned by that account, sharing memberships and pending invitations involving the account, notification and preference metadata, local CareLog data in that browser, and the associated Auth0 identity. Notes contributed to another person's profile remain under that profile owner's control, but the deleted contributor's account identifier and display name are removed. Shared activity retained for another owner is anonymized. A shared profile's owner controls that profile's cloud records.

Security and limitations

CareLog uses authenticated access and server-side ownership and permission checks. No internet service can guarantee absolute security. CareLog has not been certified as HIPAA-compliant.

Your choices

You may print or export profiles you own, delete notes, disable profile reminders and device notifications, revoke sharing, clear local device data, or delete your account. Printed and exported files are unencrypted and should be protected carefully.

Contact

For support, privacy requests, or deletion questions, email support@prioritypals.com. Do not include medical details in email.

Medical disclaimer

CareLog organizes information and does not provide medical advice, diagnosis, emergency services, or medication recommendations.