Privacy Policy

We collect the following information when you use Cercle: Account Information: Name, email address, phone number (optional), and a password hash when you use password sign-in. Care Recipient Information: Name, date of birth, medical conditions, medications, and care notes you choose to enter. Documents: Any medical documents, prescriptions, or files you voluntarily upload. Usage and Security Data: Authentication, audit, request, device/browser, and operational records used to secure and operate the service.

Your information is used exclusively to: • Provide and improve Cercle services • Send you important notifications (medication reminders, appointments) • Communicate with you about your account • Ensure security and prevent fraud • Comply with our legal obligations We never use your health data for targeted advertising.

We only share your personal information with: Members of your care circle: According to the permissions you grant each member. Service providers (subprocessors): These providers are bound by data-protection terms: • Neon — Database hosting (North America) • Vercel — Application compute and private document storage configured in Montréal; other platform operations may occur outside Canada • Resend — Transactional email delivery (United States) • Stripe — Payment processing • Sentry — Technical error diagnostics (without session replay); diagnostic processing may occur outside Canada Legal authorities: Only if required by applicable law. We never sell, rent, or share your data with advertisers or data brokers.

We take the security of your data seriously: • Encryption: Our infrastructure providers encrypt data in transit and at rest • Hosting: Private documents and application compute are configured in Montréal. Our database and some service providers operate elsewhere in North America, including the United States • Access controls: Authenticated membership and care-circle permissions restrict access • Reviews: We review application security and dependencies regularly • Deletion: Account data is anonymized on request and scheduled for permanent deletion after 30 days; external file deletion is retried durably

Under Quebec and Canadian privacy laws, you may request access to and correction of your personal information, export the information available to you, withdraw consent where applicable, and request deletion of your account. Shared care-circle records may remain available to other accepted members, and limited operational or legal records may be retained as described in this policy. Contact privacy@carecercle.com or use account settings to make a request.

We retain your data while your account is active and as needed to provide the service. When you delete your account, we immediately revoke access, anonymize account identifiers, remove care data that is not shared with another active member, and queue external file deletion. The anonymized account record is permanently deleted from the active database after 30 days. Infrastructure backups may persist for the limited retention period applied by our providers before being overwritten. De-identified operational records may be retained where they can no longer be linked to you.

Cercle is designed to support obligations under Quebec's Act respecting the protection of personal information in the private sector, as modernized by Bill 25, and applicable Canadian privacy requirements. Privacy Officer: Email: privacy@carecercle.com | Address: P.O. Box 55532, Montreal, QC H2T 1A0, Canada. We assess material privacy impacts, maintain an incident process, and will notify regulators and affected individuals when required by applicable law. This policy describes our practices; it is not a certification by a regulator.

Essential cookies maintain your login session, language and privacy choices, and account security. Optional Vercel Web Analytics and Speed Insights measure site use and performance only after you accept. These analytics are cookieless; your choice is stored in your browser. Essential-only use remains available. You can change your choice using the button below. We do not use advertising tracking cookies or third-party cookies for marketing.

You may withdraw consent where applicable by contacting privacy@carecercle.com or deleting your account. Account deletion revokes access immediately, anonymizes the account, removes unshared care data, and queues external file deletion. Shared care-circle records may remain available to other accepted members. The anonymized active-database account is scheduled for permanent deletion after 30 days.

We may update this policy from time to time. In case of significant changes, we will notify you by email and display a visible notice in the application. The date of last update is indicated at the bottom of this page.

For any questions about this policy or your personal data: Privacy Officer Email: privacy@carecercle.com Address: P.O. Box 55532, Montreal, QC H2T 1A0, Canada You may also file a complaint with the Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca We generally respond to requests within 30 days of receipt.