Privacy

What CareShop holds, and what leaves it.

In plain words. If this page and a screen in the product disagree, the screen is the bug.

Protected health information

One table: residents — diet tags, allergens, one texture level, Fatal Four roles and prep preferences. Enough for a tray note and a menu check. There are no clinical columns, and the validator refuses a name.

Personal information

Memberships: the people who sign in, and their membership of an organisation and its houses.

Public

Everything else — the catalogue, stores, prices, rule sets.

Where it lives

Records are held in Convex, in the United States, under a business associate agreement. Stripe takes payment and holds the card; we never see a number. Email goes through Resend. Those three are the only processors.

Because it holds protected health information, you accept a customer business associate agreement at signup, presented in full.

What leaves the product

Channel by channel.

Logs: The Convex dashboard only. No third-party log destination.
URLs: Opaque short-codes. A link cannot be read for a name.

This website

This page loads no analytics script, no advertising pixel and no third-party tag. Signing up takes you to the application, which presents its own terms and privacy notice.

Cookies, and what is kept on your device

Nothing is kept until you answer the cookie question, except the display choices you made in the header. Saying no keeps nothing but the no.

pho-consent: Your answer, as the word all or min. It lasts a year so you are not asked on every visit.
pho-mode: Your dark-mode choice, and where offered your text-size choice as pho-text, in this browser’s local storage. Never sent to a server.
pho-draft: Only if you said yes. What you typed into a form and have not sent, so a refresh does not lose it. Deleted the moment the message sends.

None of it identifies you to us or follows you anywhere. Clear this browser’s site data and you are simply asked again.

Your rights

Export everything the product holds for your organisation at any time, and after a cancellation. Ask us to delete a record and we delete it; the audit log of who did what is kept, because a record that can be quietly removed is not an audit log.

The Terms of Service and, where one applies, the customer business associate agreement are presented at signup and kept in your account. This page summarises; it does not replace them.

Back to CareShop