Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information you provide: name, email, phone number, and date of birth.
• Wellness data you log in the app, such as check-ins, reminders, and medical details you choose to add.
• Location data, only when you enable location features and only shared with contacts you authorize.
• Information about the family members, guardians, and emergency contacts you add: their name, relationship, phone number, optional email address, and how they prefer to be notified.
• Notification records: which contacts were notified, by which channel, and whether delivery succeeded; and, when a contact turns on push notifications, the push subscription their browser gives us for that device.
• Device and usage information (device type, app version, and diagnostic logs) used to keep the app working and secure.

2. How we use your information

• To provide wellness reminders, check-ins, and safety features.
• To share your status with family members and caregivers you authorize.
• To connect you with partner services you choose to opt into.
• To secure our services, prevent fraud, and comply with legal obligations.
• To improve the Aged Oak experience. We never sell your personal data.

3. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of our contract with you (to provide the service), your consent (for optional features such as location sharing, which you can withdraw at any time), our legitimate interests (to secure and improve the service), and compliance with legal obligations.

4. How we share information

Your information is shared only with:

• Family members and caregivers you explicitly authorize.
• Emergency services when you trigger an SOS.
• Partner services you choose to connect.
• Service providers that host and operate our infrastructure, under strict data-processing agreements — including Brevo (email delivery), Twilio (text messages, WhatsApp messages, and phone calls), and the push services run by browser and device makers (such as Apple, Google, and Mozilla) that deliver push notifications.
• Authorities where required by law. We do not sell your personal information and do not share it for cross-context behavioral advertising.

5. Notifications to your contacts

When you add a contact and turn on notifications, we tell them about your daily check-ins and alert them if you miss one. You choose each contact’s preferred channel — email, WhatsApp, text message (SMS), or push notification. If that channel can’t reach them (for example, it isn’t set up or a message fails), we try their other available channels. For urgent alerts, such as a missed check-in, and only when every other channel fails, we may place an automated phone call to the contact’s number.

Email: we send notification emails to the address you provide through our email provider, Brevo. Every email includes a link the contact can use to stop receiving them.

Push notifications: a contact turns these on themselves, on their own device, from a link you share with them. The notification is encrypted before it is handed to their browser or device maker’s push service for delivery. They can turn push notifications off at any time from the same link or in their browser or device settings.

WhatsApp and phone calls: these are delivered through Twilio. Before we send WhatsApp messages to a contact, we will ask for their agreement as WhatsApp’s policies require.

Contacts can ask you to remove them, or contact us at privacy@agedoak.app, and we will stop notifying them. We share contact details and message content with these providers only to deliver the notifications you requested, never for marketing.

6. Text messaging (SMS)

With consent, we send informational SMS text messages about daily check-ins, check-in confirmations, missed check-in alerts, and emergency notifications. When you add a contact who prefers text messages, we first send them a text asking them to confirm; they receive no other texts from us unless they reply YES from their own phone. We keep a record of each confirmation request and reply as evidence of consent.

To deliver these messages we share the mobile number and message content with our messaging provider (Twilio) acting as our service provider under a data-processing agreement, solely to send the messages you requested. We do not use these numbers for marketing.

No mobile information (including opt-in/SMS consent) will be shared with third parties or affiliates for marketing or promotional purposes. Message frequency varies, and message and data rates may apply. Recipients can opt out anytime by replying STOP (or get help by replying HELP), and you can turn off notifications for any contact in Settings.

7. Location data

Location tracking is an opt-in Premium feature. Location data is encrypted in transit, shared only with contacts you approve, and retained no longer than 30 days. You can disable location sharing at any time in Settings.

8. Data retention

We keep your personal data only as long as your account is active or as needed to provide the service. Location data is retained for up to 30 days. Notification delivery records are kept while your account is active. Records of SMS consent requests and replies (the phone number, the message, and when it was sent or received) may be kept after an account or contact is deleted, as evidence of consent where the law requires it. When you delete your account, we delete or anonymize your personal data within 30 days, except where we must retain it to meet legal, accounting, or security obligations.

9. Data security

We use industry-standard safeguards, including encryption at rest (AES-256) and in transit (TLS 1.3), regular security reviews, and strict access controls. No system is perfectly secure, but in the unlikely event of a data breach affecting your information, we will notify you and any required regulators within 72 hours.

10. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to object to or restrict certain processing; and to withdraw consent. California residents (under the CCPA/CPRA) have the right to know, delete, correct, and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising these rights — note that we do not sell or share personal information as those terms are defined by law.

To exercise any of these rights, contact us at privacy@agedoak.app. We will verify your request and respond within the timeframe required by law (generally 30–45 days).

11. Cookies & similar technologies

Our website uses only essential cookies required to sign you in and keep the site secure. We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling essential cookies may prevent you from signing in.

12. International data transfers

We are based in the United States and may process your information there or in other countries. Where we transfer personal data internationally, we use appropriate safeguards such as Standard Contractual Clauses to protect it.

13. Children’s privacy

Aged Oak is designed for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

14. Third-party partner services

When you connect a partner service (such as a ride, delivery, or health integration), that partner processes your data under its own privacy policy. We encourage you to review those policies. Aged Oak is not responsible for partners’ privacy practices.

15. Changes to this policy

We may update this Privacy Policy from time to time. For significant changes, we will notify you by email or in-app notification at least 30 days before they take effect, and we will update the “Last updated” date above.