Privacy Policy

Version: privacy-v2.2 · Last updated: 13 October 2026

This policy explains how CareToDoc processes your personal data under the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended). CareToDoc helps you manage information about your health, so part of the data we process is health data, a special category of data (Article 9 GDPR) that we handle with extra care.

This policy covers the CareToDoc app and the account and cloud services that make it work. The caretodoc.com website has its own section ("This website") on its privacy page. It does not cover third-party services you reach from the app (for example Apple's App Store, Google Play, Apple's Health app or Health Connect on Android), which have their own policies.

The caretodoc.com website is for information only: it has no forms or accounts, and it does not load advertising or content from other sites. The only outside tool is the site statistics described below.

• Hosting and delivery. The site is hosted and delivered by Cloudflare, Inc. (Cloudflare Pages). To deliver the pages to you and protect the site, Cloudflare processes your IP address and technical data about the request (for example the page, date and time, browser). We do not keep your IP address; Cloudflare may keep it in its own technical logs for a limited period. Legal basis: legitimate interest in publishing the site securely (Art. 6(1)(f)). Cloudflare acts as our processor; transfers to the United States rely on Cloudflare's certification under the EU-U.S. Data Privacy Framework, with the European Commission's Standard Contractual Clauses as a fallback safeguard.
• Site statistics. We use Cloudflare Web Analytics to count visits in aggregate form (pages viewed, country, device type and browser, referring site). It uses no cookies, stores nothing on your device and does not follow you across other sites; Cloudflare processes your IP address only to deliver the data. Legal basis: legitimate interest in improving the site (Art. 6(1)(f)).
• Language choice. When you open the site's main address, we show you the language you chose before; otherwise Italian if your browser asks for it, and English in every other case. This information is used only to pick the page, and the site does not keep it.
• Cookie and browser storage. The site sets a single technical cookie, caretodoc_locale, which contains only the language code. It is saved only if you choose a language from the menu, and it lasts 1 year. When you close the notice about cookies and privacy, the site also saves one value, caretodoc_privacy_note, in your browser's storage (localStorage), so that the notice is not shown again; it has no expiry date and stays on your device until you delete it. Neither requires your consent (Art. 122 of the Italian Privacy Code and the Garante's guidelines of 10 June 2021). You can delete both in your browser settings.

The rest of this policy applies to the app.

Account data

• Your email address, used to create and identify your account. If you sign in with Google or, on iPhone, with Apple, that service gives us the address; with Apple's "Hide My Email" option it may be a relay address generated by Apple.
• Your password is handled only by our authentication provider (Firebase Authentication, a Google service) and is never stored in the app. Accounts created with Google or Apple have no CareToDoc password.
• A technical account identifier and the dates of account events (for example creation and last sign-in).

Profile data

• Required: first name, last name and date of birth. Your first and last name appear in the app and in the header of your reports. Your date of birth is used to check the minimum age (section 13) and to show your age in reports. The measurement system has a default value you can change. These data are stored with your account so the app works the same way on all your devices.
• Your sex, only if you give it (it is optional). It is used only to suggest a more suitable starting value when you enter your weight; if you give it, it is stored with your account like the data above, and you can remove it at any time in Profile.
• Height and weight, only if you give them (they are optional). They are health data: they appear in your profile and in reports, and CareToDoc does not calculate anything from them. They leave your phone only when cloud backup is on (section 4).
• A profile photo, if you add one. It stays only on your phone.
• Your codice fiscale (Italian tax code), only if you choose to add it. It has one purpose only: it is printed in the header of your PDF reports so your doctor can recognise you and file the report. It is optional for everyone; the app only checks its format and derives nothing from it. You can change or remove it at any time in Profile.

Health data (special category, Article 9)

• Your care plan: medicines, therapies and measurements to keep track of, with times, reminders and stock.
• Your entries: doses taken or skipped, measurement values (for example blood pressure, heart rate, blood glucose, weight, temperature, oxygen saturation), calendar events such as visits and symptoms, with the notes you add.
• Items you delete, which stay in the trash for 90 days with their history (section 4).
• Values imported from Apple Health on iPhone or from Health Connect on Android (optional, a Pro feature, only if you connect the app and grant permission on your phone): the measurements you approve, limited to heart rate, resting heart rate, blood oxygen, blood pressure, blood glucose, weight and body temperature. You choose how far back to go (30 days, 12 months, everything, or a date you pick); older history arrives as period averages (on iPhone calculated by Apple Health, on Android by CareToDoc on your phone). For each imported value the app also keeps the original reading on your phone (time or averaging period, number of readings when known, exact value, and the technical identifier Apple Health or Health Connect assigns to the reading).
• Personal ranges (optional): the minimum and maximum you can set for a measurement, with the date from which they apply. In reports they appear as "entered by you".
• The settings of the reports you create for a doctor or for someone who cares for you, and the PDF reports.

Subscription data

• Your plan (Free or Pro, including the first month of Pro) and its dates. Payment is handled by the store you buy from, Apple's App Store or Google Play: we never see or store your card details.
• The start date of your included first month of Pro, recorded in your account space with our servers' time, together with the fingerprint of the email address the month started with (see "Anti-abuse data"). It lets the remaining days of the month apply on every phone you sign in on, even after a reinstall.

Preferences

• Your email choices (Tips and Offers).
• App preferences such as language, sounds, vibration and names in notifications: they stay on your phone. Your language is passed to Firebase only so that the address-confirmation and password-reset emails are written in your language. Unless you have turned off anonymous usage statistics, the app language also reaches TelemetryDeck as an anonymous signal (see below).

Anti-abuse data

• The included first month of Pro is available only once per email address. When your month starts we keep a fingerprint (SHA-256 hash) of your email address, together with your technical account identifier and the start date. The fingerprint does not contain the address, but someone who already knows an address can check whether it matches: that is why we treat it as personal (pseudonymised) data. A marker of the same kind also stays on your phone.

Consent records

• When you give or withdraw a consent we keep a record of it (which consent, the version of the text, date and time, how you gave it, the account email, the phone's system (iOS or Android) and the app language), so that we can demonstrate it as the GDPR requires.

Technical connection data

• When the app connects to the services described in section 6, they receive your IP address and technical device data (for example model, system and app version), as happens with any internet connection. The app contains no crash-reporting or advertising tools; the only statistics are the anonymous usage statistics described below.

Anonymous usage statistics

• Unless you turn them off, the app sends TelemetryDeck anonymous signals about how it is used: the app being opened, the tabs you open, the steps of registration and of the tutorial, adding something to the care plan (without saying what or of which type), the fact that you recorded or changed something on Today, at most once each time the app is started (without saying what, how many times, or whether a dose was taken or skipped), creating and sharing a report (only the format), opening the plans page, starting, completing, cancelling or failing a purchase (only monthly or annual), restoring purchases, turning backup on and off, the app language, the app being opened from the widget or, on iPhone, by Siri, and the fact that «Take all» in the widget recorded doses, at most once each time the app is started (without saying which doses, how many times, or for which part of the day). Each signal carries generic technical data added by the TelemetryDeck library: for example model and system version, app version, language, region and time zone set on the phone, day and hour of sending, usage counters (for example number of sessions and of days of use) and some of the phone's accessibility settings (text size, bold text, reduce motion and transparency, inverted or darker colours, differentiate without colour).
• The signals never contain health data, names of medicines or measurements, values, notes, your name, email, codice fiscale, your account identifier or any other text you type. To count usage without knowing who you are, the TelemetryDeck library turns a random device identifier into a fingerprint (salted hash) on the phone before sending; TelemetryDeck does not store the IP address.
• You can turn them off at any time in Profile → Preferences → "Anonymous usage statistics" (on by default): from that moment the app sends nothing more.

Messages you send us

• If you write to support@caretodoc.com we process your address and what you write, only to reply to you.

We process only the data needed for the feature you use.

On your phone. The app works on your phone first: your care plan, entries, reports and trash are saved in the app's database on your device, which remains the reference copy. If you have iPhone backup turned on (to iCloud or to a computer), the app's data, including health data, reports and your profile photo, is included in that backup like your phone's other data: you manage it, under Apple's rules. On Android, CareToDoc's data is not included in the phone's backup (Google backup) or in the transfer of data to a new phone: to find it again on another phone, use CareToDoc's cloud backup (section 4; restoring on another phone is a Pro feature).

In your private account space, in the European Union (Cloud Firestore, European region). This always holds: your profile (first name, last name, date of birth, measurement system and, if you gave it, your sex), your email address, your consent records and a copy of your plan status; once your included first month of Pro starts, also its start date with the email fingerprint (section 2). The app does not read the copy of your plan status back: we keep it only as a reference for support, when you write to us; the status that counts is the one managed by RevenueCat and the store (App Store or Google Play). If you turn backup on, the backup is kept here too (section 4). Removing data from a phone does not delete your account space; deleting your account does.

Sign-in data. Your email, credentials and technical identifier are processed by Firebase Authentication in the United States, with the safeguards described in section 6.

What CareToDoc never uploads to its servers: your PDF report files, your personal ranges, your profile photo, the values imported from Apple Health or Health Connect that you have not corrected, and the original readings behind them. An imported value that you correct by hand becomes your own data and follows the backup rules, keeping the label of its source ("Apple Health" or "Health Connect").

Saved reports are kept in CareToDoc's folder on your phone. On iPhone it is visible in the iOS Files app: you can open, copy, move or delete them without going through the app. On Android it stays in the storage reserved for the app: you open, share or delete them from the app. Anyone who can unlock your phone can see them. Uninstalling the app deletes the folder. When you share a report (email, messages…), the app and the people you choose receive it, under their own rules.

Apple Health. CareToDoc reads Apple Health only after you connect it and approve access in iOS, only to read (it never writes to Apple Health) and only to fill values you have not entered yourself. Apple Health data is never used for advertising or marketing or passed on to third parties. You can withdraw access at any time in the Health app or in iOS Settings. In CareToDoc you find it in Profile → Apple Health.

Health Connect (Android). CareToDoc reads Health Connect only after you connect it and approve access on your phone, only to read (it never writes to Health Connect) and only to fill values you have not entered yourself. Health Connect data stays on your phone (we do not upload it to our servers, except a value you correct by hand, as with Apple Health) and is never used for advertising or marketing, sold or passed on to third parties. The use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. You can withdraw access at any time in the Health Connect app or in Android Settings. Withdrawing access does not delete values already imported: they stay in CareToDoc until you delete them, remove data from this phone, delete your account or uninstall the app. In CareToDoc you find it in Profile → Health Connect.

Backup is optional and starts only after you have given your explicit consent, on any plan. Without backup, your health data stays on your phone.

What it contains: your care plan, entries, events, report settings, the items in the trash and, if you gave them, your height and weight and your codice fiscale. It is kept in your private account space in the European Union.

How it works. The app updates the backup by itself, about 30 seconds after your last change and, if a change is still waiting, when you leave the app. Besides uploading, the app reads your backup, with the same protections, for these purposes:

• with Pro, to keep your devices in step: it downloads changes made elsewhere when you open the app, when you come back to it and, while it is open, at regular intervals (every minute, less often if you are not doing anything). Restoring your data on a new phone is a Pro feature;
• on every plan, to handle deletions and merges: to ask you whether to merge a phone's data into a backup that already holds some; to set or remove the erase date of items you move to the trash or restore; and, before erasing an item on day 90, to check that it has not been restored on another of your devices. On the Free plan the app uses only the information needed for these checks and copies nothing else into your data on the phone; the Firebase library may keep a temporary copy in its own storage on the device, which is emptied when you remove the data from the phone or change account.

Data from another account. If a phone holds care data that was not created with your account, before saving it to your backup the app asks you whether it is yours (including data you entered for someone you care for). Until you answer, nothing leaves that phone.

Trash. When you delete a medicine or a measurement, it goes to the trash with all its history, on the phone and, if backup is on, in the backup too.

• After 90 days it is erased for good: on the phone the first time the app is opened after the deadline; in the backup, by the cloud itself, normally within 24 hours of the deadline, even if no phone connects any more. The two cases described below are the exceptions (item restored on another device, trash with backup off).
• "Delete for good", in Profile → Recover deleted medications and measurements, erases it at once, on any plan.
• "Restore" is a Pro feature. If your Pro plan ends while an item is in the trash, you will no longer be able to restore it and it will be erased on day 90.
• If in the meantime you restored it on another of your devices, it is not erased. On a phone on the Free plan, which does not download changes from the backup, it stays hidden in that phone's trash, with no expiry date, until the phone receives the changes from the backup (with Pro).
• If you move an item to the trash while backup is off, the backup keeps the previous copy (not in the trash), which has no 90-day erase date.
• The data export (section 11) also includes the trash, on every plan.

Several devices. If you use the same account on several devices, the data stays on each phone, but for the cloud the last choice you make applies: turning backup off, deleting the cloud copy or withdrawing your health-data consent applies to the whole account, and all your devices stop uploading data. If you then turn backup back on on one device, it resumes on the others too, except those where you chose "Not now" for sync. If you deleted the cloud copy, turning backup back on rebuilds it from all your devices: each device where sync is on uploads again all the care data it holds, including its trash.

Duplicates. If the same medicine or measurement ends up twice in your care plan (same name, dose or unit, times and repetition), for example because it was added on two devices before they synced, the app joins the two copies into one, on every plan, keeping everything you recorded. If the two copies hold different answers for the same dose, the dose counts as taken and the other answer is kept as an extra entry that the report does not count; you can correct it in the app.

Turning backup off. In Profile → Cloud backup you can turn it off: future backups stop on all your devices and the data stays on the phones. Height, weight and codice fiscale are removed from the cloud as soon as you turn it off. Turning it off does not delete the rest of the cloud copy. To delete it, choose "Turn off and delete" when you turn it off or, later, "Delete the cloud copy" on the same page, which appears when backup is off and a copy is still in the cloud. Withdrawing your health-data consent also deletes it (section 11).

• Creating and running your account; keeping your profile on all your devices; checking the minimum age. Data: account, profile. Legal basis: contract, Art. 6(1)(b).
• Making the app work with your care plan and your entries, including height and weight. Data: health data. Legal basis: explicit consent, Art. 9(2)(a) and 6(1)(a).
• Cloud backup, sync, restore and handling the trash in the backup. Data: health data (including height and weight), codice fiscale. Legal basis: explicit consent, Art. 9(2)(a) and 6(1)(a).
• Printing your codice fiscale in reports. Data: codice fiscale. Legal basis: contract, Art. 6(1)(b) (a feature you ask for).
• Managing the Pro subscription across devices (through RevenueCat). Data: technical identifiers, purchase and subscription data. Legal basis: contract, Art. 6(1)(b).
• Sending you account emails (address confirmation, password reset). Data: email. Legal basis: contract, Art. 6(1)(b).
• Connecting the app to the services and protecting them. Data: IP address, technical device data, attestation that the app is the genuine one (App Check, section 8). Legal basis: contract, Art. 6(1)(b); legitimate interest in security, Art. 6(1)(f).
• Making the included first month of Pro apply on all your devices. Data: start date of the included month, email fingerprint. Legal basis: contract, Art. 6(1)(b).
• Granting the first month of Pro only once per email. Data: email fingerprint, technical identifier, start date. Legal basis: legitimate interest, Art. 6(1)(f) (abuse prevention).
• Keeping proof of consents. Data: consent records. Legal basis: legitimate interest in demonstrating GDPR compliance, Art. 6(1)(f) (Arts. 5(2) and 7(1) GDPR).
• Understanding how the app is used, to improve it (anonymous usage statistics). Data: anonymous usage signals, generic technical device data, fingerprint of a random device identifier. Legal basis: legitimate interest in improving the app, Art. 6(1)(f); you can object at any time by turning the statistics off (section 11).
• Replying to your messages and supporting you. Data: email, message content, copy of your plan status. Legal basis: contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c), for requests about your rights; if you send us health data, we use it only to reply to you, on the basis of your explicit choice to send it (Art. 9(2)(a)).
• Sending you Tips and Offers, only if you agree. Data: email, first name, plan, email choices. Legal basis: consent, Art. 6(1)(a).

The health-data consent is required to use CareToDoc: without it the app cannot work. You are never obliged to give it and you can withdraw it at any time (section 11). Where we rely on legitimate interest you can object (Art. 21).

CareToDoc makes no automated decisions and does no profiling that produces legal or similarly significant effects on you (Art. 22). It draws no medical conclusions and does not infer illnesses from medicine names.

We do not sell your data and we never use health data for advertising. We use a few providers ("processors") that act on our instructions, under a data processing agreement:

• Google — Firebase Authentication, Cloud Firestore and Firebase App Check. Firebase Authentication processes sign-in data (email, credentials, identifier) in the United States; Cloud Firestore keeps your account space and, if you turn it on, the backup in the European Union; Firebase App Check checks that requests to the services come from the genuine CareToDoc app (section 8).
• Google — Google Workspace, for the support@caretodoc.com mailbox: it receives the messages you send us.
• Cloudflare, Inc. (United States) — routes the emails you send to support@caretodoc.com to the Google Workspace mailbox: it handles them in transit only, without storing them.
• RevenueCat, Inc. — manages subscription status across devices. It receives an anonymous identifier created when the app opens and, after sign-in, your account's technical identifier; your App Store or Google Play purchase data; your subscription status; technical device data and your IP address. It does not receive your name, email or health data. It stores the data in the United States.
• Brevo (Sendinblue SAS, France) — delivers your account emails (address confirmation and password reset), which Firebase Authentication sends through Brevo's service: that is why it receives your email address and the text of the message. We do not send Tips or Offers today; if we do, it will be only to people who agreed and through Brevo, which will then also receive your first name, plan status and email choices. Never health data.
• TelemetryDeck GmbH (Germany) — receives the anonymous usage statistics (section 2), unless you have turned them off, and keeps them on servers in the European Union. It never receives health data, your name, email, codice fiscale or your account identifier, and it does not store the IP address.

These act as independent controllers:

• Apple, for App Store payments (CareToDoc does not receive payment data), for "Sign in with Apple" on iPhone (it gives us only your account email or a relay address), for App Attest (section 8) and for the Health app on your iPhone;
• Google, for Google Play payments (CareToDoc does not receive payment data), for "Sign in with Google" (it gives us the email of your Google account; Firebase may also record the name and profile picture of the Google account, which CareToDoc does not use), for Play Integrity (section 8) and for Health Connect on your Android phone.

Transfers outside the European Economic Area. For Google, certification under the EU-U.S. Data Privacy Framework, with the European Commission's Standard Contractual Clauses as a fallback safeguard; for RevenueCat, the Standard Contractual Clauses; for Cloudflare, certification under the EU-U.S. Data Privacy Framework. You can ask for a copy at support@caretodoc.com.

Notifications are created and shown by the phone itself: no server sends them.

• Care reminders. By default notifications show the names of medicines, measurements and events. You can hide them in Profile → Preferences → "Hide names in notifications and in the widget". The widget (on iPhone on the Home and Lock Screen, on Android on the Home screen) shows the current part of the day, how many medicines are still to take and how many measurements still to do in it (counts only: never a measurement's name or value), the next medicine and today's percentage (medicines and measurements); it follows the same names setting. The widget's "Take all" button marks the medicines of that part of the day still to take as taken without opening the app. Once nothing is left to take in that part of the day, the button turns into "All taken" with a green check: pressing it again puts every medicine of that part of the day back to take, skipped ones included, and on iPhone, on a locked phone, it asks you to unlock first. Every dose can be corrected in the app. The first press, like "Take" and "Skip", may work without unlocking the phone.
• "Take" and "Skip". Reminders for a single medicine have these two buttons, which also work while the phone is locked, without unlocking it (on Android, if the phone shows notifications on the lock screen). Anyone holding the phone can therefore answer; the dose stays recorded in the app, where you can correct it, and with backup on it reaches the cloud like any other change.
• Plan reminders. When Pro has an end date and does not renew by itself (always, during the included first month), the app shows three informational notifications, at 10:00: 7 days before ("Your Pro ends on …"), 1 day before ("Your Pro ends tomorrow") and on the day itself ("Your Pro ends today"), the last one only if Pro is still active at that time. The text is always "Renew your plan so you don't lose the Pro benefits." They contain no health data. You can turn them off in Profile → Preferences → "Pro plan reminders" (on by default).

• On your phone, data is protected by the system's encryption (iOS or Android), which fully protects it when you set a screen lock (passcode, PIN, pattern or password).
• If you turn on the app lock in Profile → Preferences ("Require Face ID to open CareToDoc" on iPhone, "Require biometric unlock to open CareToDoc" on Android), the app asks for Face ID, your fingerprint or face unlock, or your phone's screen lock when it opens. The check is done by the phone's system: CareToDoc never receives your biometric data, and the setting stays on this phone. The widget and the "Take" and "Skip" buttons in notifications keep working as described in section 7.
• Your account space and backup are protected by per-account access rules (each account can reach only its own data) and are encrypted in transit and on the provider's servers.
• To protect the services against abuse, the app asks the phone's system to attest that it is the genuine CareToDoc app (App Attest on iPhone, Play Integrity on Android) and sends this attestation to Firebase App Check (section 6). Apart from the device attestation it contains no personal data: never your care data, your name or your email.
• The app never stores passwords.
• "Remove my data from this device", when you sign out, deletes the care data and Firebase's temporary storage from the phone.

No system is one hundred per cent secure, but we take appropriate technical and organisational measures (Art. 32).

• Giovanni Trebini
• Postal address: at the start of the Terms and Conditions
• Email: support@caretodoc.com

We have not appointed a data protection officer (DPO). For privacy matters, write to support@caretodoc.com.

• Account, profile and account space, including the start date of the included month: until you delete your account.
• Cloud backup: until you delete it ("Turn off and delete" or "Delete the cloud copy"), withdraw your health-data consent or delete your account. Turning backup off without deleting it leaves the copy in the cloud, except height, weight and codice fiscale, which are removed.
• Items in the trash: 90 days, on the phone and in the backup, except as described in section 4 for an item restored on another device and for backup turned off.
• Data on your phone: until you remove it, withdraw your health-data consent, delete your account or uninstall the app.
• Consent records, including the history of every grant and withdrawal with its date and the version of the text: as long as the account exists, even after a withdrawal, so that we can show when you gave and withdrew each consent; they are deleted with the account.
• Anti-abuse fingerprint in the cloud: it remains after the account is deleted, so that the included month cannot be obtained more than once, and is deleted within 3 years of the month's start date. The marker on your phone remains until the app is uninstalled, even if you remove your data or sign out.
• Data held by RevenueCat: deleting your account does not delete it automatically; we have it deleted if you ask us at support@caretodoc.com.
• Anonymous usage statistics: TelemetryDeck keeps them available for queries for the period of the plan we use (90 days on the free plan, up to 2 years on paid plans); it then moves them to an archive that cannot be queried, for which TelemetryDeck does not currently state a deletion date. They contain no data that identifies you directly.
• Accounts never completed (registration stopped before the profile): deleted after 12 months of inactivity.
• Residual copies in our cloud provider's security systems: removed within at most 180 days of deletion, as its agreement provides.
• Support messages: as long as needed to handle the request.

You have the right to access your data, correct it, erase it, restrict its processing, object, receive it in a readable format (portability) and withdraw a consent at any time, without affecting processing carried out before.

You can exercise many of them directly in the app:

• Access and correction: you view and edit your profile and care data in the app.
• Portability: Profile → Account → Account ownership and control → Export my data. You get a .zip file of CSV sheets created from the data on this phone: profile (with height and weight), codice fiscale if present, care plan and schedules, entries and events, event reminders, personal ranges, original Apple Health or Health Connect readings, list of saved reports, trash, and consents with their dates and, when it is recorded, the account email. The exception is the consent history (every grant and withdrawal), which is read from the cloud at the moment of the export: it needs a connection, and if none is available the archive says so. It is available on every plan, including Free. If you use backup, its content matches the export only when the phone is in step with the backup. It does not include your profile photo (it stays on the phone), sign-in data, your plan status (including the start date of the included month) or the anti-abuse fingerprint: for these, or for a copy of the backup, write to support@caretodoc.com.
• Withdrawing the health-data consent: Profile → Legal → Withdraw health-data consent. It is as easy as giving it. First it turns backup off for the whole account, so that none of your devices uploads any more data, and deletes the cloud copy (care plan, entries, codice fiscale, height and weight), including the copy of a backup you had already turned off. Then it deletes the health data from the phone and, with it, all the app's data on this phone, including saved reports, your profile photo and your codice fiscale. If the cloud copy cannot be deleted (for example without a connection), nothing is deleted on the phone and you can try again. Your account and sign-in remain and you can give your consent again whenever you like; without consent you cannot use the app's features. The record of your consent and of its withdrawal also remains: we keep it as evidence as long as the account exists (section 10).
• Withdrawing backup only: Profile → Cloud backup → turn it off and, if you wish, choose "Turn off and delete" to delete the cloud copy; you can also delete it later with "Delete the cloud copy". It applies to all your devices; the data stays on the phones.
• Erasing a single item: Profile → Recover deleted medications and measurements → Delete for good.
• Erasing everything: "Delete account", in Profile → Account → Account ownership and control, and also on the email confirmation screen, in the age notice and in the initial profile form. It deletes your account, your account space, the backup and the data on the phone. If you used "Sign in with Apple" and delete the account from an iPhone, we ask Apple to revoke the authorisation granted to CareToDoc as well (the account is deleted even if that request fails). If you delete it from Android, you can remove the authorisation yourself in your Apple Account settings (Sign in with Apple).
• Objecting to anonymous usage statistics: Profile → Preferences → "Anonymous usage statistics". Turn them off and the app stops sending them at once.
• Objecting to processing based on legitimate interest: write to support@caretodoc.com.
• Email: Profile → Preferences → Email preferences.

For any other request, write to support@caretodoc.com. We reply within one month, which may be extended by two further months for complex requests, and we will tell you if so.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of the country where you live.

Tips and Offers by email are turned on only with the separate boxes at registration: they are off unless you turn them on, and leaving them off does not limit the app. You can change your mind at any time in Profile → Preferences → Email preferences. We do not send emails of this kind today; when we do, each one will contain a link to unsubscribe and will be sent through Brevo (section 6).

To create an account you must be at least 18. If you live in the European Union or the European Economic Area, the minimum age your country's law sets for consenting to online services is enough: 14 in Italy, 13 to 16 in the other countries. The country is the one of your store account (App Store or Google Play); if that is not available, the minimum is 18. We do not knowingly collect data from minors under the minimum age through an account of their own. A parent or guardian can use CareToDoc for a minor from their own account.

You may record another person's health data in CareToDoc only if you are their parent or guardian (or otherwise their legal representative), or if that person has given you their explicit consent. In every case, tell them that you use CareToDoc for them and how their data is processed, for example by showing them this policy. CareToDoc treats these data like your own. The same applies to the codice fiscale: add another person's only if the doctor who receives the report needs it, and under the same conditions.

We may update this policy. If a change is material we will let you know and, where needed, ask for your consent again. The date of the last update is shown at the top.

support@caretodoc.com, or by post to the address given at the start of the Terms and Conditions.

This section adds to the rest of this policy, which applies everywhere. Your data is processed as described in the sections above, with the same providers and in the countries listed in section 6, wherever you live. If you live in one of the countries below, you also have these rights. To exercise them, write to support@caretodoc.com: we reply within the time your country's law sets, and within 30 days at the latest.

United States

• We do not sell your data, we do not use or share it for targeted advertising, and we do not use it to profile you.
• Under your state's law you can ask to know what data we hold, get a copy of it, correct it, delete it and withdraw your consent. You can do most of this in the app (Export my data, Delete account, Preferences, Withdraw health-data consent); for the rest, write to us. If we turn down a request, you can ask us to reconsider it by writing to the same address.
• For consumer health data in Washington and Nevada there is a dedicated notice, the "Consumer Health Data Privacy Policy", at https://caretodoc.com/consumer-health-data.html.
• If a security breach involves your health data, we will notify you as the FTC Health Breach Notification Rule requires, without delay and no later than 60 days after we discover it.
• California: information about your health stays confidential, as the Confidentiality of Medical Information Act requires; we do not disclose it to anyone without your authorization, except the technical providers in section 6 that process it on our behalf, or where the law requires it.

Canada

• The person responsible for protecting personal information is Giovanni Trebini, support@caretodoc.com.
• Your data is stored and processed outside Canada (and outside Québec), in the countries listed in section 6, with adequate safeguards.
• You can access your data, correct it and withdraw your consent. You can file a complaint with the Office of the Privacy Commissioner of Canada or, if you live in Québec, with the Commission d'accès à l'information.

Australia

• We handle your data under the Australian Privacy Principles; we collect health data only with your consent.
• Your data is stored outside Australia, in the countries listed in section 6.
• You can access your data and correct it. If you have a complaint, write to us: we look into it and reply within 30 days. If our reply does not satisfy you, you can complain to the Office of the Australian Information Commissioner (OAIC), oaic.gov.au.

New Zealand

• The privacy officer is Giovanni Trebini, support@caretodoc.com.
• Your data is stored outside New Zealand, in the countries listed in section 6, with safeguards comparable to those of New Zealand law.
• You can access your data and correct it; you can complain to the Office of the Privacy Commissioner, privacy.org.nz.

Singapore

• The Data Protection Officer is Giovanni Trebini, support@caretodoc.com.
• Your data is stored outside Singapore, in the countries listed in section 6, with protection comparable to that of Singapore law.
• You can access your data, correct it and withdraw your consent; you can complain to the Personal Data Protection Commission (PDPC).

Switzerland

• Your data is disclosed abroad to these countries: European Union countries (Belgium, the Netherlands and Finland: Google's Cloud Firestore), Germany (anonymous usage statistics, TelemetryDeck), France (account emails, Brevo) and the United States (account sign-in with Firebase Authentication, subscription status with RevenueCat, the support mailbox with Google Workspace, email routing with Cloudflare), with the safeguards described in section 6 (for Switzerland: the Swiss-U.S. Data Privacy Framework and the Standard Contractual Clauses adapted to Swiss law).
• You can contact the Federal Data Protection and Information Commissioner (FDPIC).

Hong Kong

• We use your data only for the purposes described in this policy. You can ask to access it and to correct it; you can complain to the Privacy Commissioner for Personal Data (PCPD).