- Category L. Sensitive personal information
Your Rights
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:
- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")
Depending upon the state where you live, you may also have the following rights:
- Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
- Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
- Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
- Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
- Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
- Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
- Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)
How to Exercise Your Rights
To exercise these rights, you can contact us by visiting mailto:founder@emberlineapps.com, by emailing us at founder@emberlineapps.com, Mailing address (listed in Section 12 / contact information of this policy), or by referring to the contact details at the bottom of this document.
Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.
Request Verification
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.
If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.Appeals
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at founder@emberlineapps.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.California "Shine The Light" Law
California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"
11. RECORDS CREATED BY CARE PROVIDERS
Carelio is used by both family members and the care professionals they work with. A care professional (such as a nanny) may create care records, including records that reference a child, as part of documenting the care they personally provide, before the child's parent or guardian has created a Carelio account. When a care professional adds a family's contact information, we send the parent or guardian a notice identifying the care professional, showing the type of information being recorded, and explaining the choices below. Parents and guardians do not need a Carelio account to receive these notices or to exercise these choices.
12. PARENT/GUARDIAN NOTIFICATION AND CHOICES
If you are a parent or guardian and a care professional keeps records in Carelio that identify your child, you may at any time: (a) create a free account to view what is shared with you and link with the care professional; or (b) ask us to remove your child's identifying information from the care professional's records. If you choose (b), we replace your child's name and identifying details with a neutral label and delete photos of your child; the care professional's own employment records, such as the dates, times, and duration of the care they provided, are retained, as records of their own work. To make either choice, use the links in any notice email or contact us at founder@emberlineapps.com.
13. PHOTOS SHARED IN CARELIO
Photos taken during care stay with the family's care record for as long as the family keeps that record. They are never included in publicly shareable links or web pages; a shared day report says only that a photo was taken. Within the app, photos are only shared with a family after a parent or guardian has created an account and linked with the care professional.
14. CARE RECORDS AND FAMILY INFORMATION
Care records have two aspects: information that documents the care professional's own work (their hours, shift times, and the factual care log they author), and information that identifies a child or family. The care professional retains their work records, including after their relationship with a family ends or a family stops using Carelio, with child-identifying details removed in those cases as described above. Families control their child's identifying information, photos, and family account data. A care professional or a parent can share a day's report by link. The link shows that day's care entries, shift times, and the handoff note for the children it covers. It never shows photos, emergency information, or account settings. Links expire and can be turned off, and a link that has expired or been turned off shows nothing.
15. THIRD-PARTY CONTACT INFORMATION
Care professionals may provide a family's contact information (such as a parent's email address) so we can send the notices described above. We use this contact information only to deliver those notices and related service communications, never for marketing to non-users, and we do not sell it. We retain it only as long as the underlying notice link is active (links expire automatically and are revoked when the care professional's relationship ends); if you create an account, it becomes your account contact information; if you exercise the removal choice, we delete it with the rest of your child's identifying information.
16. SUBSCRIPTIONS AND DIAGNOSTICS
Carelio Premium is a family subscription bought through the Apple App Store. Apple handles the payment; we never see your card. RevenueCat, the subscription service we use, receives your purchase status and an anonymous app user id so the app knows what your family has bought. Care professionals never pay and never see billing. If the app crashes or an error occurs, a diagnostic report (device model, operating system version, app version, and the error) goes to Sentry, our error monitoring service. It never includes care records or photos.
17. DELETING YOUR ACCOUNT
You can delete your account in the app (Account, then Delete account) or by emailing founder@emberlineapps.com from the address on your account; we verify the request by replying to that address. When you delete your account we delete your sign-in identity and anonymize your profile right away, you leave every family you belong to, and any report links you shared stop working. We also keep the limited suppression record described in section 2. Your name on care entries you wrote becomes "Removed member"; the entries themselves stay with the family's record, because they are the family's record of the child's care and the care professional's record of the work they did. Photos stay with the family's record. A parent who is the only admin of a family with other members hands off the admin role or removes the members first. To have a whole family's records deleted, the family admin emails us from the account address. This process is also described at https://carelio.io/delete-account.
18. PRODUCT ANALYTICS AND SESSION REPLAY
We use PostHog (PostHog, Inc., United States) to understand how the app and our website are used and to find problems. In the app this records which screens are opened and which actions are taken, tied to your account identifier, along with the app version, device type and operating system. Session replay captures the layout and timing of a session with all text, all typed input and all images masked before anything leaves your device, so a child's name, a note, a caption or a photo is never recorded. On our website it records page visits, clicks and masked session replays on the marketing pages only; the shared report page and the invitation pages never load it. PostHog does not build advertising profiles and we do not use it to track you across other apps or sites. You can ask us to delete this data by writing to founder@emberlineapps.com.
19. COOKIES ON OUR WEBSITE
carelio.io uses a small number of cookies and local-storage entries set by PostHog to recognise a returning browser and to measure page visits, clicks and masked session replays on our marketing pages. These are first-party analytics cookies. On our public pages, except pages with a sign-up form and pages that show a shared report, the OpenAI advertising measurement pixel sets two first-party cookies: __oppref, which holds a click reference for up to 30 days when you arrive from one of our advertisements in ChatGPT, and __obref, a random browser reference kept for up to 365 days. They let us learn which advertisements lead to a visit and to the App Store or Google Play. They are not used to show you advertisements, and we do not sell personal information or share it for cross-context behavioural advertising. The shared report page, the invitation page and the handoff pages set no analytics or advertising cookies. You can block cookies in your browser; the site still works.
20. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Revised" date at the top of this Privacy Notice. If we make material changes to this Privacy Notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.
Emberline Studio LLC
Data Protection Officer
1939 Fairmount Ave
#56024
Philadelphia, PA 19130
United States
If you have any further questions or comments, you may also contact us by post at the following corporate address:
Emberline Studio LLC
1939 Fairmount Ave
#56024
Philadelphia, PA 19130
United States
22. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit: mailto:founder@emberlineapps.com.