Privacy policy
What this local edition processes, where it goes, and the choices you have.
1. Who operates this edition
Carefolio is currently a local early-access application. The legal operator name and privacy contact are configuration items that must be completed before a public launch.
Operator: Pending before public launch
Privacy contact: support@mykinrecord.com
This policy describes the implemented local edition. Hosting providers, launch regions, production backups, subprocessors, and any future external AI service must be identified and reviewed before those services are used.
2. Information you choose to provide
We process your account name, email address, protected password credentials, session information, and the health-profile information you enter. Health data may include records, uploaded documents and images, extracted text, your corrections, medication schedules, appointment details, personal notes, and action history.
Family access also uses invited email addresses, roles, invitation tokens, and acceptance status. Provide another person’s information only when you have their permission or another valid authority to manage it.
3. How the information is used
Information is used to authenticate your account, organize records, extract text, show sources for review, save your corrections, maintain plans and appointment briefs, and enforce the sharing permissions you choose. It is also used to provide account export and deletion.
This edition has no advertising or behavioral analytics integrations. It does not include a model-training pipeline, data-sale integration, or external AI service in its default record-processing flow.
4. Document recognition and optional AI
PDFs, images, text and supported DOCX documents first use extraction or OCR on this server. Local extraction is the default. If an OpenAI-compatible model is configured, each upload may separately opt in to AI structuring. The consent screen names the provider and model. Only extracted text and its page numbers are sent, not the original file. That text can contain names, dates of birth and health information. The provider processes the text under its own terms and retention practices; this application does not promise that providers retain nothing or never train on data.
Extracted information can be incomplete or wrong. Review dates, names, results, medication details, and schedules against the original. A language switch changes interface text and does not automatically translate clinical documents.
5. Storage and protection
Records and original files are stored on the server used to run this edition. Health-state records and uploaded files use AES-256-GCM encryption with a server-side key. Account names, emails, and access metadata are stored in the server database without that health-data encryption. Passwords are hashed with scrypt. Server-side access checks restrict profiles to authorized accounts.
Encryption at rest is not end-to-end encryption: the running server can decrypt data to provide the service, and the local key is kept in the private server data directory. Protect the server and key; a compromised host can expose data. Temporary plaintext files used for OCR are removed after the job. Local HTTP use does not provide HTTPS transport protection. No system can guarantee absolute security.
6. Sharing with family
Profile administrators can grant viewers or collaborators access to a selected health profile. Invitation links are shared by you; this edition does not send invitation emails. An invitation is not access until the intended account accepts it. You can review or revoke access in the application.
Account email addresses are self-provided and are not email-verified in this edition. Share the secret, single-use invitation link through a trusted channel and check the recipient. An account must match the invited email to accept. People with access may read or download permitted information; exported files and printed briefs are outside the application’s access controls.
7. Retention, export, and deletion
Account data is retained while your account exists, unless you delete a file, record, or profile earlier. You can export your owned data, delete individual source files, and delete your account in Settings. Removing a source file removes the stored original; a retained record or text must be deleted separately if you also want that content removed.
Account deletion revokes your sessions and removes your account and owned profiles with their records and source files. It removes your access to profiles owned by others without deleting their information. This local edition has no managed production backup service; production retention and backup deletion periods must be configured before launch.
8. Cookies and browser storage
An essential session cookie keeps you signed in. The browser also stores interface preferences such as language. Account-specific preferences must not be used as a substitute for server authentication. We do not set advertising or cross-site tracking cookies in this edition.
If you allow browser notifications, your device stores that permission. You can revoke it in your browser settings. Alerts require the site to remain open and are not guaranteed while offline or in the background.
9. Your choices and requests
You can correct records, control family access, export data, and delete your account. Depending on your location, applicable law may provide additional access, correction, deletion, portability, restriction, or complaint rights. The production operator must provide a working contact and a process for handling those requests before launch.
10. Adults and dependent profiles
Account holders must be adults. A dependent’s profile may be added only by a person with valid authority and permission to handle the information. This edition is not designed for children to register their own accounts.
11. Changes to this policy
Material changes to data use, processing locations, or external providers require an updated policy and an appropriate notice before taking effect. This draft is dated October 4, 2026. Review it again before a public production launch.