Care OS

Privacy Notice

Last updated: July 17, 2026

This Privacy Notice explains how Oscar Yanez ("we", "us", or "our"), operating the Care OS service (the "Service"), collects, uses, and shares personal data. This page is maintained by us and describes the practices we currently follow; please review it periodically as it may be updated.

Who we are

The controller of personal data processed through Care OS is Oscar Yanez, operator of Care OS (rcfeos.com). You can reach us via the in-app support channel.

Data we collect

  • Account data: name, email address, and login credentials.
  • Facility and staff data: facility profile, roles, and staff records you enter about the people you work with.
  • Operational content: resident records, incident reports, documents, medications, calendar entries, tasks, notes, and similar content you create in the Service.
  • Support communications: messages you send us for help.
  • Usage and device data: log data, IP address, browser and device identifiers, timestamps, and pages visited.
  • Cookies: strictly necessary cookies used to keep you signed in and to run the Service.

Payment-related data (card details, billing address) is collected by our payment processor Paddle, not by us. See "Sharing" below.

Purposes and legal bases

  • Provide the Service (contract): create your account, host your facility content, generate AI outputs you request, deliver features you use.
  • Security and fraud prevention (legitimate interests): protect the Service, investigate abuse, protect users.
  • Improve the Service (legitimate interests): understand which features are used, debug errors, prioritize improvements.
  • Customer support (contract / legitimate interests): respond to your questions.
  • Legal obligations (legal obligation): tax, accounting, responding to lawful requests.
  • Marketing communications (consent, where required): only when you have opted in; you can opt out at any time.

Sharing

We share personal data only with:

  • Merchant of Record (Paddle): Paddle handles checkout, subscription management, payments, tax compliance, invoicing, and refunds. Paddle acts as an independent controller for that data. See Paddle's privacy policy.
  • Infrastructure providers (subprocessors): hosting, database, email delivery, analytics, error monitoring, and AI model providers used to power features.
  • Professional advisors: our lawyers, accountants, and auditors when reasonably necessary.
  • Authorities: when required by law or to protect rights, safety, or property.

We do not sell your personal data.

International transfers

Our infrastructure and subprocessors may store or process data in the United States and other countries. Where personal data is transferred out of the UK/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

Retention

We retain account and operational data for as long as your account is active and for a reasonable period afterwards to meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. When no longer needed, we delete or anonymize the data. You can request deletion at any time (see "Your rights").

Security

We use appropriate technical and organizational measures to protect personal data, including encryption in transit, encrypted storage, access controls, and least-privilege access to production systems. No system is perfectly secure; you should protect your credentials and notify us of any suspected compromise.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict processing of your personal data, or to object to processing and withdraw consent. Residents of the UK and EEA may lodge a complaint with their local supervisory authority. We aim to respond to verified requests within one month. To exercise these rights, contact us via the in-app support channel.

Cookies

Care OS uses strictly necessary cookies to keep you signed in and to remember basic preferences. If we add analytics or marketing cookies in the future, we will present a cookie notice with the ability to accept or decline non-essential cookies.

Children

The Service is intended for professional users at care facilities and is not directed to children under 16. We do not knowingly collect personal data from children.

Changes

We may update this Privacy Notice from time to time. When we make material changes we will update the "Last updated" date and, where appropriate, notify you in-app or by email.