Who this policy covers
This policy explains how CareFlick Inc. (CareFlick, we, us) handles information in Nova care platform (Nova Application), including its care-management tools and Yana features. It covers authorised staff, administrators, care recipients, relatives, representatives and other people whose information an operator records. Features vary by subscription and deployment.
Nova supports senior living, assisted living, memory care, nursing homes and home-care operations. This policy covers the same CareFlick-provided platform across Nova Application. Visiting these legal pages is also covered by our website privacy notice. The separate CareFlick consumer companion is not covered by this policy.
Who controls your information
The care provider or organisation using the service (the operator) normally determines why care, staff and operational records are processed. CareFlick processes those records on the operator’s instructions. The operator supplies its own privacy notice and is the first contact for questions about care records or employment information.
CareFlick is responsible as controller for information it uses for its own business relationship with customers, enquiries, contract administration, billing and legal obligations. Our address is 228 Park Ave S, New York, NY, United States. Privacy enquiries and requests can be sent to hello@careflick.com. A service agreement does not override your statutory rights or make this notice a consent to every use of your data.
Purposes and legal bases
We process operator records to deliver care workflows, manage authorised access, produce reports, support communications and AI features, troubleshoot problems and protect the service. The operator is responsible for identifying its lawful basis and any additional condition required for health or other sensitive information, including appropriate authority when a relative or representative provides information.
Where UK or EU law applies to our controller activities, we rely on legitimate interests in maintaining customer relationships, providing support, administering business accounts and preventing misuse; a contract where the individual is a party to it; and legal obligations for required financial and legal records. Where a feature requires consent, that consent is requested separately. Signing in does not provide blanket consent for health-data processing, marketing or recording other people.
Information we process and its sources
Information comes from users, the operator, care recipients, relatives or representatives, referring professionals, connected services and use of the platform. Depending on the enabled tools, it includes:
- Care recipient identity, contact and address details, demographic information, family and emergency contacts, care needs, conditions, assessments and care plans.
- Medication records, allergies, observations, nursing notes, care charts, body charts and photographs, incidents, handovers, activities, appointments and uploaded documents.
- Staff identity, work contact details, role, organisation, assigned care locations, schedules, tasks and records of activity in the service.
- Messages, feedback, support correspondence, SOPs and training resources, AI prompts and responses, voice transcripts and generated drafts.
- Invoices and transaction references where billing is used; sign-in and session information, IP addresses, device/browser information, timestamps and diagnostic records.
Required account information is needed to authenticate you and provide your assigned services. Optional microphone, location or integration permissions may be declined or revoked, although the related feature may then be unavailable.
Home-care locations and device permissions
Home-care records may include a care recipient’s home address and service locations. In B2B Home, the Yana session flow can request your device’s precise location and send latitude, longitude and time zone with the session to provide location context. This is separate from an approximate location inferred from a network request.
Your browser controls location and microphone permissions. You can change them in browser or device settings. Declining location can prevent the location-dependent Yana session from starting. Revoking permission stops future access through that permission; it does not automatically erase information already recorded.
CRM, enquiries and connected email
CRM tools hold prospective care recipient and family enquiries, referral details, pipeline activity, notes, documents and communications. Public enquiry forms collect information for the operator identified on the form; that operator’s privacy notice explains its follow-up.
Where the Gmail integration is enabled and an authorised administrator connects a mailbox, Nova uses the granted permissions to connect and synchronise mailbox messages and support email replies. This can involve sender and recipient details, message content, attachments and authorisation tokens. Imported mail may be available to other authorised users in the organisation; connecting a personal mailbox can therefore expose personal correspondence to the organisation.
Disconnect the mailbox in the product and revoke access in your Google account to stop future access. Disconnecting does not itself erase messages already imported into operator records; those follow the operator’s retention and deletion instructions. Google also processes information under its own privacy policy.
Voice transcription
When you use a supported voice feature and permit microphone access, audio is transmitted to a speech provider for transcription. Deepgram is used for supported dictation workflows. Transcripts may be passed to AI tools to prepare a draft or populate a form and become part of the care record when saved. Audio may contain health information and other voices within range.
Activate the microphone only in an appropriate setting and stop it when finished. Review names, medication details, numbers and clinical content before saving. Stopping a recording does not delete a saved transcript. Audio processing and provider retention depend on the speech service and account configuration; do not assume audio is never retained. Ask your operator or hello@careflick.com about the arrangements for your deployment.
Yana and other AI features
AI features process the questions, documents and relevant operational or care information supplied to them to produce answers, summaries, extracted fields or suggested text. The material can include sensitive information. Prompts, responses, attachments and related execution records may be retained to support conversation history, troubleshooting and the operator’s workflows.
Yana and voice-assisted workflows use external AI services according to the deployment; Nova’s generative workflows include Google Gemini services. Provider processing locations, retention and data-use settings depend on the service and contractual configuration. Contact us for the providers and terms applicable to your deployment. This notice does not promise zero provider retention or a universal model-training exclusion.
AI outputs can be inaccurate or incomplete. They support human review and must not be used as the sole basis for clinical, employment, admission or other decisions with significant effects. Ask the operator how it uses any scores, suggestions or automated workflows in its decisions.
Billing and payments
Where billing tools are enabled, we process the information needed to associate invoices, amounts, statuses and transaction references with a customer or care recipient. Payment services may be provided by Stripe. Stripe-hosted payment and onboarding interfaces collect payment credentials, business verification and bank information directly; Nova can receive related identifiers and payment or account status.
The operator controls its charges and invoicing. Stripe’s handling of information for its own payment, fraud-prevention and regulatory purposes is described in its privacy policy. Avoid putting clinical details into payment descriptions.
App analytics
The apps use Vercel Web Analytics for page views and product-use events, such as opening the app or using a workflow. Events can include associated properties. Selected organisation configurations also load Google Analytics, which can set browser identifiers and record page usage, referring pages, device information and approximate location.
These integrations are separate from analytics on the public Nova website. Changing cookie settings on this website does not change the apps’ analytics configuration. Contact your operator or CareFlick about the configuration and available choices for your organisation. Analytics providers receive the information sent by the configured integration; sensitive information must be excluded from analytics URLs and event properties.
International processing
CareFlick is based in the United States. Hosting, support, speech, AI and connected services can involve processing outside your country. A primary database location alone does not describe every processing location. Ask us for the hosting and provider locations applicable to your operator.
Where UK or EU transfer restrictions apply, transfers must use an applicable adequacy decision or appropriate safeguards, such as EU standard contractual clauses with the relevant UK addendum or international data transfer agreement. You can request details and a copy of the applicable safeguards from hello@careflick.com.
Security and incident response
Access permissions, authentication and operational security controls help protect information. Operators must configure access appropriately, remove access when roles change, protect devices and review the people and services to which they disclose records. No service or transmission can be guaranteed completely secure.
Report suspected unauthorised access promptly to your operator and hello@careflick.com. Where we act as processor, we notify the operator of a personal-data breach without undue delay after becoming aware of it and assist with the information needed for its response. Applicable law and the processing agreement determine further notification duties.
How long information is kept
Retention depends on the record’s purpose, the operator’s instructions, the service agreement and applicable legal requirements:
- Care records and their history: the operator’s clinical, safeguarding and statutory recordkeeping requirements, including after discharge or staff departure.
- Enquiries, correspondence and uploaded documents: the active relationship, purpose of the communication and any applicable dispute or recordkeeping requirement.
- AI conversations, transcripts and generated drafts: their use in an ongoing conversation or saved record and the configured provider and platform retention arrangements.
- Account, billing and diagnostic records: administration, security investigations, tax obligations and the establishment or defence of legal claims.
Removing a user or disconnecting a service does not necessarily delete underlying records. At contract end, return/export and deletion follow the processing agreement and legal retention requirements. Backup copies follow the applicable backup lifecycle rather than disappearing immediately. Contact us for your operator’s export window, deletion procedure and backup schedule.
Your rights and representatives
Depending on applicable law, you may request access, correction, deletion, restriction or a portable copy of information. You may object to processing based on legitimate interests, and to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Rights can be limited by duties to retain care records, protect others’ information or meet legal obligations.
For operator records, contact your care provider or employer first. If you contact CareFlick, we will help identify the appropriate operator and assist it with your request. For CareFlick’s own processing, contact hello@careflick.com. We may verify identity and a representative’s authority before disclosing information. We respond within the deadlines required by applicable law.
You can complain to your local data protection authority, including the UK ICO or the authority in the EU country where you live, work or believe an infringement occurred. Contacting us first is not a condition of that right.
Children and people who need support
The service is an organisational care tool, not a service for children to register independently. Where an operator legitimately records information about a child or an adult needing support with decisions, it must establish the appropriate legal authority and provide accessible information to the person or authorised representative. A family relationship alone does not grant unrestricted access to care records.
Changes and contact
We update the date on this policy when it changes and communicate material changes through appropriate service or operator communications where required. New uses requiring a separate legal basis or consent are not authorised simply by changing this page. Contact CareFlick Inc., 228 Park Ave S, New York, NY, United States, at hello@careflick.com. Read the Nova care platform terms for conditions of use.