1.1 Controller
Controller means the entity that determines the purposes and means of Processing Personal Data. For Product usage, Customer typically acts as Controller; CareJot may act as Controller for certain data (e.g., website analytics).
1.2 Processor
Processor means the entity that processes Personal Data on behalf of a Controller. CareJot is Processor when Processing Customer Data under an Order Form.
1.3 Personal Data
Personal Data means any information relating to an identified or identifiable natural person as defined under applicable law (including CCPA and GDPR).
1.4 Customer Data
Customer Data means all data, content, and information that a Customer submits to the Product.
1.5 Sub-Processor
Sub-Processor means any third party engaged by CareJot to Process Customer Data solely on behalf of CareJot.
1.6 EU Customer
EU Customer means a Customer whose principal place of business or residence is within the European Economic Area.
1.7 CCPA
CCPA means the California Consumer Privacy Act.
1.8 GDPR
GDPR means the General Data Protection Regulation (EU) 2016/679.
1.9 Third-Party Products and Services
Third-Party Products and Services means any products or services (other than the Product) that are marketed, licensed, or sold by third parties and made available through, or invoiced by, CareJot acting as an agent. Such Third-Party Products and Services are governed by separate terms and privacy policies of the respective third parties.
2. INFORMATION WE COLLECT
2.1 Product Usage Data.
We collect data entered by Customers into the Product (Customer Data), including names, contact details, health-related data, and operational metrics.
2.2 Account and Billing Information.
We collect Customer name, billing address, payment method details, and transaction records.
2.3 Website and Support Data.
We collect data when you visit our website or contact support, such as IP address, device information, cookies, and support request details.
3. HOW WE USE YOUR INFORMATION
3.1 Provide and Improve the Product.
Process Customer Data to deliver, maintain, and enhance the Product and its features, including de-identified use for AI/ML training in accordance with HIPAA Safe Harbor and CCPA de-identification standards.
3.2 Billing and Administration.
Use account and billing information to process payments, send invoices, and manage subscriptions.
3.3 Compliance and Security.
Use data to comply with legal obligations, respond to lawful requests, and protect against fraud or misuse.
3.4 Marketing Communications.
We have a legitimate interest in informing you about Product usage, updates, and related offerings, including marketing communications and promotions from CareJot and its Affiliates. Such communications will be sent unless you choose to opt out. You may opt out at any time by using the unsubscribe link in our emails or by contacting support@caryfy.ai.
4. DATA SHARING AND DISCLOSURE
4.1 Sub-Processors.
We engage Sub-Processors to host data, provide AI services, and support operations. US Customers may request a list of Sub-Processors; EU Customers see the published list at [EU Sub-Processor List URL]. EU Customers will be provided with at least 30 days' prior notice of any new Sub-Processors. EU Customers may object to new Sub-Processors by notifying CareJot within this 30-day period. CareJot will cooperate reasonably to address objections, including potential alternative arrangements.
4.2 Third-Party Products and Services.
When CareJot invoices or integrates third-party offerings, those providers' own terms and privacy policies apply.
4.3 Legal Requirements.
We may disclose Personal Data to comply with legal obligations or respond to lawful requests by public authorities.
4.4 Business Transfers.
In connection with a merger, acquisition, or sale, Customer Data may be transferred, subject to confidentiality obligations.
5.1 Customer Data.
We retain Customer Data for the duration of your subscription plus any export window per Section 3.4 of the Terms of Use (30 days for US Customers, 45 days for EU Customers). After such a period, we may delete or anonymize residual data, except as required by law.
5.2 Website Data.
We retain websites and support data for up to three years for analytics and service improvements.
6.1 CCPA Rights (US Customers).
California residents may request to know, delete, and opt out of sale of their Personal Data. To exercise, contact support@caryfy.ai.
6.2 GDPR Rights (EU Customers).
EU Customers have the right to access, rectify, erase, restrict, or object to Processing, and data portability. Submit requests via support@caryfy.ai.
6.3 Withdrawal of Consent.
Where Processing is based on consent, you may withdraw consent at any time; this does not affect processing prior to withdrawal.
8. INTERNATIONAL TRANSFERS
Customer Data may be stored and processed in the United States or other jurisdictions where CareJot or its Sub-Processors operate. For EU Customers, CareJot implements appropriate safeguards for cross-border transfers under GDPR, including the EU Standard Contractual Clauses (SCCs), binding corporate rules, or other approved mechanisms. Details of these safeguards are available at [Data Transfer Safeguards URL].