Privacy Policy

1. Roles and scope

For account, security, billing and website administration information, CareIL acts as the party responsible for determining the purposes of processing.

For client records entered by a therapist, the therapist or clinic controls the information and CareIL processes it only to provide the service. Therapists are responsible for a lawful basis, clinical confidentiality and notices or consents required from clients and guardians.

CareIL is intended for professional therapists. It is not directed to children for independent registration.

2. Information we process

Account information may include name, email, phone, clinic details, language, authentication records, legal-document acceptances and support communications.

Clinic information may include client identity and contact information, appointments, availability, session summaries, messages, uploaded files and portal invitations. This may constitute health information or information of special sensitivity.

Technical information may include IP address, browser and device information, request logs, security events and essential session-cookie data. Google Calendar information is processed only when a therapist chooses to connect Google.

3. Purposes and legal grounds

We process information to provide and secure CareIL, authenticate users, synchronize requested integrations, deliver transactional messages, support users, maintain audit records, comply with law and improve reliability.

We do not sell client records or use therapy content for advertising. Marketing messages require a separate optional choice and can be stopped at any time.

4. Google user data

CareIL requests permission to create, update and delete events managed by CareIL in the connected Google Calendar. Access is limited to the functionality requested by the therapist.

Google refresh tokens are encrypted and stored in the therapist's tenant database. CareIL does not use Google user data for advertising, credit decisions or unrelated analytics, and does not transfer it except as necessary to provide or secure the requested integration, comply with law, or with the user's explicit direction.

CareIL's use of information received from Google APIs is subject to the Google API Services User Data Policy, including Limited Use requirements.

5. Service providers and transfers

CareIL may use Railway for application hosting and storage, Resend for transactional email, and Google for optional Calendar integration. The current list appears on the Subprocessors page.

Providers may process information outside Israel. CareIL uses contractual and technical measures intended to protect transferred information as required by applicable law.

6. Security and retention

CareIL uses HTTPS, password hashing, tenant-separated databases, access controls, encrypted Google refresh tokens and expiring portal invitations. No system can guarantee absolute security.

Information is retained while the account is active and as necessary for security, dispute resolution and legal obligations. Account deletion suspends the workspace immediately and allows restoration for 24 hours. After the recovery period, active tenant data and tenant uploads are scheduled for permanent removal. Limited provider or security records may remain only for legitimate legal, fraud-prevention or technical retention periods.

7. Rights and choices

Users may request access, correction, export or deletion of their account information and may disconnect Google Calendar. Client requests concerning clinical records should normally be directed to the responsible therapist, who may ask CareIL for assistance.

Privacy requests can be sent to the privacy contact shown below. Identity verification may be required. Rights may be limited where retention is required by law or necessary to protect others.

8. Changes and contact

Material changes will be identified by a new policy version and, where required, users will be asked to accept them. Mandatory rights under applicable law are not limited by this policy.

Google API policy

CareIL's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.