1. Who we are and how to contact us
This Privacy Policy applies to Kelo Care (Kelo, we, us, or our), including the Kelo mobile application, agency web dashboard, and related services. Kelo determines how personal information is handled for the service, except where an agency customer controls care records entered for its clients. Contact us about privacy, data rights, or complaints at hello@kelo-care.com.
2. Information we collect
Account and profile information includes your name, email address, account role, authentication identifiers, policy acceptances, preferences, agency relationships, and optional profile photo. Care information may include a care recipient's name, care plan, medications, routines, visit schedule and history, task records, handoff notes, incident information, emergency contacts, feedback, assignments, reports, and reminders. Subscription information includes plan, product, store platform, entitlement status, renewal status, and expiration date; Kelo does not receive your complete payment-card number. Technical information includes device platform, push-notification token, local notification identifiers, session and security records, and limited service logs needed to operate and protect Kelo. We also receive information you send to support.
3. Information you provide about other people
Caregivers and agency administrators may enter information about clients, family members, staff, and emergency contacts. You must have authority or another lawful basis to provide that information and invite others to access it. Agency customers are responsible for deciding which records their personnel may enter and for meeting any professional, employment, health-record, notice, and consent duties that apply to them.
4. How and why we use information
We use information to create and authenticate accounts; provide role-based access; coordinate visits, medication schedules, routines, tasks, reminders, handoffs, incidents, feedback, and reports; send invitations, service emails, and notifications; manage subscriptions; provide support; maintain reliability; detect misuse; enforce our Terms; and comply with law. Depending on the context, we process information to perform our contract with you, follow your instructions, support legitimate interests in operating and securing Kelo, meet legal duties, or act with consent where required. We do not sell personal information, share it for cross-context behavioral advertising, or use care information for targeted advertising.
5. Storage, access, and security
Kelo uses Supabase for authentication, database, file storage, real-time updates, and server functions. Access is limited by account role, agency membership, client assignment, and family permissions. Session credentials and selected sensitive local information use device secure storage. Optional device lock uses Apple or Android biometric authentication; Kelo receives only the device's success or failure result and does not receive your face or fingerprint template. We use encrypted network connections and administrative, technical, and organizational safeguards appropriate to the service. No system can guarantee absolute security.
6. Service providers and disclosures
We disclose only the information needed for these providers to perform services for Kelo: Supabase processes account, care, file, and service data; Expo processes device push tokens and the notification title, body, and routing data needed to deliver enabled phone alerts; RevenueCat processes Kelo account identifiers and purchase and entitlement information; Apple App Store and Google Play process purchases and store-account information; and Resend processes recipient email addresses and transactional invitation or report-email content. A report email contains a secure link and does not include the care report itself. Apple or Google may also process sign-in information if you choose their sign-in option. These providers process information under their own terms and privacy commitments.
7. Notifications, photos, and device permissions
With permission, Kelo schedules reminders on your device and registers an Expo push token for selected service alerts. Notification content can appear on a lock screen according to your device and Kelo preferences, so avoid placing unnecessary sensitive details in notification-visible text. You may disable alerts in Kelo or device settings. If you choose a profile photo, Kelo may access the camera or the photo you select and store the resulting image in a private Supabase storage area. Kelo does not access your contacts, microphone, precise location, or health-app data in the current version.
8. Report drafting
Caregivers and agency leaders can write a family report using care-team notes as a starting point. This editing happens in the app and does not send notes to a generative AI provider. The person sharing the report must review and approve its contents first. Kelo does not use care records to train advertising or profiling models. We will update this policy and provide any required notice before materially changing this processing.
9. Retention
We keep account and active care information while it is needed to provide Kelo and do not apply a shorter automatic expiration period to active care records. Invitation codes expire after seven days. Device push tokens are removed when the app registers sign-out or offboarding and when the associated profile is deleted. Subscription, security, delivery, transaction, and audit records may remain as needed to prevent fraud, document consent and service activity, resolve disputes, satisfy an agency's recordkeeping obligations, or comply with law. Service-provider backups and logs may persist for their standard backup or security cycles before being overwritten. When information is no longer required, we delete it or de-identify it.
10. Account deletion
All account roles can open Profile > Delete account. Caregivers can review the effect and confirm deletion of their login, profile, photo, device tokens, personal clients, and personal-client care records. If a caregiver worked for an agency, its operational records remain with the caregiver identity replaced by Former caregiver; upcoming assigned visits return for coverage. Client/family users can delete their login, profile, photo, device tokens, and access to shared client records; the caregiver or agency retains those care records. Team leaders can submit an in-app deletion request because agency ownership and shared records require review first. Their account remains active until the request is handled. We may retain information that law requires us or an agency customer to keep, and will explain applicable exceptions.
11. Your privacy rights and choices
Depending on where you live, you may request access to, correction of, deletion of, or a portable copy of your personal information, or ask us to restrict or stop certain processing. You may withdraw consent where consent is the basis for processing and may complain to an applicable privacy regulator. To make a request, email hello@kelo-care.com. We may verify your identity and authority, and lawful exceptions may apply. You can change notification and report-email preferences inside Kelo and manage store subscriptions through Apple or Google.
12. Children and vulnerable people
You must be at least 18 years old to create a Kelo account. Kelo is designed primarily to coordinate care for adults, including older and vulnerable adults. Do not enter information about a minor unless you are the minor's parent or legal guardian, or you otherwise have documented legal authority and all required consents. Contact us if you believe a child created an account or personal information was provided without appropriate authority.
13. International processing
Kelo and its providers may process information in the United States and other countries where they operate. Those countries may have different privacy laws. Where required, we use appropriate safeguards for cross-border transfers.
14. Medical, health, and agency responsibilities
Kelo is an administrative care-coordination tool that assists authorized caregivers and medical professionals with organizing their work. Kelo does not provide medical advice, diagnosis, treatment recommendations, clinical supervision, or instructions for performing a medical procedure. It is not an emergency service, health-care provider, medical device, or substitute for a qualified professional's independent judgment. Health-care professionals, caregivers, agencies, and other authorized users remain responsible for every clinical decision, treatment, medication action, and medical procedure. Agency customers remain responsible for determining whether their use is subject to HIPAA or another health-record law. Unless Kelo has signed a separate Business Associate Agreement or equivalent agreement with an organization, that organization must not use Kelo in a way that legally requires Kelo to act as its business associate or regulated health-data processor.
15. Changes and contact
We may update this Privacy Policy as Kelo or legal requirements change. We will update the version and date and provide additional notice or request renewed acceptance when required. Questions, requests, and complaints may be sent to hello@kelo-care.com.