Privacy Policy

Introduction

Carelog ApS (CVR: 45350916), Ragnagade 7, 2100 Copenhagen, Denmark ('Carelog', 'we', 'us') develops an AI-assisted documentation platform for healthcare professionals. For your account information - name, email, organisation and subscription - Carelog is the data controller. For the professional content you create in the app (recordings, transcripts and notes, which may contain information about your clients or patients), you or your organisation are the data controller, and Carelog only processes this data as a data processor acting on instructions - and only to the extent it leaves your device at all. We enter into a data processing agreement under GDPR Article 28 with business customers.

How Carelog is designed for data protection

What Data We Process

We process the following categories of data: (1) Account information - name, email, organisation, language and subscription status, which are necessary to provide the service. (2) Content data - audio streamed for transcription, and the transcripts and notes you create; these may contain health information about your clients and are processed solely on your instructions. (3) Payment information - handled by our payment provider; we do not store card details ourselves. (4) Technical data - error reports and logs via our error monitoring (EU data centre) with personal data minimised, and cookies on the website as described in our cookie policy. (5) Integration data - if your organisation enables an integration with your record system, notes and lookups are transferred there at your choice.

Data security

All connections are encrypted with TLS. Local data is encrypted as described above, and data in our database is encrypted at rest by our hosting provider. Access to data in the database is restricted with row-level security (RLS), so users can only access their own or their organisation's data. API keys and integration secrets are stored encrypted server-side and are never handed to the client. All API endpoints are protected with access control and rate limiting.

Data Processing and Legal Basis

For account information and delivery of the service, the legal basis is performance of our contract with you (GDPR Art. 6(1)(b)). Error monitoring and security rely on our legitimate interest in operating a secure and stable service (Art. 6(1)(f)). Payment and accounting data are retained to comply with legal obligations (Art. 6(1)(c)). Statistics cookies are used only with your consent (Art. 6(1)(a)). Client and patient data in your notes are processed by us solely as a data processor on behalf of you or your organisation - responsibility for the legal basis under Art. 6 and Art. 9, e.g. processing in the course of healthcare, rests with you as the data controller healthcare professional.

Your Rights Under GDPR

Under the GDPR you have the following rights towards us as data controller for your account information. You can exercise them by contacting us at kontakt@carelog.dk. You also always have the right to lodge a complaint with the Danish Data Protection Agency, Datatilsynet (www.datatilsynet.dk):

• Right of access to the data we process about you
• Right to rectification of inaccurate data
• Right to erasure ('right to be forgotten')
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent where processing is based on consent

Complaints and objections

If you want to complain about our processing of your personal data or our IT security, or object to the processing, write to kontakt@carelog.dk. We confirm receipt within 2 business days and answer complaints within 10 working days. If you are not satisfied with our reply, you may complain to the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk. See our complaints procedure

International Transfers

Our primary processing takes place within the EU/EEA: transcription with Speechmatics and error monitoring take place in the EU, and our database (Supabase) and AI processing (Microsoft Azure) are configured for European data centres. A few providers - including those for hosting, payments, transactional email and the booking calendar on the contact page - are US companies; transfers to them are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses (SCCs).

Data Security and Breaches

We protect data with encryption in transit and at rest, access control, rate limiting and automatic deletion. In the event of a personal data breach, we notify the Danish Data Protection Agency without undue delay and within 72 hours where required, and we inform affected users and controller organisations if the breach poses a risk to their rights.

Third-Party Services

We use the following providers and data processors for Carelog's core clinical features: Supabase (database and login), Speechmatics (speech-to-text, EU region) and Microsoft Azure (AI-generated note drafts and chat). We also use data processors for website and web app hosting, the API gateway (content is not stored permanently), payments, transactional email, error monitoring (EU), the booking calendar on the contact page (only loaded when you click) and - only with your consent on the website - statistics (EU-hosted). If your organisation enables an integration with your record system, data is transferred there on your instructions. Data processing agreements are in place with our providers; the full list of sub-processors is part of our data processing agreement and is available on request. We never share your data with third parties for their own commercial purposes.

Storage and Deletion

Notes and transcripts are deleted automatically after the retention period you have chosen (default 5 days, at most 1 year) and can always be deleted manually. Account information is kept for as long as you have an account and is deleted when the account is closed. Payment and accounting data are kept for 5 years after the end of the financial year as required by the Danish Bookkeeping Act. Please note: your statutory record-keeping (typically 5-10 years of retention) must take place in your own record system - Carelog is not intended for long-term storage of records.

Changes to This Policy

We will inform you of significant changes to the privacy policy with 30 days' notice via email and the application. Minor changes are published here on the website. You can contact us at any time with questions about data processing.