Privacy notice

Seller and privacy contact

Baraka Fadi · Baraka Fadi – iCareIntel.com

Odenvägen 4A, 763 41 Hallstavik, Sweden

Support@icareintel.se · VAT SE750809047401 · Telephone: +46850431340

Information and purposes

We handle account email, password authentication data, language, package/activation and membership records; profile identity, health information, medicines, laboratory information, emergency contacts and documents that you provide; and the permissions and consent records needed to operate your selected features. We use these to provide account access, your emergency profile, document reading, private/public AI, support and purchase administration. Do not upload another person’s information without authority.

Consent and legal grounds

Account and paid-service administration is necessary to perform the service contract; financial recordkeeping follows legal obligations. Security, fraud prevention and dispute handling serve legitimate interests, subject to your rights. Health information requires an applicable special-category ground, normally your explicit consent for the selected health-data features. Sharing/publication choices and AI/document permissions remain distinct from purchase acceptance. You may withdraw consent for future processing and change sharing choices; this does not make earlier lawful processing unlawful or require deletion of records we must retain.

Shared emergency record and bearer-link access

In the guided shared-record mode, unfinished uploads and completed readings are not public merely because they exist. When you review a document and choose “Add to my emergency record”, you confirm sharing both the document and the medical profile displayed on that review screen. You can also choose “Confirm current medical profile for the shared record” separately, without adding a document. If you previously withdrew profile sharing, a fresh Add confirmation that includes the displayed profile shares it again. Uploading, saving a draft or reopening a saved result does not restore sharing. Anyone possessing its emergency link can open the entire committed original, including unread pages. The intended audience is medical personnel; the service does not verify that profession. Both assistants use the same eligible allowlisted medical collection and coverage, with separate conversations, authorization and funding. Withdrawal stops future system access, not copies already received or provider requests already sent.

Billing and automatic VAT decisions

For app billing and VAT, we retain your billing declaration and an independent IP-country estimate, including the request IP, database source, build date, checksum and observation time. The lookup uses a local Country database; your IP is not sent to MaxMind for this lookup. Country estimates and address formatting do not independently verify residence or identify a household. Deterministic Swedish-consumer rules record a system decision and policy version. Conflicting, missing or unsupported evidence needs individual exception review. Access is restricted and financial-record retention applies. This tax-only lookup does not change emergency location sharing.

AI processing and recovery content

Confirmed readings send selected pages/images to OpenAI using the existing processing lifecycle. Upload, quote, review, final Add, reopening and status do not trigger another reading. New chat requests send the question, acknowledged conversation and authorized bounded medical context under their existing separate accounting. Recovery stores questions, acknowledged history and replies; paid-private quotes can retain a separate reply copy. These records can contain medical information. Read-only recovery does not infer non-execution from missing content or automatically dispatch again. AI may be wrong and is not a medical or emergency service. Interrupted-chat recovery access lasts up to 24 hours after authoritative completion or failure, or 7 days from acceptance while pending or uncertain, subject to current authorization and restrictions. Reads and retries do not restart these periods. A reviewed hold may retain content internally without reopening expired recovery access. Scheduled physical cleanup is separately controlled; an access deadline is not proof of physical deletion or permission to retry. Outcome, duplicate-protection and necessary financial evidence remain.

AI recipients, transfers and retention

The API provider is OpenAI; its standard EEA processing agreement names OpenAI Ireland Ltd. Requests use store:false and background:false. OpenAI states that API content is not used for training by default unless the customer opts in, and that default abuse-monitoring logs can contain content for up to 30 days, with legal/safety exceptions. These request settings do not establish Zero Data Retention, a specific project region, or an account-specific no-training guarantee. The service uses the general API endpoint, not a verified EU-only configuration. The standard agreement provides for adequacy decisions or standard contractual clauses for relevant international transfers. No project-specific retention/residency approval or amendment expressly covering this intentional health-data use was found in the retained records. Contact us for the applicable agreement and safeguards; local deletion cannot instantly erase independently retained provider records. The owner-observed projects for the four recorded AI roles display Global residency; this does not independently verify live-key membership or specific processing countries.

Scan alerts and optional location

Opening a supported card resolver can create a scan event and an email alert to the account and configured verified recipients, according to settings. Records include time, card reference and hashed IP/browser identifiers; location can be unavailable. Automatic IP-location and reverse-geocoding lookups are currently disabled. Precise browser location is requested only when the visitor chooses the location button and grants permission; refusal does not block the emergency profile. This is not continuous tracking. Opening an optional Google Maps link sends its coordinates to Google under Google’s own terms. A location-submission token lasts five minutes; that does not delete the scan record or coordinates. Copies sent by email or kept by recipients cannot be recalled by the app.

Payments and support

Stripe handles hosted app payments and passes status and references for settlement. Its group and service providers can process data in the United States and other countries; its published data-processing/transfer terms provide applicable adequacy, Data Privacy Framework or standard-contractual-clause safeguards. This is not a promise that all payment processing stays in the EEA. Swish/Klarna, banks and other selected payment methods have their own notices and records; we do not store their login credentials or full card details. The app retains purchase, tax-evidence, receipt, withdrawal, refund/credit-note and dispute records. Manual refunds use the owner’s payment/banking tools and verified evidence; disclose bank details only through the agreed support process. Support stores tickets, replies, references and attachments for authorized roles. Amazon package orders and returns use Amazon’s separate process.

Hosting, email and authorized access

Netcup GmbH supplies the production VPS in Nuremberg, Germany. It holds the application database, uploaded files and on-server private release backups. The retained customer-specific Netcup processing agreement, provider-signed and dated 17 October 2026, expressly includes health data and lists Anexia group support/infrastructure entities in Austria and Germany; this does not establish every provider access country. Encrypted daily recovery copies of the database, documents, AI context and protected configuration are also stored with Hetzner Online GmbH in Helsinki, Finland, under its processing agreement accepted on 21 October 2026, including health data and emergency contacts. An isolated recovery from that destination was verified. Earlier encrypted release/recovery copies remain in the owner's local Windows/WSL workspace, physically in Sweden; the owner confirms no onward cloud/device synchronization of that workspace. The sole human administrator currently accesses data from Sweden for support, security, recovery and legal duties; this does not locate providers' access. Historical delivered-message headers identify a Namecheap-hosted SMTP relay. The current SMTP subscription, upstream relay mapping and processing country are not verified; another domain's hosting subscription is not evidence for this route. Support@icareintel.se is read through Namecheap Private Email at privateemail.com and automatically forwarded to Google/Gmail for support handling, including message content, sender/recipient details and attachments. The personal forwarding address is not published. Namecheap's published Private Email documentation identifies Phoenix, USA, and its processing addendum includes standard contractual clauses. Google describes global processing, including outside the EEA, with applicable adequacy or standard-contractual-clause safeguards. The owner reports Google One only, without a Workspace entry; no applicable business processing agreement or account-specific region is established by that subscription. Deleting an app ticket does not automatically delete either mailbox copy. Public recipients and nominated contacts receive what you share. No Sweden-only or EU-only processing claim is made.

Telephone contact

The public business telephone is +46850431340, supplied through Zadarma; the retained supplier invoice identifies IP Telecom Bulgaria LTD, Bulgaria. Supplier jurisdiction does not establish all call-processing, storage or access countries. Owner-confirmed settings route this number to an extension configured to record calls to cloud storage, without speech recognition and without recording delivery by email. Forwarding/voicemail and working hours were shown as enable actions, not active features, on the observed screens. These observations do not establish that historical recordings, transcripts or messages never existed or were deleted. Actual storage/access countries and account-specific retention remain unverified. Telephone contact can involve your number, call metadata and what you say. Calling is not consent to AI processing of health information or public disclosure; email and post remain available.

Cookies and technical records

An essential login/session cookie and server-side session store support authentication and language preferences. The production session lifetime is seven days and is renewed during use; logout destroys the app session. Session expiry does not delete account information. This is not consent to optional advertising or analytics. Hosted payment pages can use their own cookies. Operational/security logs can contain IP addresses, request timing and technical metadata; app logging redacts sensitive paths and scan records hash IP/browser identifiers. Nginx is configured for daily rotation with 14 rotated archives; this configuration is not a guarantee that every copy disappears after 14 days. No fixed-age system-journal deletion rule was established.

Retention, withdrawal and erasure in shared-record mode

Medical originals, saved readings and profile data have no general age-based purge; membership expiry is not deletion. Retained paid-private saved answers reopen free where ownership and current authorization permit, until assessed erasure or approved closure, without a new fixed expiry. The short interrupted-chat recovery periods do not expire these independent saved answers or medical sources. Removing a document or withdrawing sharing stops future source use and original access, without erasing independently authorized sources or your stored profile. Physical erasure is separately assessed: selected chat content is restricted promptly, eligible content is removed as soon as practical, and lawful holds and necessary outcome/accounting evidence remain. We normally respond within one calendar month of receipt; this is not a waiting period before action. A complete automatic account/medical-data erasure process is not provided. Contact Support@icareintel.se; session expiry does not delete data. Backups are handled separately. Before restored content or provider processing can reopen, independently authenticated current restriction/erasure evidence must be checked and applied. Missing, stale, incomplete or unverifiable evidence keeps restoration closed. This cannot recall recipients’ downloads or independently held provider copies. The new Hetzner daily backup destination has 30-day rolling retention: managed older copies are removed after a new copy is verified, retaining at least the latest successful copy; failed uploads and outages can delay removal. This does not erase historical local/WSL/release archives or establish an immediate document-specific deletion deadline. Those archives currently have no uniform automatic purge. Minimal financial evidence is retained for accounting, disputes and legal claims separately from health content. Netcup's agreement provides for return/deletion after its processing services finish, subject to legal duties, and a maximum 14 days for its remaining provider backup copies; this is not a timer for our active data or release archives. No defined retention/deletion rule is currently implemented for the Private Email and forwarded Gmail support copies, and app deletion does not purge both mailboxes or their Trash. Provider copies follow their applicable arrangements; proposed improvements are not current deletion guarantees.

Your GDPR rights and complaints

Depending on the applicable conditions, you may request access and a copy, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent for the future and complain to Integritetsskyddsmyndigheten (IMY), imy.se. Contact us first if you wish; this is not a requirement to complain to IMY. We may need proportionate identity verification before disclosing or changing personal data. These services do not promise diagnosis or make legally significant decisions solely through AI.