Privacy Policy

1. Who we are

Lina Maria Garcia Ltd (company number 514890946), 5 Hayam St., Bat Yam 46322, Israel, is the controller of personal data processed through getparentfile.com and the ParentFile app. Contact: support@getparentfile.com.

2. What we collect

Account and purchase

• Your email address (to sign you in and send service emails).
• Purchase records from Paddle: what you bought, when, country, and a Paddle customer reference. Paddle, not us, handles your card details.

Information you add about a family member

• Name, date of birth, address, phone, language and optional blood type.
• Medications, allergies and conditions as written on labels and documents; doctors, pharmacies and emergency contacts; insurance carrier and member numbers; where documents such as a power of attorney are kept; optional dose-log entries.
• Photos you take of labels, cards and papers, and any documents you choose to upload.

This is health information about another person. Only add it if you are entitled to, and in line with their wishes.

Quiz and email sign-up

• Quiz answers stay in your browser tab (session storage) and are not sent to us. If you ask us to email your results, we receive your email, your consent, the score and your country (US, UK or other), not your individual answers.

Technical

• Basic server logs (IP address, browser type, pages requested, time) kept for security and troubleshooting.
• An essential sign-in cookie in the app. Marketing cookies only as described in section 7.

3. Why we use it (and our legal basis)

• To provide ParentFile: store your file, read photos, build sheets, run share links (performance of our contract with you).
• Health information you add is processed only to provide the service you asked for, on the basis of your explicit consent when you add it. You can withdraw consent by deleting the information or your account.
• Service emails such as sign-in links, renewal reminders and breach notices (contract and legal obligation).
• Marketing emails only if you ticked the consent box; unsubscribe any time (consent).
• Security, fraud prevention and fixing problems (legitimate interests).
• Tax and accounting records of purchases (legal obligation).

We do not use the information in your file for advertising, profiling, or training AI models, and we never send health information to advertising platforms.

4. Who processes it for us

We use a small number of service providers, under contracts that limit them to processing data on our instructions:

• Supabase: database, sign-in and file storage (United States).
• Vercel: website and app hosting (United States and edge locations).
• Anthropic: reads the text in photos you submit so you can confirm it. Under its commercial terms, data sent through its API is not used to train its models.
• Paddle: our Merchant of Record, which processes payments, taxes and refunds as an independent controller under its own privacy notice.
• Email delivery provider: sends sign-in links and emails you asked for.
• Meta: only if you allow the advertising cookie (section 7); it receives page visits and purchase events, never anything about a parent.

People you share a link with can see whatever you chose to share. We may disclose information if the law requires it, and will push back on requests that are not legally valid.

5. International transfers

Our providers mainly store data in the United States. Where data from the UK or EU is transferred, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US / UK-US Data Privacy Framework where the provider is certified. Israel, where we are based, has an EU adequacy decision.

6. How long we keep it

• Photos: deleted automatically once the details have been read and you've reviewed them, unless you choose to keep a photo in your file.
• Free one-photo try (on our public pages, no account): the photo is sent once to be read and is never stored. We keep only a salted, one-way hash of your IP address for up to 2 days to limit tries.
• Your file: kept while your account exists, including after Keep Current ends, so it stays yours. Delete it whenever you like.
• Account deletion: permanently deletes your file, photos and share links from our live systems immediately; encrypted backups roll off within 30 days.
• Email sign-ups without an account: until you unsubscribe, or 2 years after our last email you opened.
• Purchase records: as long as tax law requires (generally 7 years).
• Server logs: up to 30 days.

7. Cookies and advertising measurement

ParentFile itself uses one essential cookie to keep you signed in. On our public pages we may use the Meta Pixel to measure whether our Facebook and Instagram ads lead to visits, sign-ups and purchases. It records page views and these events: viewed the home page, finished the readiness check or asked for the free sheet, started checkout, and completed a purchase. If you allowed the cookie, we also confirm a completed purchase to Meta from our server (the order value and a one-way hashed copy of the buyer's email, so the ad can be matched), using the same order number so it is counted once. It never receives quiz answers, emails you type, or anything from inside the app. Visitors who appear to be in the UK or EU are asked first and the pixel only loads if they choose “Allow”. You can change your choice by clearing this site's data in your browser.

8. Security

• Encryption in transit (HTTPS) and at rest.
• Row-level security, so each account can reach only its own records.
• Share links use long random tokens (128-bit), can have a PIN, and can be revoked at any time.
• Insurance numbers are masked on sheets and shares by default.
• Access by our staff is limited to what's needed to support you.

No system is perfectly secure. If a breach affects your information we will tell you without undue delay, and we follow the notification requirements below.

9. HIPAA and the FTC Health Breach Notification Rule (US)

ParentFile is not a healthcare provider, health plan or a business associate of one, so HIPAA does not apply to the information you store with us. Because ParentFile is a personal health record, the US Federal Trade Commission's Health Breach Notification Rule does apply. If unsecured health information in ParentFile is acquired without authorization, we will notify affected users, the FTC and, where required, the media, within the Rule's deadlines (no later than 60 calendar days after discovery).

10. Your rights (UK, EU and elsewhere)

Under the UK GDPR and EU GDPR you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. Most of these you can do yourself in the app (edit, export as PDF or data file, delete account). For anything else email support@getparentfile.com; we reply within one month. You can also complain to your data protection authority, such as the UK Information Commissioner's Office (ico.org.uk) or your EU supervisory authority, or the Israeli Privacy Protection Authority.

11. California and other US state privacy notice

If you live in California or another US state with a consumer privacy law:

• Categories collected in the last 12 months: identifiers (name, email, IP address), customer records, commercial information (purchases), internet activity on our site, and sensitive personal information (health information you add about a family member). Sources and purposes are described above.
• We do not sell or share personal information for cross-context behavioral advertising as defined by the CCPA, except that, if you allow the Meta advertising cookie, page-visit and purchase events may be considered “sharing”. You can opt out by choosing “No thanks”, clearing site data, or using a Global Privacy Control signal, which we honor.
• Sensitive information is used only to provide the service you requested; we do not use it to infer characteristics about you.
• Your rights: to know, access, correct and delete your information, and not to be discriminated against for exercising them. Email us to make a request; we'll verify it by email and reply within 45 days. An authorized agent may act for you with your signed permission.
• Some states (for example Washington's My Health My Data Act) give additional rights over consumer health data; we apply the same practices to everyone: health information is used only to provide the service, never sold, and deleted on request.

12. Children

ParentFile is for adults aged 18 and over. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.

13. Changes

If we make a material change, we'll email account holders and update the date at the top before it takes effect.

14. Contact

Lina Maria Garcia Ltd, Israel. support@getparentfile.com. See also our Terms.