Privacy Policy — Mirandole Care

Note to families and care facilities: This policy is written in plain language to reflect exactly how Mirandole Care handles your data. It is not generic boilerplate — every section describes our actual practices. We recommend that care facilities also have their legal counsel review this document, as they act as data controllers for resident records.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have over your data when you use the Mirandole Care iOS application and website (mirandolecare.com).

If you have any questions, contact us at privacy@mirandolecare.com.

1. Who This Policy Covers

This policy applies to all users of the Mirandole Care platform, including:

Facility administrators and care staff — employees or contractors of a subscribed retirement home or care facility
Family members — relatives or designated contacts of a resident, invited by the facility
Visitors to mirandolecare.com

Mirandole Care is an eldercare platform. We do not direct our services at children, and the platform is not intended for use by persons under 18.

2. Roles: Controller and Processor

Understanding who is responsible for your data matters, especially for health information.

The care facility is the data controller for resident records — they determine what resident health and care information is recorded, who has access to it, and how long it is kept. Their internal privacy practices govern how they use the platform.
Karim Raad / Mirandole Care is the data processor — we provide the secure platform and infrastructure, and we process data only as instructed by the facility or as necessary to operate the service.

For family member and staff account data (names, emails, credentials), Mirandole Care acts as the data controller.

3. Information We Collect

Account and identity information

Name, email address, phone number
Role within the facility (administrator, nurse, family member, etc.)
Optional: profile photo, address, emergency contact details

Resident health and care data

Entered by care staff on behalf of the facility, and visible to authorized family members:

Vital signs (blood pressure, heart rate, temperature, oxygen saturation, weight, blood glucose)
Medication records and administration logs
Care observations and clinical notes
Room assignment, date of birth, and administrative resident details
Photos shared by staff

Communications

Messages exchanged between family members, care staff, and administrators within the platform
Announcements posted by facility staff

Billing and administrative data

Invoices, billing records, and payment status managed by the facility

Technical and usage data

Device type and operating system version (for support purposes)
App version
Authentication logs (login times, session tokens)

We do not use third-party analytics, advertising networks, or tracking SDKs. Our website sets no tracking cookies.

4. How We Use Your Information

To provide the Mirandole Care platform and all its features
To authenticate users and enforce role-based access controls
To send transactional emails (account invitations, password resets, notifications)
To generate clinical reports and records on behalf of the facility
To provide technical support
To comply with applicable legal obligations

We do not use your data for advertising, profiling, or any purpose unrelated to operating the platform.

5. Sub-processors We Use

We use the following trusted sub-processors to operate the platform. Each is bound by data processing agreements:

Supabase — secure database, file storage, and authentication infrastructure. All data is encrypted at rest and in transit.
Resend — transactional email delivery (invitations, password resets, notifications). Resend receives the recipient email address and message content necessary to deliver the email.
Apple — the App Store distribution platform. Apple may collect data as described in their own privacy policy when you download or use the app.

6. Where Your Data Is Stored

Data is currently hosted on servers located in the United States via Supabase infrastructure.

Note: We plan to offer EU-region hosting for European facilities. This section will be updated when EU hosting is available. If your facility requires EU data residency, please contact us at privacy@mirandolecare.com.

7. Security

All data is encrypted in transit (TLS) and encrypted at rest
Role-based access control — each user can only access data appropriate to their role and facility
Facility-scoped data isolation — staff and families at one facility cannot access data from another
Secure authentication token management

No system is perfectly secure, and we cannot guarantee absolute security. We will notify affected users of any data breach as required by applicable law.

8. Communications Transparency

Authorized facility administrators may review messages sent within the platform — between care staff, and between staff and family members — for purposes of care quality assurance, safeguarding, and compliance. This is not routine monitoring. Care staff are informed of this capability as part of their facility's acceptable use policy.

9. Data Retention

Health and care records are retained in accordance with the applicable regulations of the care facility's jurisdiction, as directed by the facility (the data controller).
Messages and photos are retained for the duration of the active care relationship, or as specified by the facility.
Account data is retained until you request deletion or your account is closed. Upon account deletion, your personal data is removed from our active systems within 30 days.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data. We honor these rights for all users regardless of jurisdiction:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion of your account and personal data. Family member and staff accounts can be deleted directly within the app. For resident health records, requests must be directed to the facility (the data controller).
Portability — receive your data in a structured, machine-readable format
Objection — object to certain types of processing
Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, email us at privacy@mirandolecare.com. We will respond within 30 days.

11. No Third-Party Tracking

We do not use Google Analytics, Facebook Pixel, or any other third-party analytics or advertising SDK — in the app or on this website. We do not sell your data. We do not share your data with advertisers.

12. Children

Mirandole Care is an eldercare platform designed for use by adults. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child's data has been submitted to our platform in error, please contact us at privacy@mirandolecare.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and notify facility administrators by email. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

14. Contact

For any privacy-related questions, data requests, or concerns:

Email: privacy@mirandolecare.com