Privacy policy
Last updated: 14 October 2026
[Controller name], [postal address], is responsible for the personal data processed in Ava Smart Care, on the website and in the phone app. For a question about your data or a request, write to [privacy email].
What Ava Smart Care is for
Ava Smart Care lets the family, friends and professionals around an older person organise support together in a care group: messages, tasks, visits, observations, assessments, reports and plans. Much of what people write in a care group describes the health and daily life of the person being helped. Swiss data protection law treats this as sensitive personal data, and the GDPR treats it as health data. We use it to run the care group for its members and for nothing else.
What we collect
- Your account: name, email address, password (we keep only a hash of it), language, sign-in sessions, and the care groups and roles you belong to.
- What members add to a care group: messages, photos, voice messages, observations, tasks, visits, visit reports, assessment answers, reports, support plans and paths, and documents.
- Dictation: when you dictate, the recording goes to a transcription service and comes back as text. We don't keep the recording.
- The assistant and the courses: your conversations with the assistant and your course progress.
- Devices: the push notification token of your phone, the push subscription of your browser and your notification settings.
- Server logs: our hosting provider records IP addresses, times and requested pages to keep the service secure and to find faults. These logs are deleted after a short period.
The phone app keeps the app lock on your phone. Face ID, fingerprints and your device code never reach us. The home screen widget reads from a copy stored on the phone.
We don't show advertising, we don't track you across apps or websites, and the website and the app contain no analytics tools.
Who sees what
Members of a care group see what is shared with them, according to their role and the audience chosen for each conversation, observation or report. Assessment working notes are visible to advisors. A family member sees a report once an advisor releases it to them by name. A provider company's staff see what the group shares with that company.
People who run Ava Smart Care open care group content only to keep the service working, to solve a problem you report, or when the law requires it.
If you connect another app, such as an AI assistant, to your account, it can see and do what you allow on the connection screen. That app's own privacy policy then applies to what it receives.
Why we may process it
- To provide the service you signed up for.
- Information about a person's health is processed with the consent recorded in the app, given by that person or by someone entitled to act for them.
- To keep the service secure and prevent misuse.
- To meet legal duties.
Services that process data for us
- Vercel Inc., Frankfurt, Germany. Runs the website and the server.
- Neon Inc., [database region]. Stores the database.
- Anthropic PBC, through Cloudflare Inc., USA. Writes the assistant's answers, summaries and suggestions for reports and plans.
- Deepgram Inc., USA. Turns dictation into text.
- OpenAI, USA. Runs the spoken conversation in a voice assessment, when an advisor uses it.
- Google LLC, USA. Finds places and services near an address, and searches the learning library.
- [email provider], [email provider location]. Sends notification emails.
- Expo (650 Industries Inc.), Apple and Google, USA. Deliver push notifications to phones.
These services receive only what they need for their task. Push notifications say that something new is waiting and carry no care details. Where a service is outside Switzerland and the EU, we rely on the Swiss-US Data Privacy Framework if the provider is certified, or on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner. We don't use your data to train AI models.
How long we keep it
- Your account stays until you delete it.
- Care group records stay while the group exists. Closing a group keeps its records so the group can reopen. [Retention period after a group is closed.]
- When you delete your account, we delete your sign-in, name, email address, assistant conversations, course progress and push tokens. Messages and reports you wrote stay in their groups without your name, because other members rely on them.
- Dictation recordings aren't stored.
- Server logs are deleted after a short period.
Your rights
You can ask what data we hold about you and receive a copy, have it corrected, deleted or restricted, object to processing, take it to another service, and withdraw a consent you gave. Withdrawing consent doesn't undo processing that already happened.
To use a right, open Privacy requests under More in the app, delete your account under the account button in the phone app, or write to [privacy email]. We may ask you to confirm who you are first. If records also concern other people, or the law makes us keep them, we tell you what we can do and why.
If you think we've handled your data wrongly, you can complain to the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch, or, in the EU, to the authority where you live.
Security
Connections are encrypted. Passwords are stored only as hashes. Every request is checked on the server and in the database against your role in each group. Records of who opened or changed what are kept without the care content itself. In the phone app you can turn on an app lock.
Changes
When we change this policy in a way that affects you, we say so in the app before the change applies.