carexboost

    Privacy Policy

    Last updated: 8 September 2026

    This policy explains the processing of personal data associated with the CareXBoost website and platform. It covers visitors, users, business contacts and people whose data is entered by professionals or organisations using the service.

    CareXBoost is provided as part of a sole trader business. For support, contractual questions, privacy and personal data rights requests, contact hello@carexboost.com or +351 914 821 357.

    The service manages the data needed for its relationship with users, account operation and support. When patients are supported, the professional or organisation determines the purposes and conditions for using the records they enter. Each party’s responsibilities must correspond to the operation performed and applicable contractual terms.

    Data depends on the features used and the information provided. You do not need to enter clinical information in a business or general support request.

    • Account and profile: name, email, professional details and authentication information.
    • Organisation and subscription: organisation identity, contact details, plan and information needed for payment and billing.
    • Care records: patient identification and context, sessions, goals, notes, materials, feedback and reports entered or produced during use. These records may include health data and children’s data.
    • Contacts and support: information sent in forms or messages, including name, email, subject and request content.
    • Operation and navigation: technical device and browser data, records needed for security and privacy preferences; analytics and marketing data according to the choices made.

    Data enables us to provide the account and requested features, organise work, process subscriptions, respond to requests, and maintain the service and its security. When you use AI assistance, the information sent is processed to produce the requested result.

    The legal bases depend on the purpose: performance of a contract or steps requested before entering into one; compliance with legal obligations; consent, where applicable; and legitimate interests related to security and service management, subject to the rights of the people concerned.

    For health data, the professional or organisation must also identify and document the applicable condition under Article 9 GDPR. Accepting the software terms does not replace that analysis or the authorisations required in the specific case.

    CareXBoost supports professionals working with children, adolescents and adults. Children’s data should appear in a record only as part of authorised support and under the conditions applicable to the situation.

    The professional or organisation must check who may represent the child, what information must be provided and who may access each piece of content. Parental or family access does not automatically mean access to all notes, observations or communications.

    When generating reports, the supplied name of the person receiving care and occurrences of that same name in the request data are replaced with a neutral reference before being sent to AI. CareXBoost inserts the name into the returned text only after generation. This protection does not anonymise all content: other identifiers or personal references in free text may require removal by the professional.

    AI requests may include an activity description, goals, context and information selected by the user. Avoid including identifiers and personal details that are not necessary for the request.

    Content sent may be processed by model providers used by the service. The result supports the work and may need correction. Review and clinical decisions remain with the professional.

    Transcription may only begin after the person receiving care has signed the specific consent made available in the workflow and the professional has uploaded that file to the case. Consent may be withdrawn; before starting further processing, the professional must record and respect that decision.

    In this workflow, audio is processed transiently to obtain a transcription. CareXBoost does not make an audio recording available as a care record. Only text reviewed by the professional may be saved on the platform.

    Names and other personal data spoken during a session may reach the transcription provider. The pseudonymisation described for report generation does not automatically apply to audio or transcription. Do not include information that is not necessary for care and transcription.

    The service uses infrastructure components and external providers depending on the requested feature. A provider’s involvement does not mean that it receives all data held on the platform.

    • Supabase: authentication, database and storage used by the application.
    • Vercel: hosting and application execution.
    • Resend: sending service emails and routing contact requests.
    • Stripe: processing and managing subscription payments.
    • OpenAI: AI assistance, including psychology and speech therapy materials. Some features may use Anthropic or xAI, depending on the model available.
    • Deepgram: audio transcription when this feature is enabled. Requests use Nova-3 for Portuguese (Portugal) through a European endpoint and are configured to exclude audio from the provider’s model improvement programme.
    • Vendus: billing operations when the integration is configured and used by the organisation.
    • Google Analytics and Vercel analytics tools: measuring use according to privacy preferences. Other optional services depend on the enabled configuration.

    The processing location may vary between hosting, technical support and external services. Using a service hosted in Europe does not mean that every operation by every provider takes place exclusively in that territory.

    Transfers outside the European Economic Area are subject to the conditions provided by the GDPR, including adequacy decisions or appropriate safeguards where applicable. You may request information about the providers involved in a feature and the processing conditions through the privacy contact.

    Retention is determined by the purpose and obligations applicable to each data category. Account and subscription details support the contractual relationship; contacts are processed to respond to and follow up requests; professional records are also subject to the obligations of the responsible professional or organisation.

    Closing an account does not necessarily mean immediate deletion of all information, particularly where legal retention obligations or the need to establish, exercise or defend rights exists. Deletion requests must take account of the systems in use, backups and processors involved.

    To understand the conditions applying to your data or request its deletion, contact hello@carexboost.com, identifying the account and nature of the request without sending unnecessary clinical details.

    Under the terms and limits of the GDPR, you may request access, rectification, erasure, restriction of processing and portability of your data, and object to certain processing. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing.

    Send your request to hello@carexboost.com. We may need to verify your identity or forward the request to the organisation responsible for the patient records. We respond within the legal time limits, normally one month, with a possible extension under the GDPR.

    You may complain to the Portuguese Data Protection Authority (CNPD) without first contacting the service.

    The website uses storage necessary for operation, authentication and preferences. Optional analytics and marketing categories are managed through the service’s consent mechanism.

    You can review your choices using the “Privacy preferences” button available on the website. Refusing optional choices does not amount to requesting deletion of your account or the records you keep on the platform.

    Application access uses authentication and permission mechanisms. Protect your credentials, review users with access to your organisation and share only information suitable for the recipient.

    If you suspect misuse or data exposure, contact hello@carexboost.com. No service should be considered risk-free: security also depends on devices, assigned permissions and how each party uses the service.

    This policy may be updated to reflect changes to the service and data processing. The version and date shown on this page identify the text made available. Changes requiring additional information or a new choice will be handled through the applicable channels and mechanisms.