Marketing privacy notice

1. What this notice covers

This notice applies only to the public MyCareBuddy launch website, its waitlist and its newsletter.

The MyCareBuddy care app handles different information (the health data a Care Circle enters) and has its own privacy policy and terms, presented when you create or use an app account. This marketing notice does not replace those app documents, and nothing you enter in the app is covered here.

2. Who is responsible

MyCareBuddy is the data controller for the personal information described in this notice.

For privacy questions or to exercise your rights, email jennifer@mycarebuddy.app.

Our legal notice has our publisher and hosting details.

3. What we collect

• Your email address when you join the waitlist and newsletter.
• Subscription information, such as when you joined, whether you confirmed your subscription, delivery status, unsubscribes, and email opens or link clicks where those measurements are enabled.
• Basic technical information that we and our hosting provider record so the site works and stays secure: your IP address, browser type, the page you requested and the date and time. We store your IP address and browser type in a short-lived website session record, which expires within 2 hours of your last page view; our hosting provider keeps separate security logs for the limited period described below.
• Page-view measurements: which of these public pages you viewed, roughly where in the world you are, and whether you arrived from a search engine, a link or directly. This is measured with Google Analytics and is described in full in sections 5 and 7. What the cookie notice controls is whether those page views are tied together into one visit: if you decline, or before you answer, nothing is stored on your device and no identifier is written or read to link one page view of yours to the next, but the page you are reading, where you arrived from and your IP address are still sent to Google, marked as refused. Section 5 sets out exactly what reaches Google either way.

We do not ask for health information in the waitlist form. Please do not send diagnoses, medication details or other health information through the email sign-up.

The “Is MyCareBuddy for you?” finder runs in your browser. Your answers are not submitted to us, saved in your browser or added to EmailOctopus.

4. Why we use it

• To add you to the MyCareBuddy waitlist and send the launch news, early-access updates and newsletter you asked for.
• To understand whether emails are delivered and useful, and to keep the list accurate.
• To protect the website, prevent abuse and diagnose technical problems.
• To see which of these pages people actually find useful, so we write more of what helps and less of what does not.

We rely on your consent for waitlist and newsletter emails, and separately on your consent for the analytics cookies described in sections 5 and 7; section 5 sets out what reaches Google before you answer, and if you decline. You can withdraw either at any time, without affecting anything we lawfully did before you withdrew: the unsubscribe link in any email for the first, and the “change your choice” button in section 7 for the second. Neither affects the other, and declining measurement changes nothing about how the site works for you. We use our legitimate interests to keep this website secure and operating properly.

5. Who helps us process it

We use a small number of service providers only where needed to run this site:

• EmailOctopus receives and manages waitlist email addresses and sends our emails. It acts as our email-service provider. You can read the EmailOctopus privacy policy.
• Our hosting and infrastructure providers process the technical information needed to deliver and secure the site.
• Google receives measurement requests from these public marketing pages through Google Analytics, whether or not you accept on the cookie notice. What your answer changes is set out in the paragraph below and in section 7. Our Analytics contract is with Google Ireland Limited, in the European Economic Area, and Google also processes this data in the United States. Google LLC is certified under the EU–US Data Privacy Framework, the Swiss–US Data Privacy Framework and the UK Extension, and that certification, backed by standard contractual clauses where it does not apply, is the safeguard for the transfer to the United States. You can read the Google privacy policy and how Google uses data from sites that use its services.

The typefaces used on this website are served from our own servers, so loading a page does not send your IP address to a font provider.

Google Analytics is the only third-party script on these pages, and it is the only reason your IP address reaches a company other than us or our hosting provider. It is worth being precise about what your choice on the cookie notice does and does not control. Two things reach Google whichever you choose. The first is the request for the script itself, made as the page loads, which carries your IP address. The second is a measurement request as each page opens, and a further one for certain things you do on it, such as scrolling to the bottom or following a link to another website, each carrying the page address, the page title, where you arrived from, your IP address and basic technical details about your browser, and each marked to say you have not consented. Until you accept, nothing is written to or read from your device, so neither request carries a cookie and nothing in them persists to link one page view of yours to the next, and if you decline, that stays true permanently. What your choice controls is whether anything is stored on, or read back from, your device.

None of this runs inside the MyCareBuddy app itself. Once you sign in, there is no Google Analytics, no measurement and no third-party script on any page. The health information a Care Circle enters is never measured, never sent to Google and never used to build a profile. That boundary is enforced by an automated test, not by a policy someone has to remember.

We do not sell your personal information or share the waitlist with advertisers. Some providers may process information outside the European Economic Area, the United Kingdom or Switzerland; where this happens, we require appropriate data-protection safeguards through our service arrangements.

6. How long we keep it

We keep your email address until you unsubscribe, or until three years after your last contact with us, whichever comes first. Clicking a link in one of our emails counts as contact; simply opening an email does not. Before that three-year period runs out we will email you to ask whether you still want to hear from us, and if you do not reply we will delete your address.

If you unsubscribe, we keep the minimum suppression record needed to make sure we never send you marketing again. We keep that record for at least three years and use it for nothing else.

Website session records (the IP address and browser type described in section 3) expire within 2 hours of your last page view. Our hosting provider’s separate security logs are kept for [[PLACEHOLDER: retention period, once the hosting provider is decided]] and used only to investigate reliability or abuse. Service-provider backups may take a short additional period to expire.

7. Cookies and tracking on this website

Some of this website’s cookies are set without asking: the ones the site cannot work without, and the one that remembers your answer below, because the only way to respect a “no” is to write it down. The analytics cookies are different: we set those only if you say yes.

The ones set without asking:

• Session cookie (mycarebuddy-session): identifies your visit so the waitlist form works and so we can show you the result after you submit it. Set on every page you view, and expires 2 hours after your last page view.
• CSRF cookie (XSRF-TOKEN): protects the waitlist form against cross-site request forgery, so another website cannot submit it on your behalf. Set on every page you view, with the same 2-hour lifetime as the session cookie.
• Cookie-notice cookie (cookie_notice_dismissed): records that you have dealt with a cookie notice on this address, so the MyCareBuddy app does not ask you about cookies again after you sign in. Set by your browser when you answer the notice, and lasts up to 1 year.
• Your analytics answer (__Host-analytics_consent): remembers whether you said yes or no to the measurement below, so we honour your choice and stop asking. Set by your browser when you answer, stores only the word “granted” or “denied”, and lasts 6 months, after which we ask again. This one is set whichever way you answer, because remembering a refusal is the only way to respect it.

Emails may include standard delivery and engagement measurement supplied by EmailOctopus, such as open or link-click events. You can stop future email measurement by unsubscribing.

8. Your choices and rights

You can unsubscribe at any time using the link in any MyCareBuddy marketing email. You may also ask us to:

• give you a copy of the personal information we hold about you;
• correct inaccurate information;
• delete or restrict the use of your information;
• provide eligible information in a portable format; or
• consider an objection to how we use your information.

Email jennifer@mycarebuddy.app to make a request. You also have the right to complain to a data-protection authority: the CNIL in France, the FDPIC in Switzerland, the Information Commissioner’s Office in the United Kingdom, or the authority in the country where you live or work.

9. Children

This marketing sign-up is not directed at children. A parent or caregiver may join the waitlist to receive MyCareBuddy launch updates. Please do not submit a child’s email address or health information through this website.

10. Changes to this notice

We may update this notice as the marketing website or the way we send updates changes. The date at the top shows when it was last revised. We will explain any important change on this page and, where appropriate, by email.