CareHaven is a private app for caregivers. The summary below is the whole story; the rest of this page is the receipts.
We can't read the care log on your phone. With sync on, it goes to your own iCloud, and we can't read it there either. We don't receive:
Some things you choose to do can still send information off your phone. They include:
Everything you log — feedings, behaviors, sleep, vitals, doctor visits, milestones, goals, contacts, custom routines, photos attached to entries — is yours. Today, we don't have access to the care log stored on your device or in your private iCloud. Someone who receives a PDF or a complete handoff link can pass it on. Those copies are separate from access to your shared profile.
If you delete the app, the data goes with it (unless you've made a backup or turned on sync).
You can opt in to auto-backup in Settings → Sync & Backup → Auto-backup. When enabled, the app writes a .chbak file to your Files app on a schedule you choose. The file is AES-256-GCM encrypted with a password only you know — without that password, the file is unreadable, including by us.
You control where the file goes (iCloud Drive, Dropbox, your own NAS, anywhere). We never see it.
Sync is optional and off by default. Plus adds sync across your devices. Family adds sharing with caregivers you invite. Today, sync uses iCloud: Apple encrypts synced records while they travel and while they are stored in iCloud. You turn sync on in Settings → Sync & Backup → Sync via iCloud. When you invite a caregiver, they get the person's profile: name, birth date, sex, diagnoses, communication method, and sensory profile. They also get the sections you choose. It reaches them through an iCloud share.
Sync is off by default. Turning it off after using it may leave a copy in your synced storage, which you can delete from your device's Settings.
On your iPhone or iPad, the app connects to Apple Health only for the one profile you mark as yourself, never for anyone else's profile. Today CareHaven only reads from Apple Health, and only after Apple asks you to allow it. It can read sleep, vitals, cycle, and body measurements. If you bring in your Health Records, it also reads your medications, allergies, immunizations, lab results, conditions, and vitals. Those imported records stay on your device, though your device's own backup can include them. A record you add to your care log with "Add to my records" is saved like your other records, so it can sync, go into backups, and be shared like them. On Apple Watch, the seizure timer can show your latest heart rate while it runs, if you allow it. It doesn't save or send it. CareHaven writes nothing to Apple Health.
When the app reads from Apple Health, the data goes straight from Apple Health into the app on the iPhone, iPad, or Apple Watch you are using. It does not go through any computer we run. No part of the app made by another company reads from Apple Health.
CareHaven provides on-device smart help. For questions eligible for Online help, the app first tries its local knowledge base and available on-device AI. If you enable Online help and those options cannot answer, a question the app identifies as general may be sent to an AI provider over HTTPS. The app tries to remove identifying details first, but it can miss some.
If you turn on Online help, questions the app identifies as general may be sent to an AI provider. The app tries to remove identifying details first, but it can miss some. We don't operate any server-side caching or logging of these queries. The AI tier is enrichment — the deterministic chart underneath is always the source of truth, and AI never makes decisions for you.
These queries go to a small set of vetted third-party AI services — a primary service, plus a fallback used only if the primary is unreachable. We choose providers on capability and privacy posture, and we may change them as better options emerge; this policy will always describe the current data flow. If you'd like the names of the current providers, email us and we'll tell you.
Each provider's privacy policy governs how they handle the request on their side. Because the app tries to remove identifiers before any call, the data they receive is not meant to be associated with you or your care recipient, though the app can miss some. We don't share customer data with any provider for training; we use them as inference endpoints only.
You can turn off Online help in Settings → Privacy, under AI help. It is off until you turn it on. With it off, AI features don't send your questions or care log off your phone. Lookups, feedback, and the location check are separate. They are described under Lookups and feedback (optional) below.
Some features send a small piece of what you're doing, and only when you use them or allow them. The reference-file download at the end of this section is different. It runs on its own.
A medicine name you type goes to the U.S. National Library of Medicine. So can a saved medicine's name, when you open that medicine. When you ask what a condition or a medicine is, a diagnosis code or a drug code goes to MedlinePlus. The diagnosis code can be one already saved in your care log. You don't type it again.
A doctor or clinic name goes to the U.S. government's list of providers. A city or state is included only if one is filled in. The state may be the one from the location check below.
A food barcode goes to Open Food Facts. A food name the app doesn't know goes to the U.S. Department of Agriculture. A pharmacy name you type goes to Apple Maps. The app doesn't add your location to that search.
Tapping an address opens it in a maps app. That is Apple Maps, or Google Maps or Waze if you have one of those and you pick it. That app gets the address. Tapping a saved pharmacy opens it in Apple Maps, which gets the place.
With Apple Calendar sync on, the app makes a calendar on your iPhone for each person you pick and copies that person's appointments into it, with their dates, times and repeat schedules. The calendar's name usually starts with CareHaven and can include the person's name. Once the calendar is made, sync keeps its name. For each person you choose what the events show: Just the name (the default) shows each appointment's name, Full details also shows the provider, what to bring and your notes, and Private label shows the word CareHaven in place of the appointment's name. Private label changes each appointment's name, not the calendar's name. Adding an appointment to Apple Calendar yourself needs sync on. It keeps its real name whatever you picked for sync, and Apple's event screen shows it to you, including which calendar it goes in, before it is saved. Adding a doctor-visit follow-up does not need sync on. You tap the calendar button next to it. A follow-up with a date keeps its real name, and the same Apple screen shows it before it is saved. A follow-up with no date goes straight into the Reminders list your iPhone uses for new reminders, with its real name. That list can sync to its account, such as iCloud. Tapping that button can also make that person's CareHaven calendar, even with sync off. The calendar is usually made in the account your iPhone uses for new events, such as iCloud, Google or Outlook, and your iPhone syncs it to that account like any other calendar.
If a handoff or shift report link is opened in a web browser, our web host gets its locked (encrypted) data but not the key, so it can't read it.
If you allow location, the app asks your iPhone for a rough location (within about 100 meters). The iPhone may give a closer or a coarser reading, and the app sends that reading to Apple as it is, to find your country and, in the U.S., your state. The app uses those to show the right emergency numbers and state resources, and to fill in your state when you search for a provider. It keeps only the country and, in the U.S., the state. We never see the reading. The state can be sent with a provider search.
If you send feedback, you need to be signed in to iCloud. Apple ties the note to that iCloud account, so notes from that account can be linked. The app doesn't attach your email address. We save the message, the category you picked, the app version and build, the kind of device (such as iPhone or iPad), the full system version (such as iOS 26.0.1), and the time you sent it. The app removes obvious names, emails, and phone numbers first. The cleaner also looks for an address and similar details, and it still isn't perfect. Please leave out your child's name and other personal details.
Each time the app starts, it checks carehaven.org for updated reference files, like help topics and crisis lines, and downloads any that changed. You do not tap anything for that. If you are signed in to iCloud, it also downloads reference files from Apple's iCloud. It may download a food list from carehaven.org too, if you ask for that in Settings. These downloads send none of your care log. On the carehaven.org downloads, our web host sees the internet address of your phone (its IP address), the same way it does when you visit this website.
This website works in three layers. First, it counts visits with Plausible, which sets no cookies. Second, it counts visits with Google Analytics, which does set cookies: outside the EU, the UK and Switzerland it is on unless you turn it off; inside those regions, as far as your browser's time zone and language tell us where you are, a cookie banner asks first and nothing from Google loads until you click Allow (the Google Analytics section below explains the one exception). Third, on a few pages, and only when we are running ads, the banner also asks whether we may use cookies from ad partners to measure those ads. Nothing from an ad partner loads unless you click Allow. The Shop page is the one other place with cookies: Shopify's buttons there set Shopify's own cookies (see Cookies and your privacy choices below). The CareHaven app is separate: it sends nothing to Plausible, to Google Analytics or to any ad partner.
This marketing site uses Plausible Analytics to count visits. Plausible sets no cookies. It does not store your raw IP address or your browser's user-agent string (the technical label every browser sends). It makes a visitor ID that is specific to this site and changes every day, so visits can't be linked from one day to the next, or from one site to another. We see aggregate totals: which pages were viewed, which site or link sent each visitor, what kind of device and browser they used, and which country or region they were in. This site also sends Plausible some simple events, such as when someone signs up for the launch list or skips the signup, sometimes with a simple label like the signup source. Plausible's data policy has the details.
This site also uses Google Analytics to count visits and see which pages get read. Unlike Plausible, it uses cookies: _ga and _ga_<id>, which last up to two years and tell your browser apart from others on this site. Google gets the page you viewed and the page that sent you; when either is one of our pages, its web address is cut down to click IDs and campaign tags first, so a condition code in an address never goes to Google. It also gets your device and browser type, your IP address (Google uses it to work out your rough location and does not store it), and the time. When someone joins the launch list or the beta, it is told that a sign-up happened, never the email address or anything typed into a form. We have turned off Google Signals (the cross-device and ads-audience feature) and ads personalization, so this data does not feed Google's ad profiles. How Google uses information from sites that use its services explains Google's side.
Where it is on. It runs on our main pages, the pages about a health condition or a care topic, the blog (carehaven.org/blog) and the Help pages (carehaven.org/help) included, but not on the 404 page or the handoff page. Outside the EU, the EEA, the UK and Switzerland it is on from your first visit unless you turn it off in Privacy choices. Inside those regions it stays off until you click Allow on the cookie banner, which asks on your first page. We tell the regions apart by your browser's time zone and language settings. Google also checks your IP address: if it places you in one of those regions when our check did not, Google is told you have not said yes, so it sets no cookies and keeps only cookie-free counts: the page view and, if you sign up, that a sign-up happened. If your browser sends the Global Privacy Control signal, Google Analytics stays off everywhere. Turning it off in Privacy choices deletes its cookies on this site and reloads the page so no Google code stays running.
How we tell where you are. When you open the first page of a visit and your browser's clock and language do not say you are in Europe, our server looks at your IP address once, to tell which country it belongs to, so it knows whether to ask you before Google Analytics runs. Our code keeps no record of the address: it answers with a country code and a yes or no, then forgets it. (Hostinger keeps ordinary server logs, as the hosting line below says.) We do this under our legitimate interest in asking you first where the law says we must. Your browser keeps that one answer for the tab you are in, in sessionStorage under ch_region, so later pages do not ask again.
The signup form sends your email to Mailchimp so we can email you when CareHaven is ready for early-access testing. Signing up is double opt-in: Mailchimp sends you one confirmation email, and you are not on the list until you click the link in it. You can unsubscribe with one click. We never share or resell the list.
When we run ads for CareHaven on other sites, we measure them with the ad partners' own tags. Those tags use cookies, so we ask first. The cookie banner has two equal buttons, No thanks and Allow. Where it also asks about Google Analytics, one answer covers both, and the Privacy choices panel has a separate switch for each. Until you click Allow, no ad tag loads and no ad cookie is set. If your browser sends the Global Privacy Control signal, we treat that as a No: we do not show the banner and we do not load any ad tag.
Which pages. Ad tags can run only on a short list of pages: the home page, the beta page, the welcome page, About, Press, Support, the Shop and the Flyers page. They never run on the pages about a health condition or a care topic, the mental-load quiz and guide, the comparison pages, this privacy page, or the Help pages. A new page is off by default.
Which partners. We may use Meta (Facebook and Instagram), Google, TikTok, Reddit, Pinterest, Snap, LinkedIn and X. The cookie banner and the Privacy choices panel name the partners that are active at that moment.
What they get. If you click Allow, the partner gets data about your visits to the few pages of this site that run ads, for up to a year: that you visited, your IP address, your browser and device details, and an ad-click ID if you came from one of its ads. When someone joins the launch list or the beta, the tag is told that a sign-up happened. We do not send an ad partner your email address, your name, or anything you type into a form. Before a tag loads, we cut the web address down. If you came from an ad, a partner may get that ad's click ID and its campaign tags (such as utm_source) from the address, and never the page's other address parts. We also hide which page of ours you came from.
The cookies these companies set. Google Analytics' cookies are set while it is on (see Google Analytics above). Ad partner cookies come only after you click Allow. Each company publishes its own lifetimes and can change them.
| Partner | Cookies | How long | What they are for |
|---|---|---|---|
| Google Analytics | _ga, _ga_<id> | Up to 2 years | Count visits and tell your browser apart from others on this site |
_gcl_au, _gcl_aw, _gcl_gs, _gcl_gb, _gcl_ag (all start with _gcl_), _gac_gb_<id> | 90 days | Remember which ad click led to a sign-up | |
IDE (set by Google's ad domain, doubleclick.net) | 13 months in the EEA and UK, 24 months elsewhere | Deliver and measure ads | |
| Meta | _fbp, _fbc | About 90 days (Meta sets this) | Tell visits apart and remember a click on a Meta ad |
| TikTok | _ttp, _tt_enable_cookie, ttcsid | Up to 13 months; ttcsid ends with your session | Tell visits apart and remember a click on a TikTok ad |
_rdt_uuid, _rdt_cid, and others that start with _rdt_ | 90 days | Tell visits apart and remember a click on a Reddit ad | |
_pin_unauth, _epik, _derived_epik, _pin_aem | 1 year | Group visits together and remember a click on a Pinterest ad | |
| Snap | _scid, _scid_r, _sctr, sc_at | 1 year | Tell visits apart and measure ads |
li_fat_id, li_giant (on this site), plus cookies on linkedin.com | 30 days and 7 days on this site | Link a visit to a LinkedIn ad click | |
| X | Cookies on twitter.com and t.co, plus first-party cookies on this site (we list their names here before we turn X on) | X publishes the names, and caps lifetimes at 13 months in some areas | Link a visit to an ad click and measure ads |
Ad partners may also keep small notes in your browser's storage on this site. We remove the ones we know about when you turn ads off.
You can change your mind at any time. Use Privacy choices at the bottom of our main pages. Turning ads or Google Analytics off there deletes the cookies this site could reach for that switch, and reloads the page so none of that code stays running. Cookies that a partner keeps on its own domain are the partner's to delete: clear them in your browser settings.
lp04 or p-7k2m, never a name or a health topic), and when you signed up.CareHaven LLC (privacy@carehaven.org) is responsible for this website's data. We rely on your consent for the email list, and on our legitimate interest in running, measuring and protecting a website for hosting logs, Plausible visit counts and the short-lived signup-abuse counters. Google Analytics relies on that legitimate interest outside the EU, the EEA, the UK and Switzerland, and on your consent inside them. When our region check misses you there and Google's own check applies its no-consent default, the cookie-free count that remains rests on the same legitimate interest. Either way you can turn it off at any time in Privacy choices. Ads and ad measurement rely on your consent: you can say no, and you can withdraw it at any time in Privacy choices. We never sell personal information. If you click Allow, our ad partners receive data about your visit, as described above. We honor the Global Privacy Control signal.
Our own code sets no cookies. There are three other sources. Google Analytics sets its cookies while it is on (see Google Analytics above). Shopify's buttons on the Shop page set Shopify's cookies when that page loads. Ad partners set cookies only if you click Allow.
Shopify, on the Shop page. When the Shop page loads, Shopify's buttons set these cookies on this site: _shopify_y and _y (up to 2 years; some browsers shorten this to about 13 months) and _shopify_s and _s (about 30 minutes). Shopify sets them to tell shop visits apart for Shopify's statistics. Shopify may also keep a cart note in your browser's storage once you use a cart. The Privacy choices switches do not control these. You can clear them in your browser settings.
These are our own small notes. They stay on your device, they are not cookies, and they never go to us or to any ad partner. The pages read them to remember your choices. This list covers our notes only: Shopify's buttons on the Shop page may keep a cart note in your browser's storage once you use a cart, and ad partners may also keep small notes in your browser's storage on this site, but only if you click Allow (see the cookie table above).
ch_privacy: your privacy choices (ads, Google Analytics, visit counter, and when you chose).ch_region (session storage, this tab only): whether to ask you first, from the country check above; gone when the tab closes.ch_theme: light or dark, if you picked one.ch_modal_seen: that you have seen the sign-up pop-up, so it does not keep coming back.ch_sticky_bar_dismissed: that you closed the bar at the top of the home page.ch_exit_intent_shown: that the leaving-the-page sign-up pop-up already showed.ch_unsupported_dismissed: that you closed the older-iPhone notice.ch_wiki_recent and ch_wiki_audience: on the Help pages, the pages you opened lately and the reader type you picked.plausible_ignore: only if you turn the visit counter off. It tells Plausible to skip your visits.Select Privacy choices at the bottom of our main pages, or the button above. You can turn ads, Google Analytics and the visit counter on or off, and you can use Forget my settings on this device to clear the theme, pop-up and Help-page notes in the list above. It keeps your privacy choices and the visit-counter setting.
Global Privacy Control (GPC) is a setting in your browser that tells websites not to share your data for ads. We honor it on our main pages and on the blog. When your browser sends it, no ad tag loads, Google Analytics stays off, the cookie banner stays hidden, and the visit counter stays off. The Privacy choices panel shows every switch off. We do not store the signal, so if you turn GPC off, your own saved choices apply again.
One place differs. The Help pages do not load the visit counter; Google Analytics counts their visits, under the rules above.
CareHaven is designed for caregivers — adults logging care on behalf of a person they're responsible for. The app does not target users under 13 directly. Our Terms say you must be 18 or older to use the app. The care records about a person (your child, your aging parent, your sibling) are yours as their caregiver. Today, we don't have access to the care log stored on your device or in your private iCloud.
If you're a minor caregiver yourself (e.g., a teen sibling), please set the app up with a parent or guardian. CareHaven is built for adults 18 and older, as our Terms say. Your care log is kept on your device, or in your own iCloud if you turn on sync, and we can't read it. If you turn on Apple Calendar sync, appointments are also copied to a calendar account on your iPhone, such as iCloud, Google or Outlook. Feedback, Online help, and lookups can still send a piece of what you type or a saved code, so please skip those unless a parent is with you. This website is not meant for children, and its ad cookies stay off unless a visitor clicks Allow.
For the app, most requests to see, fix, or delete information don't apply. We hold care records only when you choose to send them to us, so there's usually nothing on our end to see, fix, or delete. What we may hold is feedback you send, and anything else you send us yourself, such as an email, a PDF or summary, or an Emergency Snapshot. Email privacy@carehaven.org. Tell us what you sent, about when you sent it, and which of our addresses you sent it to, such as support@carehaven.org. For feedback, also tell us roughly what the note said. The app doesn't attach your email address to that note, so we need those details to look for it. For this website, Google Analytics holds data about your visits while it is on for you, and ad partners hold data about your visit only if you clicked Allow. You can turn either off at any time in Privacy choices and clear cookies in your browser, and you can email privacy@carehaven.org and we will help you reach the partner. If you joined the launch list, we hold your email address, your first name if you gave one, the signup-source code described above, and when you signed up. To remove that:
To stop the signup form from being abused, our server also keeps short-lived counters. Each one is keyed by a scrambled, one-way version (a hash) of an email address that tried to sign up, and one more counter covers the whole site. They exist even when a signup fails or is rejected. They hold only timestamps, never the address, your name, or your IP address. They are stored outside the public web folder (the part of our hosting that visitors can reach). A counter stops counting after one day, and any counter more than two days old is deleted automatically the next time someone uses the signup form. We don't keep any counter per IP address today.
If you delete the app from your device, the local store goes with it. If you have sync enabled, you can delete synced data from your device's Settings (Manage Account Storage → CareHaven).
If we ever change the privacy posture in a meaningful way (change diagnostic collection, change what's collected, add ads, etc.), we'll:
We do not plan to change what the app collects. The privacy-first stance of the app is the product, not a feature we'd compromise.
CareHaven is a tracking and coordination tool. It is not FDA-approved, not regulated as a medical device, and shouldn't be used to diagnose or make medical decisions. The app makes this disclosure inline (Settings → About & Help → Terms & Privacy) and on the homepage. Always consult your healthcare provider.
Questions, complaints, or requests: reply to any CareHaven email, or email us at privacy@carehaven.org. We read every message.