Privacy policy

Carefolio Privacy Policy Effective September 16, 2026. 1. Who is responsible Carefolio (carefolio.us) is operated by Channing Bredley, based in Ohio, United States. In this policy, “Carefolio,” “we,” and “us” mean that operator. Contact info@carefolio.us with privacy questions or requests, using “Privacy request” in the subject line. Do not include passwords or medical records in your request. This policy covers our professional directory, specialist websites, accounts, credential-review process, enquiry forms and support services. Individual professionals are separately responsible for information they receive and their own practice privacy obligations. This policy does not govern their external websites, booking services or clinical records. 2. Information we collect Account information: name or practice name, email address, a protected password hash, email-confirmation status, account settings and a record of acceptance of our terms. We do not store account passwords in readable form. Professional information: profile name, photograph, cover image, professional title, specialty, biography, services, qualifications, languages, consultation format, location, practice address, availability, opening hours, fees, team descriptions, FAQs, contact details and external booking links that you choose to provide. We retain draft information separately from the version approved for publication. Credential-review information: credential name and number, issuing authority, jurisdiction, expiry date, uploaded evidence, submission history, review decisions and review notes. Administrators may compare this information with professional registries or obtain confirmation from an issuing organization. Provide only evidence needed for the review. Redact unrelated identifiers, financial details, patient information and other unnecessary personal information. Messages: when you contact a professional, we collect the name, email address and message you submit, the selected professional and the message date and status. Support requests and profile reports also include their category, relevant profile, status and administrative notes. Technical and security information: our application and hosting services process IP addresses, browser/device information, request and error logs, timestamps, session identifiers and security events. We also maintain administrative audit records, notification records and basic profile visit counts. A session indicator helps avoid counting repeated profile views within the same session; this is not a unique-person count. 3. Why we use information We use information to operate accounts; authenticate users; review credentials; publish approved professional websites; provide directory search; deliver enquiries to the selected professional; answer support requests; investigate reports; prevent misuse; maintain security; troubleshoot problems; send essential account and service messages; manage renewals and publication status; and meet applicable legal obligations. We do not sell personal information, use it for targeted advertising or provide it to advertisers. Carefolio does not use credential documents or enquiries to train a general-purpose AI model. Our current platform does not process subscription payments or store payment-card information. Any material change to these practices will be addressed before the new use begins, including consent where required. 4. What becomes public After approval, the approved version of your professional profile and its public images and contact details can be viewed by anyone, indexed by search engines and shared through its URL. Choose public contact information carefully. Credential uploads, private credential numbers, private review notes, account passwords and visitor enquiries are not published on your profile. Saving changes does not immediately replace an already approved public version. That version may remain visible while proposed changes await review. You can pause your profile to remove it from public view. Search engines and independent third parties may retain earlier copies after a page changes or is removed; we cannot directly control those copies. 5. Who can receive information Professionals receive enquiries addressed to their practice. Their use of a received enquiry is subject to their own obligations. An email notification alerts the professional to sign in; the current notification does not include the enquiry message itself. A professional may later reply through their own email service, which is outside the Carefolio inbox. Authorized Carefolio administrators access private credential documents for review and related support or investigations. Other professionals, visitors and the uploading account cannot download those documents through the application. Authorized technical personnel may need limited infrastructure access to operate or secure the service. Hostinger provides our website hosting, database, file storage and email infrastructure. Relevant infrastructure providers process information to operate these services. They are not public recipients of your credential documents. Data may be processed outside your state or country depending on the infrastructure and support involved; the operator’s Ohio location does not mean all servers are in Ohio or the United States. We may provide the minimum relevant credential details to an issuing authority to confirm authenticity. We may also disclose information when legally required, to investigate fraud or threats, protect rights and safety, or respond to valid legal process. If operation of Carefolio transfers to another operator, personal information may transfer subject to applicable law and appropriate notice; the recipient must address any changed use through an updated notice and consent where required. 6. Health information and enquiries Carefolio is a professional directory and website platform. It is not an emergency service, patient portal or medical-record system. Use enquiry forms for general availability, services and contact arrangements. Do not submit symptoms, diagnoses, treatment history, test results, insurance identifiers, payment details or medical records. Ask the practice how to communicate sensitive information securely. Even a general enquiry to a specialist may reveal an interest in a health service. We use the enquiry to deliver the contact request, provide support and protect the service, not for advertising or health profiling. If you submit sensitive information despite this instruction, it is stored and delivered as part of the message; the warning does not remove our responsibilities toward it. Contact info@carefolio.us if information needs to be removed. We will also explain when you need to contact the professional about copies they hold independently. We do not represent that every use of Carefolio is covered by HIPAA. Whether healthcare privacy laws apply depends on the information and relationships involved. Professionals must not use this service to store or exchange patient records on behalf of a healthcare organization without an appropriate, separately evaluated arrangement. 7. Cookies and similar technologies Carefolio uses first-party cookies and server-side sessions to maintain sign-in, protect forms against forgery, remember temporary interaction state and support basic session-based visit counts. Blocking these cookies can prevent sign-in or forms from working. Our current application does not include advertising pixels or third-party behavioral analytics. Hosting security services may process request data to protect the site. External sites linked from a profile have their own cookie practices. 8. Retention and deletion Account and profile information remains while the account is active. Deleting an ordinary professional account removes its account record, profile, associated credential uploads, profile images, profile enquiries, sessions and account notifications from active application storage. Administrators cannot use the ordinary self-service account-deletion function; contact the operator for these requests. Credential documents otherwise remain with the account while needed to support review and publication. Pausing, rejection or suspension does not automatically erase them. Administrators can remove a document when its profile is neither live nor pending review, subject to applicable obligations. The current scheduled cleanup removes practice enquiries more than 365 days after creation; closed support/report tickets more than 365 days after their last update; and read notifications more than 180 days after creation. Archiving an enquiry changes its status, not its retention period. Unread notifications and open tickets remain until resolved, deleted with the relevant account where applicable, or otherwise removed. Some support records and administrative audit records may remain independently of account deletion for security, complaint handling or legal reasons. Application audit records currently have no automatic expiry. Hosting logs and backup copies follow the hosting service’s retention settings. Deletion from the active application is not instant deletion from every backup or independent recipient’s system. Backup copies should be restricted to recovery and security purposes, and deletion requests must be reapplied if a backup is restored. We will explain relevant retention limitations when responding to your request. 9. Your choices and requests Professionals can edit their account and draft profile, pause publication, export available account/profile/enquiry data and request account deletion through account settings. Password confirmation is required for sensitive actions. The self-service export does not download private credential files or all administrative records; contact us for other access requests. Visitors and professionals may email info@carefolio.us to request access, correction or deletion, ask about recipients or retention, or raise a privacy complaint. We may ask for proportionate information to verify identity and authority. We will not request your password. We will respond within the deadlines that apply to the request and explain any lawful limitation, extension or refusal. Where applicable, you may use an authorized agent, appeal a decision by replying with “Privacy appeal,” withdraw consent for future optional processing, or complain to the relevant regulator. We will not penalize you for exercising applicable privacy rights, although deleting information needed to provide a feature may end that feature. 10. Children Professional accounts and enquiry forms are intended for adults aged 18 or older. An adult seeking services for a child should contact the practice without entering the child’s medical or identifying details here. Carefolio is not directed to children under 13. If we learn that we have collected a child’s information contrary to applicable requirements, we will take appropriate steps, including deletion where required. Contact us if this occurs. 11. Security and policy changes Measures include HTTPS, password hashing, protected sessions, restricted credential-download routes, administrator email verification codes and access controls. No service can guarantee complete security. Notify info@carefolio.us promptly about a suspected account compromise or data exposure; do not send sensitive evidence through a public profile. We investigate incidents and provide notices required by applicable law. We will update this policy as practices change and show its effective date. For material changes, we will provide an appropriate notice and obtain additional consent where required. Contact: Channing Bredley, Carefolio, Ohio, United States; info@carefolio.us.