Privacy Policy

Introduction

POPS (Personal Organizer for Parental Support) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and web services.

Information We Collect

Personal Information

When you use POPS, we may collect:

• Name and email address (through Google OAuth or Apple Sign-In)
• Profile information for care recipients (names, photos, relationships)
• Contact information you store (healthcare providers, family members, etc.)
• Documents you upload (medical records, legal documents, etc.)
• Notes and tasks you create
• Audio recordings and their transcriptions (when you use voice notes)

Usage Data

We automatically collect certain information about your device and usage:

• Device information (model, operating system, unique device identifiers)
• Log information (access times, app features used, crashes)
• IP address and general location information

Health Records from Connected Services

If you choose to connect your Epic MyChart account, we may access and store health information including:

• Medications and prescriptions
• Medical conditions and diagnoses
• Allergies and adverse reactions
• Vital signs (blood pressure, heart rate, etc.)
• Laboratory test results
• Immunization records

This data is accessed via secure FHIR (Fast Healthcare Interoperability Resources) APIs with your explicit authorization. You can disconnect your health records at any time through the app settings.

Camera and Microphone Access

We request camera access for document scanning and photo uploads. Microphone access is requested for voice note recordings. These permissions are only used when you actively engage these features.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the POPS service
• Store and organize your personal caregiving information
• Synchronize your data across devices
• Process and store documents, notes, and tasks
• Power the AI features described below (Ask POPS, document reading, voice-note transcription, care reports), only after you turn AI features on
• Authenticate your identity and manage your account
• Send you technical notices and support messages
• Analyze usage patterns to improve our services

Data Storage and Security

Your data is stored securely on Google Cloud Platform (GCP) servers located in the United States. We implement industry-standard security measures including:

• Encryption in transit (TLS/HTTPS)
• Encryption at rest for stored data
• Secure authentication via OAuth 2.0
• Regular security audits and updates
• Access controls and monitoring

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Third-Party Services

POPS integrates with the following third-party services:

Authentication

• Google OAuth: For user authentication and optional Google Calendar integration
• Apple Sign-In: For secure iOS authentication

Cloud Infrastructure

• Google Cloud Platform: For hosting, storage, and database services
• Google Cloud Storage: For document and media file storage

Health Record Integration

• Epic MyChart: For accessing and syncing health records from participating healthcare providers via FHIR APIs

These services have their own privacy policies. We encourage you to review them:

• Google Privacy Policy: https://policies.google.com/privacy
• Apple Privacy Policy: https://www.apple.com/privacy
• Epic Privacy Policy: https://www.epic.com/privacy

AI Features and Third-Party AI Providers

POPS has optional AI features. They are off until you turn them on, and we ask for your permission in the app before anything you create is sent to an AI provider. You can turn them off at any time under Settings → Privacy & Data (mobile) or Settings → Preferences (web).

What the AI features do

• Ask POPS: answers questions about the profiles you manage
• Document reading: reads uploaded documents and scans (OCR) so they can be searched and summarized
• Voice-note transcription: turns your recordings into text
• Care reports: generates summaries and estate-planning reviews
• Extraction: pulls medications from prescription scans, contact details from business cards, and item details and value estimates from inventory photos
• Search: creates embeddings of notes, contacts, tasks and documents so similar items can be found

What is sent

Only what the feature you use needs, and only while AI features are on:

• The question you type and recent messages in that conversation
• Relevant profile information (names, relationships, medications, health records, contacts, notes, tasks, calendar entries) so the answer is about your care recipient
• The document, scan, photo or voice recording you ask POPS to read, transcribe or analyze
• The text of notes, contacts and tasks you create, for search embeddings

Documents in the Sensitive Vault are encrypted with your passphrase and are never sent to an AI provider.

Who it is sent to

We route each feature to one of these providers. Which one handles a given feature can change as we tune quality and cost; the list below is everyone we may use.

• Google (Gemini): document reading (OCR), voice-note transcription, and some answers — https://policies.google.com/privacy
• xAI (Grok): Ask POPS answers and in-app help chat — https://x.ai/legal/privacy-policy
• OpenAI: search embeddings and some answers — https://openai.com/policies/privacy-policy
• Anthropic (Claude): some answers, reports and extraction — https://www.anthropic.com/privacy
• OpenRouter: a gateway we sometimes use to reach the models above and others — https://openrouter.ai/privacy

We use these providers under their business (API) terms, which do not permit them to train their models on your content and which require them to protect it at least as well as we do. We do not sell or share your content with any AI provider for its own purposes.

Your choice

If you do not turn AI features on, POPS still stores and organizes everything for you. Documents are kept but not read or summarized, voice notes are kept without a transcript, and Ask POPS is unavailable. Turning AI features off later stops any new content from being sent; content already processed stays in your account until you delete it.

Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in these circumstances:

Profile Sharing

When you explicitly share a care profile with others using our sharing features, the shared users will have access to information associated with that profile according to the permissions you grant.

Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Requests by law enforcement or government agencies
• Protection of our rights, property, or safety
• Emergency situations involving personal safety

Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice in the app.

Your Rights and Choices

Access and Correction

You can access, update, or delete most of your information directly within the POPS app.

Account and Data Deletion

You can delete your account yourself, without contacting us:

• iPhone app: Settings → Privacy & Data → Delete Account
• Web: Settings → Delete Account, or https://joinpops.com/delete if you are signed out

Deleting your account deactivates it immediately and removes your access. Everything you own (profiles, documents, contacts, notes, tasks, recordings) is deleted permanently after a 90-day recovery window, during which you can ask support@joinpops.com to restore it. People you shared profiles with lose access right away.

Data Export

You can download a copy of everything in your account as a ZIP file from Settings → Privacy & Data (mobile) or Settings → Download my data (web), or by emailing support@joinpops.com.

Marketing Communications

You can opt out of promotional emails by following the unsubscribe link in any marketing email.

California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to request deletion.

Children's Privacy

POPS is not intended for use by children under 13 years of age. We do not knowingly collect personal information from children under 13. If we discover we have collected information from a child under 13, we will delete it immediately.

International Users

POPS is operated from the United States. If you are accessing our services from outside the U.S., please be aware that your information will be transferred to, stored, and processed in the United States where our servers are located. By using POPS, you consent to this transfer.

Data Retention

We retain your information for as long as your account is active or as needed to provide services. If you delete your account, we delete your information after the 90-day recovery window described above, except where we are required to retain it for legal or regulatory purposes.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. We encourage you to review this Privacy Policy periodically.

Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

• Email: support@joinpops.com
• Subject Line: Privacy Policy Inquiry