Carli ("the app", "we") is a personal care companion for people going through hospitalization and recovery. Your health information is yours. This policy explains, in plain language, what we collect, why, and what we never do with it.
Account information. Your email address and password (stored only in hashed form by our authentication provider) and the profile details you choose to add (name, condition, care preferences).
Health and wellbeing information you enter. This is the heart of the app, and it is all voluntary: mood logs, symptom reports, medications and intake confirmations, calendar events and appointments, journal entries, sleep / hydration / nutrition / walking / breathing / meditation / yoga / art activity, questions for your doctor, support contacts and care-circle members, and health record documents you upload or scan (lab results, imaging reports, prescriptions and similar).
Conversations with Carli (the AI assistant). Messages you send to Carli, and the memory Carli keeps to help you (for example, your medication schedule). You can view an activity log of what Carli has done and delete Carli's memory at any time in Settings → Privacy.
Location, only when you use location features. If you allow it, we use your device location to find nearby providers (pools, studios, therapists) and to measure your walking sessions. Location is used for these features and is not shared with third parties for any other purpose.
Camera, photos and motion, only when you use those features. The camera scans documents into your health records and food barcodes; the photo library is used when you choose to attach a photo; the motion sensor counts steps during walking sessions.
What we do NOT collect. No advertising identifiers, no ad profiling, no contact-list upload, no background location tracking, and no sale of your data to anyone.
We measure how the app is used, so we can see what helps and what gets in the way. This is done through PostHog (US Cloud).
What is recorded: that a feature was used, and when — for example that Self-Care was opened, that a message was sent to Carli, that a symptom was logged or a document uploaded. These records are linked to your account's internal identifier, not to your name or email address.
What is not recorded: none of the content itself. A mood check-in is counted without the value; symptom, medication, document and journal events are sent with no detail at all — no symptom name, no dose, no filename, and no text from your journal or from your conversations with Carli. This is enforced in code, not only in policy: an event carrying free text or a personal identifier is blocked before it is sent.
The bottom line: we can see that a health feature was used and when, but never what was recorded in it. You can request a copy of this data, or its deletion, at help@carli.support.
Solely to provide the app's features to you: showing your own data back to you, powering reminders you set, and letting Carli assist you. Our AI features are powered by a large-language-model provider (Anthropic); the messages you send to Carli are processed to generate replies and are not used to train the model.
When you ask Carli to act on Clalit's website — to read your information there, to file your documents into Records, or to book or cancel a family-doctor appointment — you sign in yourself, with your own ID number, an SMS code sent to your phone and, when the site asks for it, the code from a picture. The SMS code and the picture code are not stored.
What Carli can read there, when you ask. Your appointments, lab results and lab orders, prescriptions and chronic medicines, referrals and their documents, diagnoses and measurements, vaccinations and sensitivities.
Where it goes. When you ask Carli to act on your health fund's website, the request goes through Browserbase, a secure browser service whose session runs through an Israeli address — only for the purpose of that action. What passes through it is what the action needs: the sign-in details you give for it, the requests to the fund's site, and what the site sends back. We turn off Browserbase's session recording and log retention for these sessions.
What is kept. Your ID number, encrypted, so that next time you do not have to type it again; and the login session at the fund's site, encrypted, for up to about 30 minutes, so that Carli does not ask you to sign in again for every action. Ask Carli to forget the site and both are deleted; deleting your account deletes them too.
What happens to the information. What is read from the fund's site is used to answer your request. Documents you ask Carli to file are saved into Records, like any document you add yourself — so care-circle members you have given access to Records can open them. Only your own information is downloaded and saved: documents and details of family members on the same fund account are not (at most, the task's receipt notes how many such items there were).
Nothing is booked or cancelled without your confirmation. Carli shows you the appointment she is about to book or cancel, and does nothing until you confirm.
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and encrypted file storage for your account and health data |
| Fly.io | Hosting for Carli's AI backend |
| Anthropic | Generating Carli's AI replies to your messages |
| Google (Places API) | Finding nearby providers when you search — a location and query is sent, never your identity or health data |
| Open Food Facts | Nutrition lookup when you scan a food barcode — only the barcode number is sent |
| PostHog (US Cloud) | Product usage data — which features were used and when, linked to your account's internal identifier; never your name, email, or anything you recorded |
| Expo | Delivering app updates and, if you enable them, notifications |
| OpenAI | Turning your search terms and the notes Carli keeps into the numerical form that lets her find them again — the text is sent to be converted and is not used to train the model |
| Sentry | Crash and error diagnostics, so we can fix what breaks. Not linked to your account, and it never carries anything you recorded |
| MedlinePlus (NIH) / openFDA | Looking up a medical term or a drug name so Carli can answer from a named source — only the term is sent, never your identity or your records |
| Anthropic (web search) | Running a search when Carli needs current or country-specific information — the medical term is sent; not your name, not identifiers, not your records |
| RevenueCat | Checking your subscription status. Your account identifier is sent on each launch on iOS, including during the pilot when nobody is charged |
| Browserbase | A secure browser service whose session runs through an Israeli address, used to perform an action you ask for on your health fund's website (today: Clalit). It receives the requests Carli makes to the fund's site, the pages and data the site returns during that action, and the login session needed to carry it out — only when you ask Carli to act on a health-fund site, and for nothing else. Session recording and log retention are turned off |
| YouTube / Spotify / Apple Music | Playing wellness content you choose — their own terms apply when content plays |
We do not sell or rent personal information to anyone, and we do not share your health information with data brokers, advertisers, insurers or employers.
Data is encrypted in transit (TLS). Health record files are stored in private storage and served through short-lived signed links. Database access is protected by row-level security, meaning your records are readable only by your authenticated account.
If you are in the EU/EEA, UK or Israel, you also have statutory rights of access, rectification, erasure, restriction and portability, which the mechanisms above are designed to honor.
Carli is not directed at children under 16. If you believe a child under 16 has created an account without a guardian's consent, contact us and we will delete it.
Carli is a supportive companion, not a medical device or a substitute for professional care. Always consult your care team about medical decisions.
If this policy changes in a meaningful way, we will note it in the app and update the effective date above.
© 2026 Carli · help@carli.support