CareVocal is not a medical device. It does not diagnose, triage, or give medical advice. It records what you choose to log about how you feel and helps you share that record with your own doctor and family.
CareVocal is built and published by Ambermind Studio. For any privacy question, or to ask about the data described here, contact ambermindstudio@gmail.com.
| Data | Why |
|---|---|
| Check-in entries: how you felt, the time, a note, which language you spoke, and who logged it | The health record itself, and the doctor-visit summary built from it |
| Transcripts of what you said in a voice check-in | So the summary carries your own words, not just counts |
| Voice recordings, for check-ins that take the cloud route | Either the device cannot transcribe that language offline, or — for "Need Help" check-ins — we keep the recording on purpose, so the most serious moments survive as your own voice and not only as text. The recording stays on the phone until you delete the check-in. |
| Patient profile: name, age, conditions, blood type | Shown on the doctor summary. Entirely local — there is no login and no server-side account |
| Trusted contact numbers you enter | To pre-fill the alert message you send yourself |
This database is encrypted at rest with SQLCipher. The encryption key is generated randomly on your device, sealed with a key held in the Android Keystore (hardware-backed where your phone supports it), and never leaves the phone. Automatic Android backup is switched off for this app, so your health data is not copied to Google Drive.
Uninstalling CareVocal deletes all of it — entries, transcripts, recordings, and profile. There is no copy anywhere else for us to hold.
Which route a check-in takes decides whether any audio exists at all.
If you reject a transcript — "That's not what I said" — the wrong text is deleted, not kept alongside a correction. A sentence you have disowned should never reach your doctor.
| What | Who receives it | Why |
|---|---|---|
| Voice recordings from the deferred route, plus the language spoken | Our own transcription proxy (Cloudflare Workers), which forwards to Google's Gemini speech-to-text API | To convert speech to text. We use a paid API tier specifically because it does not permit the provider to train models on submitted data. The audio is not retained by the provider beyond producing the transcript. |
| A device attestation token | Google Firebase App Check | To prove the request came from a real installation of CareVocal, so the transcription service cannot be abused by others. No health data is involved. |
| Purchase and subscription status, an app-generated anonymous user ID, and basic device information | RevenueCat | To manage the optional paid upgrade (extended history) and restore it on a new device. No health data, no transcripts, no recordings. |
| If you enter a family code: that code (which is the referring subscriber's anonymous user ID) and your own anonymous user ID | Our own proxy (Cloudflare Workers), which passes them to RevenueCat | To check the code and give your family the free extended-history period, and to credit the family that referred you. The proxy stores nothing; RevenueCat keeps a count of how many families each subscriber has referred. |
| A notification subscription ID and push token; the date and time of your last check-in and your current streak (a count of days, never what you logged); the language reminders should be written in; when the app is opened and whether a reminder or in-app message was opened; purchases made in the app; basic device information such as model, Android version and time zone | OneSignal | To send check-in reminders at a sensible hour in your own time zone and language, to stop reminding you after a week without check-ins, and to show a short message after milestones such as 14 days of check-ins. This is sent after each check-in whether or not you allow notifications, so reminders can start the moment you allow them; nothing is ever shown on your lock screen unless you do. Reminders never contain your health details. |
No check-in entry, transcript, profile field, or contact number is transmitted anywhere except as described in this table. Logging always works fully offline; nothing is uploaded at the moment you tap a button.
CareVocal does not request, collect, store, or transmit your location — including in the emergency alert message. The app declares no location permissions.
The red flow does three things, in this order: it records the entry, it opens your messaging app with an alert already written out to your trusted contacts, and it opens your phone dialer with the emergency number already typed in. You tap send. You tap call. CareVocal never sends a message or places a call on its own. The alert contains a fixed message and the time — no location, no transcript.
When you share a summary, CareVocal renders it as an image and hands it to whichever app you pick — usually WhatsApp. That is your action and your choice of recipient. Once it leaves CareVocal, the image is governed by that app's privacy policy, not this one. A copy is written to the app's private cache to make the share possible.
CareVocal does not request permission to send SMS or place calls. It hands the message and the number to your own apps instead, so the final action is always yours.
Everything stays on your device until you delete the check-in, uninstall the app, or clear its storage; we set no expiry, because a health record is worth more the longer it runs. Recordings sent for transcription are processed and not retained by the transcription provider afterwards. If you buy the upgrade, RevenueCat keeps your purchase record for as long as needed to honour and restore it.
CareVocal (published by Ambermind Studio) keeps your health record on your own phone, so most deletion is something you do directly and it takes effect immediately.
Because none of that is held on a server, these actions are complete deletions — there is no copy left anywhere for us to hold.
Email ambermindstudio@gmail.com from any address, with the subject "Delete my data". Tell us roughly when you installed CareVocal so we can locate the right records. We will confirm and complete the deletion within 30 days.
| Data | What happens |
|---|---|
| Check-ins, transcripts, voice recordings, patient profile, trusted contacts | Deleted immediately when you delete the entry, clear storage, or uninstall. Held only on your phone, never on a server. |
| Voice recordings sent for transcription | Nothing to delete. The copy sent for transcription is used to produce the text and not retained afterwards. |
| Purchase record and the anonymous ID that restores it (RevenueCat) | Deleted on request by email. Otherwise kept for as long as needed to honour and restore a purchase you have paid for. |
| Reminder data held by OneSignal: notification token, last check-in time, streak, reminder language, app and message opens | Deleted on request by email. Turning notifications off or uninstalling stops every reminder straight away; the record itself stays with OneSignal until you ask us to delete it. |
| Family-code referral count (RevenueCat) | Deleted on request by email, together with the purchase record. |
We keep no other retained copy of your data, and there is no additional retention period beyond what this table describes.
Depending on where you live, you may have rights under laws such as India's Digital Personal Data Protection Act, 2023 or the GDPR to access, correct, or erase your personal data. Because your health data is held on your own device and not on our servers, you can exercise most of these directly in the app.
CareVocal is intended for adults. It is not directed at children under 18, and we do not knowingly collect data from them. An adult may log entries on behalf of a family member they care for.
The local database is encrypted; recordings are held in app-private storage that other apps cannot read; all network traffic uses HTTPS; API keys live on our server, never inside the app. No system is perfect, but health data is treated as the most sensitive category here, and the architecture keeps it on the device by default.
If what CareVocal collects changes, this page is updated before the change ships, and the date at the top changes with it.
Ambermind Studio · ambermindstudio@gmail.com