RockyCareCare · Together

Privacy Policy

Effective date: July 29, 2026 · Last updated: July 29, 2026

Caregiving is deeply personal. When you use RockyCare, you're trusting us with information about you and someone you love — and we don't take that lightly. This policy explains what we collect, why we collect it, who can see it, and the choices you have. If anything is unclear, please reach out.

1. Our promise to you

RockyCare ("RockyCare," "we," "us," or "our"), a service of ArrayLink, provides a caregiving platform at rockycare.arraylink.ai(the "Service") that helps families track medications, appointments, and daily notes for a loved one. Because caregiving involves sensitive information, we hold ourselves to a higher standard than a typical app:

  • We don't sell your personal information. Not to advertisers, not to data brokers, not to anyone.
  • Your mobile number and SMS consent are never shared for marketing.
  • Care recipient data is treated as confidential. Only you and the caregivers you explicitly invite can see it.
  • You're in control. You can view, export, correct, or delete your data at any time.
  • We use industry-standard security including encryption in transit (TLS 1.2+) and encryption at rest.

2. Scope and your responsibilities

This Privacy Policy applies to information we process in connection with the Service. It does not apply to information collected by third parties whose services you separately use (for example, Google or your wireless carrier), even if you access them through the Service.

You are responsible for the information you submit about yourself and about any care recipient. By using the Service, you represent and warrant that you have all rights, authority, and consents necessary to submit that information and to receive the communications you choose to enable. RockyCare relies on that representation and has no independent duty to verify it.

3. Information we collect

We collect only what we need to run the Service:

Information you give us

  • Account information: your name, email address, mobile phone number, and password (stored as a salted hash — we never see your actual password).
  • Care recipient details you add: name, age, relationship, doctor and pharmacy info, medications, schedules, and any notes you choose to record.
  • Consent records: whether you opted in to SMS, whether you accepted the Terms and Privacy Policy, and the date and time you did so.
  • Messages you send us through the contact form, email, or SMS.

Information collected automatically

  • Device and log data: IP address, browser type, operating system, referral URLs, and pages viewed — used only for security, debugging, and analytics.
  • Session cookies to keep you signed in.

Information from third parties

  • If you sign in with Google, we receive your name, email, and profile picture from Google — nothing more. We do not receive access to your Google contacts, Drive, or calendar.

4. How we use your information

We use your information to:

  • Create and manage your RockyCare account.
  • Send care notifications, prescription alerts, appointment reminders, and account updates — by in-app notification, email, or (if you opted in) SMS.
  • Provide the caregiving features you use: medication schedules, notes, doctor contact info, and shared care updates.
  • Respond to your support requests and improve the Service.
  • Detect, prevent, investigate, and respond to fraud, abuse, security incidents, and violations of our Terms.
  • Comply with legal, regulatory, and audit obligations.
  • Enforce our agreements and protect the rights, property, or safety of RockyCare, our users, or others.

We do notuse your care data or your loved one's information to train advertising models, and we do not sell it.

5. Aggregated and de-identified data

We may create de-identified or aggregated data from your information — for example, statistics about medication adherence in the aggregate, feature usage, or performance benchmarks. Aggregated and de-identified data does not identify you or any care recipient, and we may use, retain, and share it for any lawful purpose, including improving the Service, publishing insights, and business planning. We contractually prohibit any recipient of such data from attempting to re-identify it.

6. SMS messaging and consent

When you opt in during sign-up by checking the SMS consent box and providing your mobile number, you consent to receive recurring text messages from RockyCare, including:

  • Care notifications
  • Prescription and medication reminders
  • Appointment reminders
  • Account and security updates

Message frequency varies based on your care activity. Message and data rates may apply from your wireless carrier. Reply HELP for help or STOP at any time to unsubscribe. After you reply STOP, we will send one confirmation message and then stop sending SMS to that number.

Mobile information sharing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, is permitted. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7. How we share information

We share personal information only in these limited situations:

  • With service providerswe engage to run the Service (see "Service providers we rely on" below). They are contractually bound to use your data only to provide services to us.
  • With people you invite to co-manage care for the same loved one, and only to the extent you enable sharing.
  • To comply with the law or a valid legal process (see Section 9).
  • To protect rights and safety of RockyCare, our users, or others, or to prevent fraud or abuse.
  • In a corporate transaction, such as a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, in which case information may be transferred as part of the transaction subject to standard confidentiality protections.
  • With your consent, for anything else.

We do not sell your personal information. We do not share it with advertisers, data brokers, or affiliates for marketing or cross-context behavioral advertising.

8. Service providers we rely on

To run RockyCare we use a small number of trusted vendors, each covered by a data-processing agreement that limits their use of your data:

  • Cloud hosting and database — to store account and care data.
  • Authentication— Google, for "Sign in with Google."
  • SMS delivery — Twilio, to send text messages you opted in to receive.
  • Email delivery — to send account and support emails.
  • Error monitoring and analytics — to detect bugs and improve reliability.

You can request the current list of vendors and their roles at any time by contacting us. We may update this list from time to time without prior notice.

10. No HIPAA covered-entity relationship

RockyCare is designed for individual caregivers and family members, not for use by covered entities under the Health Insurance Portability and Accountability Act ("HIPAA"). RockyCare is not acting as a "covered entity" or "business associate" under HIPAA, and no business-associate agreement is created by these Terms or by your use of the Service. You must not submit protected health information on behalf of a covered entity without our prior written consent.

11. How we protect your information

  • Encryption in transit: traffic to and from the Service is encrypted with TLS 1.2 or higher.
  • Encryption at rest: databases and backups are encrypted using industry-standard algorithms.
  • Password handling: passwords are stored as salted bcrypt hashes; nobody at RockyCare can read your password.
  • Least-privilege access: only a small number of authorized personnel can access production data, and only for legitimate support or engineering reasons, with logging.
  • Regular reviews: we review access controls, dependencies, and vendor security on an ongoing basis.

No system is 100% secure, and we cannot and do not guarantee the absolute security of any information. You use the Service at your own risk and are responsible for maintaining the security of your own devices and credentials.

12. How long we keep your data

We keep your data only as long as we reasonably need it to provide the Service or as required by law:

  • Account data is kept until you delete your account.
  • Care recipient data is kept until you delete the recipient or your account.
  • Consent records (SMS opt-in, Terms/Privacy acceptance) are retained for at least four (4) years to comply with telecom and consumer-protection laws.
  • Logs and backups are retained for a limited period (typically up to 90 days) and then automatically purged on our normal rotation.

When you delete your account, we remove your personal data from live systems within 30 days, and from backups on the normal backup rotation. We may retain de-identified or aggregated data indefinitely.

13. Your rights and choices

You have the right to:

  • Access the personal information we hold about you.
  • Correctanything that's inaccurate.
  • Delete your account and associated data.
  • Export a copy of your data in a machine-readable format.
  • Opt out of SMS at any time by replying STOP, or opt out of marketing emails via the unsubscribe link.
  • Withdraw consent for optional processing at any time.

To exercise any of these rights, contact us. We will respond within the time period required by applicable law (typically 30–45 days). We may need to verify your identity before responding to protect your account, and we may decline or narrow requests where doing so is permitted by law (for example, where fulfilling the request would compromise legal, regulatory, or security obligations).

14. U.S. state privacy rights

Depending on where you live (including California, Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws), you may have additional rights, including:

  • The right to know what categories of data we process.
  • The right to opt out of the "sale" or "sharing for cross-context behavioral advertising" of your personal information — RockyCare does not do either.
  • The right to limit the use of "sensitive personal information."
  • The right to appeal a denied privacy request.

To exercise these rights, contact us with the subject line "State privacy request." We will verify your identity before responding.

15. Children's privacy

The Service is intended for adults 18 and older who provide care for a loved one. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

16. International users

The Service is hosted in the United States and is intended for U.S. users. If you access the Service from outside the U.S., you consent to the transfer of your information to, and processing in, the United States, which may have different data-protection laws than your country. You are responsible for complying with any laws applicable to your own use of the Service.

17. Cookies and analytics

We use only the cookies we need to run the Service — primarily a secure session cookie to keep you signed in, and a small number of first-party analytics cookies to understand aggregate usage and catch errors. We do not use third-party advertising cookies or cross-site tracking. You can block cookies in your browser, though this may prevent sign-in or other features from working.

18. Security incidents

In the event of a data breach that affects your personal information, we will notify you and any applicable regulators to the extent required by applicable law, within the time frames required by that law. Nothing in this policy creates a contractual notification obligation beyond what applicable law requires.

19. No warranty on privacy practices

We work hard to protect your information, but no product, policy, or safeguard can guarantee absolute privacy or security. To the maximum extent permitted by law, RockyCare disclaims all warranties, whether express, implied, or statutory, regarding the outcomes of our privacy practices, including any warranty that unauthorized access, disclosure, or loss will not occur. Your remedies for any privacy or security incident are limited to those provided in our Terms and Conditions.

20. Changes to this policy

We may update this Privacy Policy from time to time as we add features or as laws change. When we make material changes, we will update the "Effective date" at the top and, for significant changes, notify you by email or in the app before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy. If you do not agree, you must stop using the Service.

21. Contact us

Questions, concerns, or privacy requests? We want to hear from you.

← Back to sign upRead our Terms and Conditions →