Privacy Policy
Last updated 11 July 2026
Who we are
Dementia Online (dementiaonline.org) provides a family-facing photo book, calendar and care information app designed for people living with dementia and their families. In this policy, "we" refers to the app owner and "you" refers to the account holder.
What information we collect
- Account details — email address, name if provided, and authentication data (password hash or single sign-on identifiers when you sign in with Google or Apple).
- Care information you enter — name, preferred name and title, date of birth, address, phone and email if provided, communication needs, diagnoses and past medical history, allergies, medications, health-card numbers, likes and dislikes, what helps, diary notes, and uploaded documents such as hospital passports and advance care directives.
- Photos and voice notes uploaded to memory books or visitor messages.
- Contact details for family, GPs, emergency contacts, providers and guardians that you choose to store.
- Basic technical data — browser type, approximate time of access, and (for share links) a hashed record of access so you can see when a shared emergency or visitor link is used. We do not store raw IP addresses or full user-agent strings for this purpose.
How we store it
All account data, care information and uploaded files are stored in our managed backend (Lovable Cloud, powered by Supabase) with per-row access controls so that only your account can read your data. Files (photos, voice notes, documents) are stored in private buckets and served only through short-lived signed URLs.
To keep the app usable on tablets with poor connectivity, some content is also cached on your device using the browser's IndexedDB storage — for example, the slideshow, diary voice notes, and offline visitor recordings. Clearing your browser data removes this local cache.
What we do not do
- We do not sell your data or share it with advertisers.
- We do not send your medical or diary information to third-party AI services. AI features in the app are limited to non-medical utilities (for example, transcription of a voice memo you explicitly request); medical fields, documents and contacts are never sent to an AI provider.
- We do not embed EXIF/GPS metadata from your original photos in stored images — photos are re-encoded on your device before upload, and identifying metadata is stripped from PDFs.
Third parties who process data for us
- Lovable / Supabase — application hosting, database, storage and authentication.
- Stripe — subscription payments. We never see or store your card number; Stripe handles that directly under its own PCI-compliant terms.
- Transactional email provider — used to send account emails (sign-in, subscription receipts, visitor invitations you send). Email content is limited to what is needed for the message.
Share links (emergency, visitor and contribution)
You can generate private links that show a limited view of your care information — for example, an emergency summary for paramedics, or a visitor page for a family member. These links:
- expire automatically (emergency links after 72 hours by default);
- can be revoked at any time from the My Care section;
- record a hashed access log so you can see how many times a link has been opened and revoke it if it has been forwarded.
Retention and deletion
Care information is kept for as long as your account is active. You can delete individual entries, documents, contacts, photos and voice notes from within the app at any time. If you close your account, contact us at nicole@dementiaonline.org and we will delete your data from our systems within 30 days, except where we are legally required to retain billing records.
Your rights
Depending on where you live, you may have rights to access, correct or delete your personal information, to receive a copy of it in a portable format, or to object to certain processing. Email nicole@dementiaonline.org to exercise any of these rights. Because the app handles special-category health data, we may ask you to verify your identity before acting on a request.
Children
The app is intended to be operated by adult family members or carers. It is not intended for use by children under 16 as account holders.
Changes to this policy
If we make material changes, we will update the "Last updated" date above and, for significant changes, notify account holders by email before the change takes effect.