ViaraThis Privacy Policy describes how IndicWave LLC ("we", "us", or "our"), the operator of Viara, collects, uses, discloses, and safeguards your personal information when you access or use the Viara mobile application and related services (collectively, the "Service"). For the purposes of applicable data protection law, IndicWave LLC is the controller of the personal information described in this Policy.
If you are a resident of California, Washington, Nevada, or Connecticut, please also review our Consumer Health Data Privacy Notice, which describes how we handle consumer health data as required under those states' laws.
1. Scope of this policy
This Policy applies to personal information we collect from account holders and the individuals they invite into their care circle. Viara accounts are created and controlled by adults. When you add a profile for a child or another dependent, you do so as their parent or legal guardian, and you are responsible for the accuracy and lawfulness of the information you enter about them. Dependents do not create their own accounts or log in.
2. Information we collect
We collect the following categories of personal information:
- Account information: name, email address, phone number, and a password (stored as a salted, one-way hash and never in plain text).
- Health and care information you choose to enter about the people in your care: medications, conditions, allergies, vital signs, immunizations, growth and developmental milestones, lab results, insurance details, appointments, care notes, uploaded documents, and, if you choose to record them, advance directive status (DNR, POLST, living will, healthcare power of attorney).
- Communications: messages you and your care team send to one another within the Service.
- Device and technical information: a push-notification token, if you enable notifications, and standard session and security identifiers.
We do not collect precise or approximate geolocation information. We do not access your microphone, camera, or photo library except when you deliberately take or upload a photo or scan a document. We do not operate advertising networks, embed third-party analytics or tracking software, or purchase information from data brokers.
3. How we use your information
We use your personal information solely to provide, maintain, and secure the Service, including to:
- create and authenticate your account and enable sign-in;
- store and organize the care information you enter and display it to the members of your care circle according to the permissions you set;
- deliver messages and the appointment or reminder notifications you request;
- protect the security and integrity of the Service, investigate misuse, and prevent fraud or abuse;
- comply with applicable legal obligations and respond to lawful requests.
We do not use your personal information for advertising or marketing, and we do not sell or rent your personal information to anyone. We do not engage in cross-context behavioral advertising, and we do not use your personal information to make automated decisions that produce legal or similarly significant effects about you.
4. Legal bases for processing
Where applicable law requires a legal basis, we process personal information on the following grounds:
- Performance of a contract: to provide the Service you request;
- Legitimate interests: to secure the Service and prevent fraud or abuse, where those interests are not overridden by your rights and freedoms;
- Legal obligation: to comply with applicable laws and regulations;
- Consent: where you have given consent, such as enabling notifications or sharing information with your care circle. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. How we disclose your information
We disclose personal information only as described below:
- Care circle members: to the specific individuals you invite into a person's care circle, limited to the permissions you grant them and revocable by you at any time.
- Service providers: a limited number of infrastructure providers process data on our behalf under written contract, including cloud storage for uploaded documents and an email provider for account and appointment notifications. These providers do not use your information for their own purposes.
- Sign-in providers: if you choose "Sign in with Google" or "Sign in with Apple," those providers confirm your identity to us. They do not receive your health or care information.
- Push-notification delivery: if you enable notifications, reminder and appointment notifications are delivered through Expo's push-notification service, which relays them through Apple's and Google's push infrastructure. A notification may include the content of the reminder itself (for example, a person's name or an appointment reason). These providers see only the notification text; they do not have access to the rest of your account.
- Legal and safety: we may disclose information when required by law, in response to a valid legal process, or to protect the rights, property, or safety of IndicWave LLC, our users, or others.
- Business transfers: in connection with a merger, acquisition, or sale of assets, personal information may be transferred, subject to this Policy.
We do not sell, rent, or share personal information with advertising networks or data brokers.
6. Data retention
We retain your personal information only for as long as necessary to provide the Service and for the purposes described in this Policy. When you delete your account, we delete your personal information immediately and permanently. A limited amount of anonymized record-keeping data may be retained where necessary to preserve the integrity of records you shared with other family members (for example, so a note you wrote does not silently disappear from another member's history). Any such retained data cannot be linked back to you.
7. Security
We implement technical and organizational measures designed to protect your information. Data is encrypted in transit and at rest. Passwords are stored as salted hashes and are never retained in plain text. Two-factor authentication (TOTP) is optional and available on every account, and TOTP secrets are separately encrypted at the application level. Uploaded documents are scanned for malware before they are made available. You may review and revoke active sessions at any time from Settings → Security.
No method of transmission or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee its absolute security.
8. Your rights and choices
Depending on your jurisdiction, you may have some or all of the following rights:
- Access and portability: request access to, and a copy of, your personal information in a portable format;
- Correction: request correction of inaccurate or incomplete personal information;
- Deletion: request deletion of your personal information;
- Restriction and objection: request restriction of, or object to, certain processing;
- Non-discrimination: exercise your rights without being subject to discriminatory treatment.
From Settings → Privacy you may, at any time, export a complete copy of your family's data in JSON format or delete your account permanently and immediately. You may also request executor access if you are the legal representative of a deceased family member.
California residents: under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), you have the right to know, access, correct, and delete your personal information. We do not sell or share personal information as those terms are defined under the CCPA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA.
EEA, UK, and Swiss residents: under the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, restrict, and port your personal information, and to object to processing. You also have the right to lodge a complaint with your local supervisory authority.
To exercise any of these rights, contact us at support@viara.io. We will respond within the timeframes required by applicable law and may verify your identity before processing a request. If we decline a request, we will explain why and, where applicable, inform you of your right to appeal.
9. Children's privacy
The Service is not directed to children, and children do not use Viara directly or create their own accounts. Profiles for minors are created and managed exclusively by a parent or legal guardian, who confirms this when creating the profile. If you believe a child has provided us personal information directly, without a guardian's involvement, contact us at support@viara.io and we will promptly investigate and delete it.
10. Cookies, analytics, and tracking
Viara does not use cookies, pixels, web beacons, or similar tracking technologies in the Service. We do not deploy third-party analytics or advertising trackers, and we do not track you across websites or apps.
11. International data transfers
Your information may be transferred to and processed in countries other than your country of residence, including the United States, where IndicWave LLC and its service providers operate. Where required by applicable law, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, for such transfers.
12. HIPAA
Viara is not itself a HIPAA "covered entity." Professional caregivers or organizations that require a Business Associate Agreement may request one from within the app (Settings → HIPAA BAA Request).
13. Not a substitute for medical or emergency services
Viara is a coordination and record-keeping tool. It is not a medical device, does not provide medical advice, diagnosis, or treatment, and is not a substitute for professional medical care or emergency services. In an emergency, always call your local emergency number first.
14. Changes to this policy
We may update this Policy from time to time. If we make a material change to how we handle your personal information, we will notify you in the app before the change takes effect and update the "Last updated" date above. Your continued use of the Service after a change takes effect constitutes acceptance of the revised Policy to the extent permitted by law.
15. Governing law
This Policy is governed by and construed in accordance with the laws of the United States and the state in which IndicWave LLC is organized, without regard to its conflict-of-laws principles, except to the extent preempted by applicable federal or state privacy law.
16. Contact us
If you have questions or concerns about this Policy or our privacy practices, or wish to exercise any of the rights described above, contact us at support@viara.io. We will acknowledge and respond to your inquiry within the timeframes required by applicable law.