Privacy Policy

1. Introduction and Scope

Aflote Inc, a Delaware corporation (“Aflote,” “we,” “us,” or “our”), operates a care-coordination service that helps families organize support from their community when someone they love is facing a serious illness (the “Service”). This Privacy Policy describes the personal information we collect, how we use and share it, how long we keep it, and the choices available to you.

This Privacy Policy is incorporated into, and should be read together with, our Terms and Conditions, which use the same defined terms (“Flote,” “Patient,” “Support Circle,” “Supporter,” and the roles Owner, Admin, Member, Provider, Follower, and Concierge). By using the Service, you agree to the collection and use of information as described here.

This Policy applies to aflote.com, our mobile-responsive web application, and related services. It does not apply to third-party websites or services we link to but do not operate, such as a family’s Meal Train, CaringBridge, or GoFundMe page (see Section 10).

2. Personal Information We Collect

The information we collect depends on how you use the Service. Some of it you provide directly; some comes from other people using the same Flote; some is collected automatically.

2.1  Account and Contact Information. If you register for an account, we collect your name, email address, and (if you choose to add it) phone number. If you create a Flote or accept an invitation to join one, we also ask for your relationship to the Patient (for example, daughter, spouse, or friend), where you choose to provide it. If you use the Service without registering, such as claiming a Visit or leaving a comment as a guest, we collect the name, email address, or phone number you provide at that time, and, for a Visit, your relationship to the Patient as described in Section 2.5.

2.2  Flote and Patient Information. A Flote’s creator or Admin provides information about the Patient, such as their name, photo, a short description, and location information (including a street address, unit, floor, or room where relevant, and location type such as home, hospital, or care facility). This information is provided by the Flote’s Owner or Admin, not by the Patient directly, consistent with the Terms and Conditions’ description of how a Flote is created.

2.3  Key Contacts. A Flote’s Owner or Admin may add Key Contacts: people or organizations the family reaches for repeatedly, such as an oncologist, pharmacy, hospital, or home-care agency, categorized as medical, support/administrative, or practical/personal. This category typically includes a contact’s name, role, organization, phone number, email, address, and notes. It identifies the contact, not clinical information about the Patient, though the free-text notes field is not restricted and could contain more than that if an Admin chooses to include it.

2.4  Appointments and Calendar Information. A Flote’s Owner or Admin may log appointments (such as a treatment date or doctor’s visit), including a title, notes, location, and recurrence. The title and notes fields are free text and may describe the purpose of an appointment (for example, “chemo infusion”) at the discretion of whoever enters it.

2.5  Visits and Help Sign-Ups. When a Supporter claims a Visit or signs up to help, we collect their name and, depending on how they choose to participate, their email address, phone number, a message, and a relationship to the Patient. This does not require creating an account.

2.6  Content You Post. Updates, comments, reactions, and Thinking of You messages (including any photo attached) are stored along with the name or account associated with the post. Some of these features let you post without displaying your name publicly; we still retain the identifying information you provided even when it is not shown to other viewers (Section 5.3 of the Terms and Conditions describes this in more detail).

2.7  Information Collected Automatically. We use PostHog to collect analytics about how the Service is used, including pages visited, actions taken, and, for authenticated users, an identifier tied to your account. PostHog’s session replay feature is enabled, which records how you interact with pages you visit (such as clicks, scrolling, and navigation) to help us understand and improve the Service. We use Sentry to collect error and performance data, including stack traces and request information, to diagnose problems; this runs only in our production environment.

2.8  Location Information. When an Admin searches for an address using Google Places (for a Flote’s location, an appointment, or a Key Contact), we send the free-text search query typed and, for better results, a general city/state bias. We do not send the Patient’s name or other identifying information to Google as part of this search. The selected address is then stored as described in Sections 2.2 through 2.4 above.

3. How We Collect Information

• Directly from you, such as when you register, create or administer a Flote, claim a Visit, post an Update, or contact support.
• From other people using the same Flote, such as when a Flote’s Owner or Admin adds information about the Patient, or when a Supporter’s booking or sign-up is visible to Admins.
• Automatically, through the analytics and error-monitoring tools described in Section 2.7.
• From our service providers, described in Section 7, to the extent necessary for them to perform a function on our behalf (for example, WorkOS confirming your identity when you sign in).

4. How We Use Personal Information

We use personal information to:

• Operate the Service, including creating and displaying Flotes, coordinating Visits and help sign-ups, and sending the notifications and transactional emails described in our Terms and Help Center;
• Provide customer support, including through a Concierge acting on your request;
• Maintain the security of the Service, including detecting and responding to abuse or violations of our Terms;
• Diagnose and fix technical problems, using the error-monitoring and analytics tools described in Section 2.7;
• Provide AI-assisted features, described in Section 5; and
• Comply with legal obligations, and respond to lawful requests from courts or government authorities.

We do not use personal information for third-party advertising, do not run advertising cookies or pixels from ad networks, and do not sell personal information. Section 12 describes this in more detail.

5. AI-Assisted Features and Your Information

As described in our Terms and Conditions, Aflote may use artificial intelligence tools, including large language models operated by a third-party provider (Anthropic), to help you use the Service, for example to turn a plain-language description of an appointment into a structured calendar entry. When you use an AI-assisted feature, the text you enter, which may include Key Contact information such as a clinic or provider name and address, is sent to that third-party provider to generate a response.

6. How Information Is Shared Within a Flote

A Flote is a shared space, and information within it is visible according to each person’s role and the Flote’s privacy settings, described in our Terms and Conditions Section 4.4 and 4.5.

• Admins and Members can generally see the Flote’s Key Contacts, appointments, Updates, and booking activity.
• Providers see the scope of information relevant to the Flotes they are assigned to.
• Followers and the public (for a Public or Listed Flote) see the follower-facing Flote page: ways to help, the support circle shown without roles, and the family’s Updates. They do not see Key Contacts, appointments, or the admin dashboard.
• A Concierge may access a Flote to provide support at your request or as reasonably necessary to operate the Service, investigate misuse, or respond to a legal request.

Information shared within a Flote is not shared outside it except as described elsewhere in this Policy (our service providers, legal requirements, or a link the family chooses to add to another service such as Meal Train or GoFundMe).

7. Third-Party Service Providers

We use the following service providers to operate the Service. Each receives only the information necessary to perform its function, and each has its own privacy practices governing the information it processes on our behalf.

• WorkOS — authentication (sign-in), including your email, name, and account identifier.
• Resend — sends transactional email on our behalf (invitations, notifications, confirmations).
• PostHog — product analytics and session replay, described in Section 2.7.
• Sentry — error monitoring in production, described in Section 2.7.
• Intercom — customer support messaging. If you are signed in, Intercom receives your name, email, account identifier, and sign-up date. It also receives the address of the page you are viewing, a generic page title naming the section of the Service, and anything you type into a conversation. Page addresses sent to Intercom never contain names, email addresses, or access tokens; the Messenger does not load on pages whose address carries them.
• Google Places — address lookup, described in Section 2.8.
• Anthropic — AI-assisted features, described in Section 5.

We may add or change service providers over time; this Policy will be updated to reflect material changes, consistent with Section 18.

8. Cookies and Similar Technologies

We use cookies and similar technologies (such as local storage) to keep you signed in, remember your preferences, and support the analytics described in Section 2.7. We do not use third-party advertising cookies, and we are not aware of any third-party advertising network operating on the Service.

9. Notice at Collection

The following table summarizes the categories of personal information we collect through the Service, the sources of that information, the business purposes for which we use it, and the categories of third parties to whom we disclose it. Category labels follow the California Consumer Privacy Act, as amended.

We do not knowingly collect personal information for the purpose of selling it or sharing it for cross-context behavioral advertising.

10. Third-Party Links

A Flote may link out to other tools a family already uses, such as Meal Train, CaringBridge, or GoFundMe. Those services are operated by other companies, are not covered by this Policy, and are governed by their own privacy policies. If we introduce a payment processor to support financial contributions or paid features (see our Terms and Conditions, Section 12), that processor’s own privacy policy will apply to information you provide as part of a payment.

11. Data Retention and Deletion

11.1  How long we keep information. We retain personal information for as long as your account remains active, or a Flote you are part of exists, and for as long as reasonably necessary for the purposes described in this Policy. Key Contacts, appointments, Updates, Thinking of You messages, and booking history are retained for as long as the associated Flote exists, subject to Section 11.2. Analytics data (PostHog) and error and performance data (Sentry) are retained per each platform’s own default retention period. We may retain information for a longer period where necessary to comply with a legal obligation, resolve a dispute, enforce our agreements, or where the information has been de-identified or aggregated so that it can no longer reasonably be associated with you.

11.2  Deleting a Flote. A Flote’s Owner, or a Concierge, may delete a Flote. A deleted Flote is deactivated immediately and enters a 30-day recovery window, during which an Owner or Admin may contact us to restore it. After that window closes, the Flote and its associated content, including Updates, Thinking of You messages, appointments, Key Contacts, and booking history, are permanently deleted from our production systems and cannot be recovered.

11.3  Deleting your individual account. If you would like your personal account or personal data removed, contact us at support@aflote.com and we will process your request, subject to the exceptions described in Section 12.

11.4  Backups and residual copies. Information may persist for a limited time in backups, logs, or systems used to diagnose and prevent abuse, even after it is deleted from your Flote. We do not use this residual information for any purpose other than backup integrity, security, and legal compliance.

12. Your Choices and Rights

You can review and update most of your own information directly in your account settings. Notification preferences are per user and per Flote, and are described further in our Help Center; a Follower can manage their email preferences through the link in the footer of update emails.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising.

To request access to, correction of, or deletion of your personal information, contact us at support@aflote.com. We will verify your identity before acting on a request, and may decline a request to the extent permitted by law, for example where information is needed to comply with a legal obligation, complete an in-progress transaction, or resolve a dispute.

13. U.S. State Privacy Rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have additional rights under your state’s privacy law, including the rights described below. We apply this section to residents of these states; we do not currently distinguish further by state.

13.1  Right to Know and Access. You may ask us to confirm whether we process your personal information, and to provide a copy of it in a portable format.

13.2  Right to Delete. You may ask us to delete personal information we have collected from you, subject to the exceptions described in Section 12.

13.3  Right to Correct. You may ask us to correct inaccurate personal information we hold about you.

13.4  Right to Opt Out. You may opt out of the sale of personal information, sharing for cross-context behavioral advertising, and profiling for legal or similarly significant decisions. As stated in Section 12, we do not currently engage in any of these practices.

13.5  Non-Discrimination. We will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised a privacy right described in this Section.

13.6  Verification and Appeals. To protect your information, we will ask you to verify your identity before processing a request, which may include confirming your email address on file. You may designate an authorized agent to submit a request on your behalf with your written permission. If we decline a request, you may appeal by replying to our decision or contacting us at support@aflote.com; we will respond to an appeal within a reasonable time.

13.7  California “Shine the Light.” California residents may request information about disclosures of personal information to third parties for those parties’ own direct marketing purposes. Aflote does not make such disclosures.

13.8  Financial Incentives. Aflote does not offer any financial incentive or price or service difference in exchange for the retention or sale of personal information collected through the Service.

14. Sensitive and Health-Related Information

Aflote is not a HIPAA-covered entity or business associate, and use of the Service does not create obligations under the U.S. Health Insurance Portability and Accountability Act (“HIPAA”).

Some parts of the Service, such as Key Contacts and appointment notes, let you enter free-text information that may relate to a Patient’s health or care. We do not independently verify this information, and we ask that you not enter a Social Security number, financial account or payment card number, government identification number, or a detailed clinical or diagnostic record into any field on the Service.

A small number of states (currently including Washington, Nevada, and Connecticut) have their own consumer health data laws that apply more broadly than HIPAA and may reach some of the information described in this Section. To the extent those laws apply, we collect this information only as necessary to provide the Service at your direction, we do not sell it, and we share it only as described in Sections 6 and 7 of this Policy.

15. Children’s Privacy

You must be at least 18 years old to register an account or hold the Owner, Admin, Member, or Provider role, consistent with our Terms and Conditions. We do not knowingly collect personal information directly from anyone under 18 for those purposes.

There is no minimum age for the Patient a Flote is created to support. Where a Flote is created for a minor, information about that minor (such as their name and photo) is provided by the adult who created or administers the Flote on the minor’s behalf, not collected directly from the minor, consistent with Section 3.1 of our Terms and Conditions.

16. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including access controls tied to the roles described in our Terms and Conditions and encryption in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you become aware of a security issue affecting the Service, please contact support@aflote.com.

17. International Users

The Service is directed to users in the United States, and personal information is hosted and processed in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will provide notice, such as by posting an updated version on the Service with a new “Last Updated” date, or by emailing registered account holders. Your continued use of the Service after a change takes effect means you accept the updated Policy.

19. Contact Us

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to support@aflote.com.

Aflote Inc · 701 Tillery St, Ste 12 B#246, Austin, TX 78702