Your data. Your rights. Always.

USA · HEALTH INSURANCE PORTABILITY & ACCOUNTABILITY ACT

• End-to-end encryption of all Protected Health Information
• Business Associate Agreements with all US partners
• Audit logs for every data access event
• Breach notification within 60 days
• Annual third-party HIPAA security assessments
• Posture stated plainly: HIPAA-aligned practices — we are not a US covered entity

INDIA · DIGITAL PERSONAL DATA PROTECTION ACT

• Consent recorded per purpose — nothing processed beyond it
• Data principal rights in-product: access, correction, erasure
• Grievance officer: grievance@clykkcare.com — response SLAs published
• Breach notification to the Data Protection Board as mandated
• Verifiable parental consent flows for minors in the circle
• Vault data hosted in-region for Indian households

EUROPE · GENERAL DATA PROTECTION REGULATION

• Lawful basis documented for every processing purpose
• Data subject requests: access, portability, erasure — in-product
• Standard Contractual Clauses for cross-border transfers
• 72-hour breach notification commitment
• Privacy by design reviews on every new module
• EU/UK user data flows mapped and minimised

SINGAPORE · PERSONAL DATA PROTECTION ACT

• Consent, purpose limitation and notification obligations mapped to product flows
• Access and correction requests honoured in-product
• Do Not Call registry compliance for SG numbers
• Data breach notification per PDPC requirements
• Transfer limitation: comparable protection before any data leaves SG

ALWAYS ON

• AES-256 encryption at rest, TLS in transit
• Role-based vault access — you control who sees each document
• Gift and invitation tokens stored as SHA-256 hashes only
• SOC 2 program in progress — report publishes when we have it, not before

A TRUST PRINCIPLE

• Monitoring is passive and camera-free by principle
• No audio, no video — ambient patterns and per-elder baselines only
• Optional everything: each monitoring tile can be turned off per household