Privacy and Data Protection Policy

VovoCare ("VovoCare", "we", "us" or "our") is a digital marketplace that connects families seeking non-clinical eldercare and companionship services with independent caregivers who choose to offer those services.

VovoCare is currently operated by Luis Portas de Iberico Nogueira, pending formal incorporation. For the purposes of applicable data-protection law, VovoCare is the controller of personal data processed in connection with operating the Platform unless otherwise stated.

For privacy or data-protection questions or requests, contact: privacy@vovocare.org

VovoCare follows the principles of data minimisation, purpose limitation, transparency, security and privacy by design. We aim to collect only the personal data reasonably necessary to operate the Platform safely and effectively.

Caregivers using VovoCare are independent service providers. Verification by VovoCare is a Platform trust-and-safety measure and does not make a Caregiver an employee, agent or representative of VovoCare.

The information VovoCare collects depends on how the Platform is used.

This may include:

Families may provide information such as:

Families should provide only information that is reasonably necessary for arranging the requested service.

Some information concerning a care recipient may constitute special-category personal data under the GDPR, particularly information concerning health.

Where VovoCare processes special-category data, it will do so only where an appropriate legal basis under Articles 6 and 9 GDPR applies.

Where explicit consent is required, VovoCare will obtain that consent before the relevant processing occurs.

Where information is provided by a legal representative or another person acting for a care recipient, that person must have appropriate authority to provide the information where required by applicable law.

Caregiver information may include:

VovoCare may request evidence reasonably necessary to verify qualifications, certifications, professional history or references.

Because caregivers may provide services in private homes and to potentially vulnerable persons, VovoCare may verify the identity of Caregivers before or after activating their profiles.

Identity verification is a Platform trust-and-safety measure. It does not constitute an employment decision, professional licence, recommendation or guarantee of a Caregiver's suitability.

VovoCare may record that a Caregiver's identity has been successfully verified.

Where reasonably necessary, VovoCare may record limited information from an identity document, such as:

VovoCare applies data minimisation when determining which of these fields are actually necessary.

Information appearing on an identity document that is not needed for identity verification will not intentionally be collected merely because it appears on that document.

For example, numbers or information relating to tax, social-security or health systems will not be collected from an identity document solely for identity-verification purposes unless VovoCare has a separate lawful and necessary reason to process them.

VovoCare does not normally require or retain photocopies, scans or photographs of identity documents merely to verify a Caregiver's identity.

Where possible, VovoCare verifies the document and records the minimum necessary verification information rather than retaining the document itself.

If applicable law specifically requires VovoCare to retain a copy of an identity document, VovoCare may do so for the required purpose and retention period.

If VovoCare exceptionally offers document-copy submission as an optional verification method, any consent required by applicable law will be obtained and a reasonable alternative method of identity verification will be available.

If an identity-document copy is received when it is not necessary, VovoCare will seek to delete it promptly after the necessary verification has been completed.

Raw identity-document copies are not displayed to Families or other Caregivers.

Families may instead see a status such as "Identity Verified" or another verification indicator.

VovoCare may verify information that Caregivers choose to present as part of their professional profile.

Where a copy of a professional certificate or qualification is necessary to establish its authenticity, VovoCare may retain that document for as long as reasonably necessary for Platform verification and trust-and-safety purposes.

Families will not normally receive raw verification documents. VovoCare may instead indicate that a qualification, reference or other item has been verified.

Verification means that VovoCare has taken reasonable steps to check the specified information. It does not constitute a guarantee of a Caregiver's character, conduct, competence or future performance.

VovoCare does not currently request, collect or retain criminal-record certificates or other personal data relating to criminal convictions or offences as part of its standard Caregiver verification process.

Caregivers should therefore not send criminal-record certificates to VovoCare unless specifically requested following a future change to the verification process.

Personal data relating to criminal convictions and offences is subject to specific legal restrictions under Article 10 GDPR and applicable national law.

If VovoCare introduces criminal-record verification or another form of regulated background checking in the future, VovoCare will first:

Providing the Platform: to create and administer accounts; publish caregiver profiles; create and display care requests; allow Families and Caregivers to find and contact each other; facilitate bookings; process payments and payouts; provide Platform support; and maintain Platform records. The primary legal basis is generally performance of a contract or taking steps requested before entering into a contract.

Identity verification and Platform safety: to verify that users are who they claim to be; reduce impersonation and fraudulent accounts; protect Families, Caregivers and care recipients; investigate suspected misuse; enforce Platform rules; and handle complaints and safety incidents. Depending on the processing, the legal basis may include performance of a contract, compliance with a legal obligation, or VovoCare's legitimate interests in operating a trustworthy and secure marketplace.

Professional verification: to verify qualifications, experience, references or other professional claims made by Caregivers. The legal basis may include performance of the Platform agreement and VovoCare's legitimate interests in ensuring accurate information and maintaining trust and safety.

Payments, accounting and legal compliance: to process authorised payments; make Caregiver payouts; maintain transaction records; prevent payment fraud; meet accounting, tax and regulatory obligations; and establish, exercise or defend legal claims. The legal basis may include contractual necessity and compliance with legal obligations.

Communications: to send account messages; booking notifications; payment confirmations; security notices; support responses; and important Platform or policy updates. Marketing communications will be sent only where VovoCare has an appropriate legal basis, including consent where required.

Platform improvement: VovoCare may analyse Platform activity to improve functionality, reliability, security and user experience. Where possible, such analysis will use aggregated, anonymised or pseudonymised information.

The current VovoCare marketplace does not automatically record or transcribe audio from caregiving visits.

Caregivers may submit written visit information through functionality made available by the Platform.

VovoCare intends to introduce additional features in the future that may include AI-assisted transcription, analysis or generation of written visit summaries.

Before any feature involving recording, transcription or materially new processing of personal or sensitive information is activated, VovoCare will determine the appropriate legal bases; conduct a data-protection impact assessment where required; explain what information will be collected and how AI or other providers will process it; establish retention and deletion periods; explain whether data leaves the European Economic Area; establish appropriate contractual and technical safeguards; obtain consent or other authorisation where required by law; and update this Privacy Policy or provide a specific additional privacy notice.

The same principle applies to any future location tracking, wearable-device, sensor, camera or similar monitoring technology.

Payments and payouts may be processed through external payment providers.

Payment providers may receive information necessary to process transactions, comply with financial regulations, prevent fraud and administer payouts.

VovoCare may retain transaction identifiers, amounts, payment status, invoices and other records required for Platform operations, accounting and legal compliance.

Payment providers process some information under their own legal obligations and privacy terms.

VovoCare does not sell personal data.

Personal data may be shared only where reasonably necessary, including with a Family and the Caregiver they are considering or have selected, where necessary for arranging services; payment processors; hosting and infrastructure providers; email, communications and customer-support providers; identity-verification providers if VovoCare uses such a service; professional advisers such as lawyers or accountants where necessary; regulators, courts, law-enforcement agencies or other authorities where required or permitted by law; or a future acquiring or successor company if VovoCare undergoes a genuine corporate reorganisation, investment, merger or sale.

Service providers processing data on VovoCare's behalf are required to handle it only for authorised purposes and subject to appropriate data-protection obligations.

Caregiver verification documents and identity-document details are not disclosed to Families merely because the Caregiver has been verified. A Family may instead see the relevant verification result or badge.

Where personal data is transferred outside the European Economic Area, VovoCare will use a lawful transfer mechanism where required, such as a European Commission adequacy decision, Standard Contractual Clauses, or another transfer mechanism permitted by applicable data-protection law.

VovoCare will assess appropriate safeguards for relevant providers and services.

VovoCare keeps personal data only for as long as reasonably necessary for the purpose for which it was collected or where continued retention is required or permitted by law. Retention periods may depend on the type of information and the reason it is held.

Identity-document copies: VovoCare does not normally retain copies of identity documents. If a copy is exceptionally and lawfully obtained for identity verification but does not need to be retained, it will be deleted promptly after verification. Where retention is specifically required by law, it will be retained only for the applicable legally required period.

Identity-verification records: limited verification records - such as verification status, verification date, method, document type and necessary document identifiers - may be retained while the Caregiver's account remains active and for a reasonable period following closure where necessary for fraud prevention, safety, dispute resolution, re-registration prevention or legal claims. These records will be periodically reviewed and deleted or anonymised when no longer necessary.

Unsuccessful or abandoned Caregiver applications: information associated with an application that does not result in an active Caregiver account will be retained only for a limited period where necessary to administer the application, prevent misuse or resolve disputes, after which unnecessary verification information will be deleted or anonymised.

Professional verification records: qualification, reference and professional-verification information may be retained while relevant to the Caregiver's active profile and for a reasonable period thereafter where necessary for disputes, safety or legal claims. Outdated information may be deleted or replaced when updated verification is completed.

Financial and transaction records required for accounting, taxation, payment compliance or other legal obligations may be retained for the period required by applicable law.

Information concerning complaints, fraud, safety incidents or legal disputes may be retained for as long as reasonably necessary to investigate the matter, protect users or establish, exercise or defend legal claims.

Information that has been genuinely and irreversibly anonymised so that it no longer identifies an individual is no longer personal data and may be retained for statistical, analytical or service-improvement purposes.

VovoCare uses proportionate technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, disclosure or misuse.

Measures may include access controls; authentication controls; secure transmission; restricted administrative access; logging and monitoring; backups; separation of sensitive information where appropriate; and limiting access according to operational need.

No electronic system can guarantee absolute security. VovoCare reviews safeguards as the Platform develops and will respond to personal-data breaches in accordance with applicable law.

Users are also responsible for protecting their account credentials and devices.

VovoCare does not currently make decisions producing legal or similarly significant effects on individuals solely through automated processing.

Automated tools may assist with Platform operation, security or analysis, but significant trust-and-safety decisions may be reviewed by a person where appropriate.

If VovoCare introduces materially different automated decision-making in the future, affected users will receive the information and rights required by applicable law.

Depending on the circumstances, individuals protected by the GDPR may have the right to access their personal data; correct inaccurate or incomplete information; request deletion or restriction of processing; object to processing based on legitimate interests; receive certain information in a portable format; withdraw consent where processing is based on consent; lodge a complaint with a competent data-protection authority; and request human review where applicable automated-decision rights arise.

Withdrawal of consent does not affect processing that was lawful before the consent was withdrawn.

Some rights are subject to legal limitations. For example, VovoCare may need to retain certain transaction information despite an account-deletion request because of accounting, taxation, fraud-prevention or legal-claim obligations.

Requests may be sent to: privacy@vovocare.org

VovoCare may request proportionate information to confirm the identity of the person making a privacy request but will not require more information than reasonably necessary for that purpose.

VovoCare generally responds to GDPR rights requests within one month, subject to legally permitted extensions.

Individuals may lodge a complaint with the competent data-protection supervisory authority in the country in which they live, work or believe an infringement occurred.

While VovoCare is currently operated from Portugal, the Portuguese supervisory authority is the: Comissao Nacional de Protecao de Dados (CNPD).

Users in other EU or EEA countries may also contact their applicable national supervisory authority.

VovoCare is intended for adults.

Users registering Family or Caregiver accounts must be at least 18 years old or have reached the applicable age of legal majority.

The Platform is not intended for children to create accounts independently.

VovoCare may update this Privacy Policy as the Platform develops, the law changes, or new processing activities are introduced.

The current version will display its latest revision date.

If a change materially affects how personal data is processed, VovoCare will provide appropriate notice and obtain new consent where consent is legally required.

In particular, this Policy will be reviewed before VovoCare introduces criminal-record or regulated background checking; automatic care-session recording; AI transcription of care sessions; location tracking beyond functionality already properly disclosed; wearable or sensor monitoring; or other materially new processing of sensitive personal information.

For questions about this Policy, privacy concerns or GDPR requests: privacy@vovocare.org

For ordinary Platform support: support@vovocare.org