Anido Privacy Policy

• Anido helps a family and its caregivers look after an older loved one together. It is not a medical device, an emergency service, a care agency or a pharmacy.
• You and your care team add information about the elder, including health information. We treat all of it as the most sensitive information we hold.
• Everyone in a care team can see the elder's care information. The organizer decides who joins and what each person can do.
• We never use your family's health information for ads.
• Before we share your information with third parties in any new way, we'll ask you first.
• AI summaries only run if you say yes. We don't attach the elder's profile details, and our AI provider may not train its models on Anido data.
• Product analytics, ad measurement, marketing emails and "Help improve Anido's AI" are all off until you turn them on. You can turn them off at any time.
• Your information is stored in the United States, including if you live in Mexico, Colombia or elsewhere in Latin America.
• You can see, download, correct and delete your information. Use Settings › Privacy & data in the app, or email privacy@anidoapp.com.
• When you delete your account, we delete or de-identify your information within 30 days, and backups roll off within 35 days. Care entries you made stay in the care team's record under your name, so the elder's history stays accurate.
• Your rights depend on where you live. Find your country in section 22.

Anido is made by Orchid Media LLC, a Tennessee limited liability company. Our address is 110 Somerville Ave, Chattanooga, TN 37405, USA. In this policy, "Anido," "we," "us" and "our" mean Orchid Media LLC.

We are the company in charge of the information in Anido, including the elder's information. The legal word for this is "controller" (in Mexico and most of Latin America, "responsable"). That means we decide how the information is used, and we answer to you and to regulators for it.

What Anido is: a shared place for a care team to track medications, doses, vital signs, visits, documents and shift handovers for an older adult.

What Anido is not: Anido is not a medical device, not an emergency service, not a home-care agency and not a pharmacy. It doesn't diagnose, treat or give medical advice, and it doesn't order medications. In an emergency, call your local emergency number (911 in the United States and Mexico, 123 in Colombia). See our Medical disclaimer.

This policy covers:

• Care team members: people with an Anido account. Each one has a role: organizer, family, caregiver or viewer.
• The elder: the older adult the care team looks after. The elder usually doesn't have an account.
• People named in the elder's records: doctors, pharmacies, emergency contacts and anyone mentioned in a note.
• People who are invited to a care team but haven't joined yet.
• Visitors to anidoapp.com.

Who's who?

Home-care agencies can't open business accounts yet. If we offer agency accounts later, they will have separate terms, and for their clients we may act on the agency's behalf. We'll update this policy first.

Where is Anido available?

Anido is offered in the United States and in Spanish-speaking countries in Latin America, including Mexico and Colombia. At launch, Anido is not offered in Brazil. Anido is not offered in Cuba or anywhere else where United States sanctions prohibit it.

People who live in the European Union or the United Kingdom can join a care team only if someone invites them. We don't advertise to people there. Section 22.D explains their rights.

This policy doesn't cover other companies' apps that Anido opens for you, like your phone, maps or email app, or the App Store and Google Play. Their own privacy policies apply.

We collect information about three groups of people: care team members, the elder, and other people named in the elder's records. The tables below show what we collect, where it comes from, why, and whether we treat it as sensitive.

"Sensitive" means we give it the highest level of protection. All health information is sensitive, everywhere Anido is offered.

3.1 About you, as a care team member

3.2 About the elder

The elder is the person the care team looks after, for example Mamá Rosa. The elder usually doesn't have an account. Their information comes from the care team, and we treat all of it as health information.

3.3 About other people

About invitations. Anido doesn't send texts or emails to people you invite. You share the invitation link or QR code yourself, using your own apps. Each link is unique to the care team and the role, and it expires after 7 days. We don't collect the invited person's phone number or email.

If we add text messages (SMS) later, we'll update this policy first and ask for consent where the law requires.

If you're mentioned in someone's records, you can use the rights in section 14. We ask members to write only what the care team needs to know.

3.4 What device permissions do we ask for?

We ask for each permission only when you first use the feature that needs it. Anido works without any of them, though some features won't.

We don't ask for your location, microphone, contacts or calendar. When you tap "Add to calendar," Anido hands the visit details to your calendar app. We don't read your calendar.

3.5 What don't we collect?

• Your precise location. Visit addresses are only what your care team types in.
• Your address book.
• Face, fingerprint or other biometric data.
• Audio recordings.
• Payment card details. Anido is free and takes no payments.
• Data from Apple Health, Google Health Connect or wearables.
• Your device's advertising ID, unless you allow ad measurement (see section 9).

The elder's information belongs to the elder. Their family and caregivers add it so they can care for them together. Because the elder usually doesn't have an account, we set extra rules to protect them.

Who can add the elder's information?

The organizer creates the elder's profile and invites the care team. Family members can add and edit most things. Caregivers can log doses, vital signs, notes, visits, documents and handovers. Caregivers can change medications only if the organizer allows it. Viewers can't add anything. Section 5 has the full list.

What permission is needed?

When an organizer creates an elder's profile, we ask them to confirm two things, each with its own box that starts unticked:

• They have the elder's permission, or the legal right, to keep the elder's care information in Anido. A legal right could come from a power of attorney, a guardianship, or being the elder's legal representative.
• They agree that Anido can store and process the elder's health information, which is stored in the United States, as this policy explains.

We keep a record of each confirmation, with the date and the version of this policy. If you don't have the elder's permission or the legal right, please don't add their information.

Before you first invite someone, we ask you, with another unticked box, to agree that Anido can show the elder's health information to the people you invite. Without it, you can still use Anido on your own.

Does the elder know?

We ask organizers to tell the elder about Anido. When the organizer adds the elder, Anido offers a short notice written for the elder, in large type, that the family can show or read to them. It's also at anidoapp.com/elder-information-notice. Anido offers it again when the family sets up elder mode.

What is elder mode?

Elder mode turns a phone or tablet into one simple screen for the elder. It shows the next dose with an "I took it" button and a "Call family" button.

• "I took it" taps are logged as, for example, "Rosa (self)." The family decides whether these count as given or need someone to confirm.
• "Call family" calls the first family contact. If no one answers, it sends an urgent alert to the whole care team. "Call family" does not call emergency services.
• Leaving elder mode needs the family PIN or the phone's Face ID or fingerprint check.

What rights does the elder have?

The elder doesn't need an account to use their rights. The elder, or their legal representative, can email privacy@anidoapp.com and ask us to:

• show them their information or give them a copy,
• correct it,
• limit how it's used, or
• delete it.

We check who is asking and, for a representative, their legal authority. Then we act on the request and tell the organizer what we did. We won't tell the organizer if the elder or their representative asks us not to and we believe telling them could put the elder at risk.

What if the family disagrees?

We don't settle family disagreements. When the elder can tell us what they want, we follow the elder's wishes. Otherwise, we follow legal documents, such as a court order, a guardianship or a power of attorney.

While we look into a disagreement, we may pause changes to the care team.

Everyone in a care team can see the elder's care information. That's what makes Anido useful: the whole team works from the same record. The organizer decides who joins, gives each person a role, and can remove people at any time.

Every care team has at least one organizer. The last organizer must pass the role to someone else before leaving.

Things to know about sharing in a care team

• Care team members may live in different countries. Showing them the elder's information is part of the service the organizer sets up.
• Removing someone ends their access to the care team right away. The entries they made stay in the record under their name (see section 15).
• Medical ID on the lock screen. The family can choose to show the elder's Medical ID on the elder's own lock screen. This is off unless they turn it on. When it's on, anyone who picks up that phone can see it.
• What people do after they see information is up to them. Anido can't stop a member from taking a screenshot or telling someone else. Only invite people you trust.
• Exports leave Anido. When someone downloads or shares a PDF or CSV report, that file is outside Anido. We can't control or delete it.
• Calls and messages open your phone's own apps. Anido doesn't connect, record or read your calls or messages.

When someone adds a lab result or other medical document, Anido can explain it in plain words. We call this an AI summary. It is written by an artificial intelligence system, not a person, and it is always labeled "AI summary."

We ask first

AI summaries only run if you give permission. The first time you add a document, we ask: "Allow AI summaries" or "Not now." This choice is separate from everything else you agree to.

If you choose "Not now," your documents are still stored for the care team, but they are not sent to our AI provider. You can change your mind at any time in Settings › Privacy & data › AI summaries. Turning it off stops new summaries. Summaries already made stay with their document until someone deletes it.

What is sent to the AI provider?

We send the pages of the document and the text we read from them. We don't attach the elder's profile details to the request. The document itself may show the elder's name or other details printed on it, and that text is sent as part of the document.

We read text from documents using on-device text recognition (Apple Vision on iOS, Google ML Kit on Android).

Who is our AI provider, and what can they do with it?

Our AI provider is Vercel AI Gateway (Vercel Inc.), which sends the request to Anthropic PBC (Claude). It works for us under a contract. It may use the document only to create the summary. It may not use Anido data to train its AI models. It keeps requests for no longer than zero data retention: not stored after the summary is returned, except where the law requires otherwise or to prevent misuse, to detect misuse, and then deletes them.

What do we keep?

We keep the summary with the document. We also keep a record of each request and answer, with the AI model's name, for 12 months. We use this record only to check quality and look into errors.

What the AI will and won't do

• It copies values exactly as printed. It doesn't round or recalculate them.
• It flags only what the document itself marks as high, low or critical.
• It never diagnoses, suggests medication changes or predicts what will happen.
• If the document marks a critical value, it only tells you to call the elder's doctor today (for example, "Call Rosa's doctor today"), with the doctor's phone number.
• If it can't read part of a page, it says so and never guesses.
• Every summary ends with this reminder, using the elder's name: "Anido explains results in plain words. It doesn't replace Rosa's doctor."

A summary stays marked "Needs review" until a care team member checks it and taps "Mark as reviewed." AI summaries can be wrong. Always check with the elder's doctor. No decision about you or the elder is made by AI alone.

Do you use our information to train AI?

Only if you say yes. In Settings › Privacy & data › "Help improve Anido's AI" you can choose to let us use de-identified copies of the documents and AI summaries you add to improve Anido's own AI features. This is off until you turn it on, and Anido works the same either way.

Section 12 explains what "de-identified" means. We won't try to identify anyone from de-identified data, and it is never used to train our AI provider's models.

You can turn this off at any time. We'll stop using new information right away. Information that was already de-identified can't be linked back to you, so we can't pull it out.

We use information for two kinds of purposes: core uses that Anido needs to work, and optional uses that happen only if you turn them on.

Core uses (needed to provide Anido):

• Create and secure your account and sign you in.
• Keep the elder's care record and show it to the care team.
• Send reminders, alerts, hand-off requests and the daily digest.
• Prevent double doses and warn when supplies run low.
• Create exports when you ask.
• Answer support requests.
• Find and fix problems, using crash reports with personal and health information removed.
• Keep Anido safe: stop fraud and misuse, and investigate security issues.
• Send service messages, like sign-in codes and notices about changes.
• Follow the law, and protect our rights and other people's safety.

Optional uses (only if you say yes):

• AI summaries of documents (section 6).
• Help improve Anido's AI with de-identified data (section 6).
• Product analytics (section 9).
• Ad measurement (section 9).
• Marketing emails about Anido.

What we never do:

• We never use your family's health information for ads.
• We don't show ads inside Anido.
• We don't use health information for marketing.
• We don't use information for a new purpose without telling you and, where needed, asking you first.

7.1 On what legal basis do we use information?

Privacy laws require a legal reason, called a "legal basis," for each use. The table shows ours. "Consent" always means a separate choice you make, never a box that is ticked for you.

Colombia. Colombian law calls consent "authorization" (autorización) and asks for it for each purpose, except where the law says it isn't needed. Section 22.C.1 explains how we get it.

You can withdraw any consent at any time. This doesn't affect what we did before you withdrew it. If you withdraw consent for health information, we can't keep the elder's care record for you, so you'll need to delete it (see section 15).

We share information only with the people and companies below, only for the reasons shown, and only as much as they need.

8.1 Which service providers do we use?

The full, current list is at anidoapp.com/subprocessors.

How we hold service providers to our standards. Each one signs a contract that lets them use information only to do their job for us. They must protect it at least as well as this policy does, keep it confidential, and delete or return it when the work ends.

8.2 Do you share for legal reasons?

We share information with authorities only when the law requires it, for example under a valid court order. We check every request and share only what is required. We'll tell you before we share, unless the law forbids it or there's an emergency.

We may also share information to prevent serious harm to someone, or to protect our rights in a legal dispute.

8.3 What happens if Anido changes owners?

If Orchid Media LLC or Anido is acquired by, or merged with, another company, your information may move to the new owner. The new owner must keep the promises in this policy, including the one in section 8.4. We'll tell you before your information moves, and you can delete your account first.

8.4 Our promise: we'll ask you first

Before we share your information with third parties in any new way, we'll ask you first.

This is a binding commitment. It is part of our agreement with you, and you can enforce it. Here is exactly what it means:

• "Any new way" means sharing with a new kind of third party, or for a new purpose, that this policy doesn't already describe.
• We ask before, never after. We ask in a separate request, with a box that starts unticked. We tell you who would receive the information, what they would receive, and why.
• Saying no is free. If you say no or ignore the request, nothing changes, and Anido keeps working the same.
• Never backwards. A new kind of sharing applies only to information from after you say yes, unless you clearly agree to more.
• You can change your mind. You can withdraw your yes at any time. We'll stop the new sharing from then on.
• For the elder's information, we ask the organizer, who must have the elder's permission or legal right to say yes.

What this promise doesn't cover, because this policy already describes it:

• the sharing described in this section 8;
• replacing a service provider with another that does the same job under the same rules (we update our list first); and
• sharing the law requires, as described in section 8.2.

If a change to this policy would weaken this promise, we'll ask for your consent first. It won't apply to you unless you agree.

9.1 Does Anido show ads?

No. There are no ads inside Anido.

9.2 How do we measure our ads?

We advertise Anido on other apps and websites, for example on Meta and Google, so more families can find it. To know which ads work, we use:

• Apple's and Google's own app store reports. They give us campaign totals, like how many installs came from an ad, without identifying you. They don't need your permission. On Android, we read the Google Play install referrer only if you turn on ad measurement.
• An ad measurement tool from Meta, Google and TikTok (only on our public marketing website, after cookie consent), only if you say yes. It receives three events: that you installed Anido, opened it for the first time, and created an account. It also receives your device's advertising ID and your IP address.

These partners never receive health information, elder information, screen names, or anything about medications, doses, visits, documents or notes. They also don't receive anything we've worked out about you or the elder.

How you say yes:

• On iPhone, Apple asks if Anido can track you. If you choose "Ask App Not to Track," we don't use your advertising ID or share it.
• On Android and on the web, we ask with our own choice, "Ad measurement," which starts off.
• On anidoapp.com, ad tags run only on our public pages, never inside the signed-in web app, and only after you accept them in the cookie banner.

You can turn ad measurement off at any time in Settings › Privacy & data › "Ad measurement" or on our Your Privacy Choices page.

9.3 Product analytics

Product analytics help us see which features people use, so we can improve Anido. This is off until you turn it on.

If you turn it on, Calyx Analytics (our own tool, operated by Orchid Media LLC) and Calyx Analytics receive usage events, like "opened the Visits screen," linked to a random ID rather than your name. They never receive health information. We don't record your screen.

You can turn it off at any time in Settings › Privacy & data › "Product analytics." We keep analytics events for no more than 25 months.

9.4 Crash reports

When Anido crashes, we send an error report to Sentry (Functional Software, Inc.) so we can fix it. We remove personal and health information from these reports before they leave your device. Crash reports are part of keeping Anido working.

9.5 Marketing emails

We send marketing emails, like news about Anido features, only if you say yes. Every marketing email has an unsubscribe link. Service emails, like sign-in codes and notices about this policy, aren't marketing and you'll still get them.

9.6 What do state laws call ad measurement?

California and some other states have their own words for ad measurement. Letting an ad partner use your advertising ID to measure ads may count as "sharing" your personal information, or as "targeted advertising." You can opt out of this at any time.

Because ad measurement is off unless you turn it on, you're opted out until you choose otherwise.

9.7 Your Privacy Choices and Global Privacy Control

Our Your Privacy Choices page, marked with this icon , lets you opt out of sharing for ads and targeted advertising. It is linked at the bottom of every page on anidoapp.com and in Settings › Privacy & data in the app.

We honor Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a request to opt out. It applies to that browser and, if you're signed in, to your account. When we've honored it, the page shows "Opt-out request honored."

9.8 All your choices in one place

Anido sends reminders and alerts through Apple's and Google's push notification services, which pass them to your device. We keep notification text short.

• What a reminder shows. A reminder starts with the elder's nickname and says what's due, for example a medication name and a time. Unless you hide details, this can show on your lock screen.
• Lab values and diagnoses never appear in notifications on your lock screen.
• With "Hide details on lock screen" on, notifications on your lock screen show only "Anido reminder."
• Urgent alerts (when the elder presses "Call family") reach everyone in the care team, even during quiet hours.

The daily digest email (8 PM in your time zone) lists what happened, like "2 doses given, 1 handover," with a link to Anido. It never includes lab values, diagnoses or document contents. If you turn on "Hide details on lock screen," the digest only says you have updates in Anido, with a link.

Reminders and alerts may not always arrive. They depend on your phone, its settings, your connection, and Apple's and Google's services. Don't rely on Anido in an emergency. Call your local emergency number.

We store information in the United States. If you live in Mexico, elsewhere in Latin America, or in the EU or UK, your information is transferred to the United States. When you create your account, we ask you, with a separate box, to agree that Anido can store and process the health information you add, and that it is stored in the United States.

To protect information sent abroad, we use:

• Contracts with each service provider that require them to protect information the way this policy does.
• Recognized transfer tools where they apply, like the EU-U.S. Data Privacy Framework for providers certified under it, and the European Commission's standard contract clauses.
• Your consent, where your country's law requires it.

Section 22 explains the rules for your country.

On your device. Anido keeps a copy of recent information on your phone or browser so it opens fast and works offline. This copy is encrypted. It's removed when you sign out or delete the app. We don't store health information in iCloud.

We keep information only as long as we need it for the reasons in this policy.

We may keep information longer if the law requires it or to deal with a legal claim. When that happens, we keep only what is needed and limit who can see it.

What "de-identified" means. De-identified information has had names, dates, ID numbers and other details removed, so it can no longer be linked to a person. We keep it in that form, we don't use it to identify anyone, and we don't share it except as this policy allows.

We protect information with safeguards that fit how sensitive it is. They include:

• Encryption while information travels and while it's stored.
• Access limited to each care team, enforced on our servers, so one care team can never see another's information.
• Very limited staff access. Only people who need it to run Anido or help you can access information, and their access is logged.
• Scrambled storage of sign-in codes and the elder mode PIN.
• Optional app lock with Face ID or fingerprint, and a list of signed-in devices you can sign out of.
• No health information in analytics, ad measurement or crash reports.

No system is perfectly secure. You can help by locking your phone, keeping your email account safe, and signing out on shared devices.

What if something goes wrong?

If there is a breach that affects your information, we'll tell you and the authorities without unreasonable delay, and within the time each law requires. For health information covered by the US Federal Trade Commission's rule, that is no later than 60 calendar days after we find out. Some laws set shorter deadlines, and we follow them. A breach includes an unauthorized disclosure, not only a hack. We'll explain what happened, what information was involved, and what you can do.

Wherever you live, you can ask us to:

• See the information we have about you, and get a copy in a common format.
• Correct information that is wrong.
• Delete your information.
• Withdraw consent you gave, at any time.
• Opt out of ad measurement, product analytics and marketing emails.
• Limit how we use your information, or object to a use.
• Appeal if we say no.

Some laws give you more rights or set different deadlines. Section 22 shows the rules for your country or state.

How do I make a request?

• In the app: go to Settings › Privacy & data. There you can use Download my data, Delete my account, Leave this care team, and, for organizers, Delete the elder's information. You can also turn your choices on or off.
• On the web: use anidoapp.com/delete-account to ask us to delete your account without the app, and anidoapp.com/privacy-choices to opt out.
• By email: write to privacy@anidoapp.com. Tell us what you want and which care team it's about.

How do you check it's really me?

To protect your information, we confirm who you are before we act. Usually that means you're signed in, or you enter a code we send to the email on your account. If we can't confirm who you are, we may ask for a little more information. We use it only to check your request.

Can someone ask for me?

Yes. You can name an authorized agent to make a request for you. We'll ask for proof that you gave them permission, and we may ask you to confirm.

A family member or legal representative can make requests for the elder. We'll ask for proof of their authority, like a power of attorney, a guardianship order, or proof that they are the elder's legal representative.

How long will it take?

We'll confirm we got your request within 10 business days. We'll answer within 45 days, or sooner if your local law requires it. If we need more time, we'll tell you why. Requests are free, unless they are clearly excessive.

What about entries other people made?

You can ask us to correct or delete what other members wrote about you. Because the care record must stay accurate, we usually do this by adding a correction that everyone can see, rather than erasing the original. If the law requires us to delete something, we will.

What if you say no?

We'll explain why. You can appeal by emailing privacy@anidoapp.com with "Appeal" in the subject line, within 60 days of our answer. We'll answer within 45 days. If you still disagree, you can complain to your local data protection authority or state Attorney General (see section 22).

Will I be treated differently?

No. We won't deny you the service, charge you differently or give you a worse service because you used your privacy rights.

The care log in Anido is "append-only." That means entries are never quietly changed or erased. Corrections and undos are added as new entries that point to the original. This keeps the record accurate and trustworthy, for example so no one can hide a missed dose or give a double dose by mistake.

Because of this, deleting your account doesn't erase the care entries you made for the elder. Here is what each kind of deletion does:

If you're the last organizer, you must make someone else organizer, or delete the elder's information, before you can delete your account.

Download first. Before you delete, you can use Download my data or export a care report. After deletion, we can't recover anything.

What we may keep. We keep records of your consents and choices, and unsubscribe requests, for the times in section 12. We also keep anything the law requires us to keep.

If the elder dies, the organizer can export the care record and then delete the elder's information. If no one does, the care team is deleted under our rule for care teams no one uses (section 12).

If the organizer dies or can no longer act, another member, or the organizer's or elder's legal representative, can email privacy@anidoapp.com. With proof, such as a death certificate or a legal document, we can make another trusted member the organizer.

If a member dies, their family can ask us to close the account. Their care entries stay in the care team's record.

If the elder can no longer make decisions, their legal representative can use the elder's rights (section 4). Where local law lets heirs or relatives act for someone who has died, we'll follow it.

We don't decide who is right in a family disagreement. We follow the elder's wishes when we know them, and otherwise legal documents.

No. You must be 18 or older to have an Anido account. Anido is built for the care of adults. We don't knowingly collect information from children, and we don't use children's information for ad measurement.

If we learn that someone under 18 has an account, or that a care team is set up for a child, we'll delete it. If you think this has happened, email privacy@anidoapp.com.

Sometimes a note mentions a child, such as a grandchild's name. That becomes part of the care record. Please write only what the care team needs to know.

If you're a nurse, aide or other professional caregiver, here's what you should know.

• Your entries work like a work record. The doses, vital signs, notes, handovers and acknowledgments you log show your name and the time. The family can see them, export them, and may use them if there is a disagreement about care.
• Anido isn't your employer or agency. We don't hire, place, supervise, pay or rate caregivers. Your work arrangement is between you and the family or your agency.
• Each care team is separate. If you work for several families, each one sees only its own care team. They can't see your other clients.
• Your shifts are visible to the care team so they know who's on duty.
• When you leave a care team, you lose access right away. Your entries stay in that care team's record under your name.
• You have the same rights as any member (section 14).

Anido doesn't offer agency accounts yet. If it does, the agency's terms will explain how your information is handled.

Cookies are small files a website saves in your browser. Apps and websites also use similar tools, like local storage.

• Inside the Anido web app, we use only what's essential: keeping you signed in, remembering your settings, and an offline copy so Anido works without internet. If you turn on product analytics, we also use analytics tools. We never use ad tags inside the signed-in web app.
• On our public pages at anidoapp.com, we use analytics and ad tags only if you accept them in the cookie banner. "Accept" and "Reject" are equally easy to choose.

You can change your choices at any time with Cookie settings at the bottom of every page. Our Cookie policy lists each cookie and how long it lasts.

We may update this policy as Anido changes or the law changes. The date at the top shows when we last changed it.

If we make an important change, we'll tell you at least 30 days before it takes effect, in the app and by email. Where the law requires it, we'll ask you to accept the change.

We won't use information already collected in a new way without your consent. Any new sharing with third parties follows our promise in section 8.4. Earlier versions of this policy are available on request.

• Privacy questions and requests: privacy@anidoapp.com
• Help and general questions: info@anidoapp.com. We aim to reply within 2 business days.
• By mail: Orchid Media LLC, Attn: Privacy, 110 Somerville Ave, Chattanooga, TN 37405, USA
• EU and UK representative: Not appointed (Anido isn't offered in the EU or UK at this time)

Our privacy team handles all privacy requests, including requests under Mexican and other Latin American laws.

Find where you live, then go to that section.

22.A United States

California notice at collection

This table lists the categories of personal information California law defines, what each means in Anido, and how we handle it. The same handling applies in every state. We have not used any of these categories for ad measurement unless the person opted in.

We don't collect commercial information (Anido is free), biometric information, precise location, or education information.

Sharing in the past 12 months. In the past 12 months we have not sold personal information as California defines it. We have shared identifiers (advertising ID, device IDs and IP address) and internet or app activity (install, first open and account created events) with Meta, Google and TikTok (only on our public marketing website, after cookie consent) for ad measurement, only for people who turned it on.

Sensitive personal information. We use sensitive personal information only to provide the service you asked for, to keep it secure, and for other uses California law allows. We don't use it to infer things about you. So the "right to limit" use of sensitive personal information doesn't require a separate link, but you can always email privacy@anidoapp.com to ask about it.

Your California rights. You can ask to know what we collect, use and disclose; see and get a copy; correct; delete; and opt out of sharing for ads. You can make requests yourself or through an authorized agent (section 14). We won't discriminate against you for using these rights.

Direct marketing by others. We don't give personal information to other companies for their own direct marketing.

Information about people under 16. We don't knowingly share information about anyone under 16 for ads.

Other states

Many states give you privacy rights, including Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Depending on your state, you can ask to:

• confirm whether we process your information and see it;
• correct or delete it;
• get a copy you can take elsewhere;
• opt out of targeted advertising and profiling; and
• withdraw consent for sensitive information, including health information. We always ask for consent before collecting health information.

Use the steps in section 14. If we say no, you can appeal. If you disagree with our answer to your appeal, you can contact your state's Attorney General.

Tennessee. Orchid Media LLC is based in Tennessee. Tennessee residents have the rights above. Tennessee law also requires consent before processing sensitive information, which we always ask for.

Consumer health data (Washington, Nevada, Connecticut and other states)

Some states, including Washington, Nevada and Connecticut, have special laws for health information. Our Consumer Health Data Privacy Policy explains what health information we collect, where it comes from, who receives it, and your rights.

In short: we collect health information only to provide Anido, and only with your consent. We ask separately before we first show it to the people you invite. We don't collect your location, and we don't use geofences around health care places.

Is Anido covered by HIPAA?

No. HIPAA is a federal law for health care providers, health plans and their business partners. Anido is a tool families use on their own, so HIPAA generally doesn't apply to it. We still protect health information as the most sensitive information we hold, as this policy explains.

Breach notice for health information

The Federal Trade Commission's Health Breach Notification Rule may apply to Anido. If health information is accessed or disclosed without authorization, we'll notify you, the FTC and, where required, the media. We'll do it without unreasonable delay, and no later than 60 calendar days after we find out. If a state law sets a shorter deadline, we follow it.

22.B Mexico: aviso de privacidad integral

This section, together with the rest of this policy, is our comprehensive privacy notice (aviso de privacidad integral) under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). The Spanish version at anidoapp.com/es/aviso-de-privacidad controls.

I. Who is responsible for your data (responsable)?

Orchid Media LLC, 110 Somerville Ave, Chattanooga, TN 37405, USA. We don't have an office in Mexico. Our privacy team handles your requests: privacy@anidoapp.com.

II. What personal data do we process?

• About care team members: name, email, optional phone, profile photo, sign-in data, preferences, role, shifts, activity in Anido, device and technical data, support messages, and your choices. Details are in section 3.1.
• About the elder: identity data, health data, medications, doses, vital signs, visits, documents, AI summaries, notes, insurance data and elder mode activity. Details are in section 3.2.
• About other people: doctors, pharmacies, emergency contacts and invited people. Details are in section 3.3.

Sensitive data (datos personales sensibles). We process health data about the elder: conditions, allergies, blood type, medications, doses, vital signs, visits, medical documents, AI summaries, notes and handovers. Health details in support messages are sensitive too. We also give insurance data the same protection.

III. What do we use your data for?

Primary purposes. These are necessary for the service you asked for:

1. Create and manage your account and sign you in.
2. Keep the elder's care record and show it to the care team the organizer chooses.
3. Send reminders, alerts, hand-off requests and the daily digest.
4. Prevent double doses and warn when supplies run low.
5. Create the exports you ask for.
6. Answer support requests.
7. Keep Anido secure, prevent fraud and fix problems.
8. Send service messages, such as sign-in codes and notices of changes.
9. Comply with the law and defend our rights.

Express consent for sensitive data. We process health data only with your express written consent. You give it through your signed-in account by ticking a separate, unticked box. We ask at three moments: when you create your account, when an organizer creates an elder's profile, and before you first invite someone to see the elder's health data. We keep a record with the date and policy version.

Optional features that need separate consent:

• AI summaries. We send medical documents to our AI provider only if you give separate, express consent (section 6).

Secondary purposes. These are not necessary for the service. We do them only if you say yes:

1. Product analytics to improve Anido.
2. Measuring our ad campaigns.
3. Marketing emails about Anido.
4. Using de-identified data to improve Anido's AI.

How to refuse secondary purposes. All of them are off until you turn them on. You can turn them off at any time in Settings › Privacy & data, or email privacy@anidoapp.com. Saying no won't affect your use of Anido.

Who receives your data. Our service providers (encargados) process data only on our behalf and under contract. This is not a transfer. We communicate the elder's data to the care team members the organizer invites, as part of the service and with the consent described above.

We send ad measurement data to Meta, Google and TikTok (only on our public marketing website, after cookie consent) only with your consent, and never health data. We disclose data to authorities only where the law requires it. We don't make any other transfers without asking you first (section 8.4).

Data of the elder obtained through the family. The elder's data comes from the organizer and the care team. We make a notice written for the elder available through the organizer, at anidoapp.com/es/aviso-persona-mayor, and again when elder mode is set up.

IV. How can you limit the use or disclosure of your data?

• Turn optional uses on or off in Settings › Privacy & data.
• Turn off AI summaries, and use "Hide details on lock screen" for notifications.
• Organizers can remove members, change their roles, and turn off a caregiver's access to documents.
• Unsubscribe from marketing emails with the link in each email.
• Email privacy@anidoapp.com. We keep a record of your choices so we respect them.

V. How do you exercise your ARCO rights or revoke consent?

You have the right to Access your data, Rectify it, Cancel (delete) it, and Oppose its use (ARCO rights). You can also revoke your consent at any time. Revoking it doesn't affect what we did before, but we may no longer be able to provide the service.

How to ask. Email privacy@anidoapp.com, or use Settings › Privacy & data in the app. Your request must include:

1. Your name and an email address where we can reply.
2. A document that proves your identity, or, if someone asks for you, proof of their authority to represent you.
3. A clear description of the data and the right you want to exercise.
4. Anything that helps us find your data, such as the care team or elder's name.
5. For corrections, the change you want and any document that supports it.

Deadlines. We answer within 20 days of receiving your request. If we grant it, we carry it out within 15 days after our answer. We'll reply by email and deliver data electronically. This is free.

The elder's rights. The elder, or their legal representative, can exercise these rights over the elder's data without having an account (section 4).

Automated decisions. We don't make decisions about you based only on automated processing. AI summaries are explanations that a person reviews, not decisions.

Security breaches. If a security breach significantly affects your rights, we'll tell you promptly, with what happened and what you can do.

Complaints. If you aren't satisfied with our answer, you can go to the Secretaría Anticorrupción y Buen Gobierno, the Mexican authority for personal data protection. For consumer matters, you can contact PROFECO.

Cookies and similar tools

Our website uses cookies and similar tools. Essential ones keep you signed in and remember your settings. Analytics and ad tags run on public pages only if you accept them. You can turn them off in Cookie settings (section 19).

VI. How will we tell you about changes to this notice?

We'll post the new version at anidoapp.com/es/aviso-de-privacidad and update the date. For important changes, we'll tell you in the app and by email at least 30 days before they take effect. If a change needs your consent, we'll ask for it.

22.C Colombia and other Latin American countries

If you live in Colombia, read 22.C.1. If you live in another Spanish-speaking country in Latin America, read 22.C.2.

22.C.1 Colombia

This section is our personal data processing policy (Política de tratamiento de información personal) for Colombia, under Law 1581 of 2012 and Decree 1074 of 2015, which includes Decree 1377 of 2013. You can read it on its own. We also publish it separately, in Spanish, at anidoapp.com/es/colombia.

The rest of this Privacy Policy gives more detail, but you don't need it to understand this section. The Spanish version of this section controls if the two differ.

Words we use here:

• Data subject (titular): the person the data is about. That can be you, as a care team member, or the elder whose care is recorded.
• Processing (tratamiento): anything we do with data, like collecting, storing, using, showing it to the care team or deleting it.
• Controller (responsable): who decides why and how data is processed. Processor (encargado): who processes data on the controller's behalf, like a hosting provider.
• Sensitive data: data that affects your privacy or could lead to discrimination if misused, like health data.
• Authorization (autorización): your prior, express and informed permission for us to process your data.

Who is responsible for your data?

Orchid Media LLC, a US company that offers the Anido app and website.

• Domicile and address: 110 Somerville Ave, Chattanooga, TN 37405, USA
• Email: privacy@anidoapp.com
• Phone: +1 (520) 646-6997
• Website: anidoapp.com

We don't have an office, domicile or representative in Colombia. We help you in Spanish or English, by email and in the app.

What data do we process, and where does it come from?

• About you: name, email, profile photo and, only if you add it, phone; sign-in data; preferences; your role, shifts and the invitations you send; what you record in Anido; device and technical data; support messages; and your authorizations. Only if you agree: analytics events and ad measurement data.
• About the elder: identity (name, nickname, birth date, photo), health (conditions, allergies, blood type, medications, doses, vital signs, visits, medical documents, AI summaries, notes and handovers), insurance, Medical ID and emergency contacts.
• About other people: doctors, pharmacies, emergency contacts and invited people.

We get it from you, your care team and your device. Full details are in section 3.

How do we process your data, and why?

We collect, store, use and delete your data. We also show it to the care team the organizer chooses, and send it to our processors so Anido works.

Purposes needed to provide the service:

1. Create and manage your account and sign you in.
2. Keep the elder's care record and show it to the care team the organizer chooses.
3. Send reminders, alerts, hand-off requests and the daily digest.
4. Prevent double doses and warn when supplies run low.
5. Create the exports you ask for.
6. Answer your support requests.
7. Keep Anido secure, prevent fraud and fix problems, using crash reports with personal and health information removed.
8. Send service messages, like sign-in codes and notices of changes.
9. Comply with the law and defend our rights.

Optional purposes (only if you authorize them separately):

1. AI summaries of documents (section 6).
2. Using de-identified data to improve Anido's AI.
3. Product analytics.
4. Measuring our ad campaigns.
5. Marketing emails about Anido.

All of them start off. You can turn them off at any time in Settings › Privacy & data. If you say no, you keep using Anido the same way.

We never use your family's health information for ads. We don't use health data for marketing.

Sensitive data: health information

We treat as sensitive data all of the elder's health information (conditions, allergies, blood type, medications, doses, vital signs, visits, medical documents, AI summaries, notes and handovers) and any health details in support messages. We give insurance data the same protection.

You don't have to authorize the processing of sensitive data, and answering questions about sensitive data is optional. Every health question in Anido, like conditions, allergies or blood type, can be left blank. We always tell you which questions are about health.

We use health data only to keep the care record, show it to the care team, send reminders and, if you separately allow it, create AI summaries.

How we ask for authorization. With a separate, unticked box, at three moments: when you create your account, when an organizer creates an elder's profile, and before you first invite someone to see that data.

What happens if you don't give it. Anido is a care record, and that record is health information. So today, the health box is needed to create an account and to create an elder's care team. Without it, we don't store any health data.

The elder's data. The elder is the data subject. If the elder can decide, the authorization is theirs, and the organizer confirms they have it. If not, it can come from whoever the law allows: the elder's legal representative or attorney-in-fact, or the support person named in a support agreement or a court decision (Law 1996 of 2019).

How do you give authorization, and how do we prove it?

Your authorization must be prior, express and informed. We show you a privacy notice (aviso de privacidad) before we ask.

• For your account data: when you sign up, you see the privacy notice, tick the Terms box and create your account. That authorizes us to process your data for the purposes needed to provide the service.
• For health data: with the separate box explained above.
• For each optional purpose: with its own toggle or box, which starts off.

Your silence never counts as authorization. We keep proof of each authorization: the date and time, the text you saw, its version, the language and the platform. You can ask us for a copy.

When the law doesn't require authorization. We don't need your authorization when a public entity asks for data while performing its legal duties or there is a court order, for public data or Civil Registry data, or in a medical or health emergency. Even then, we apply this policy.

What are your rights?

Besides your constitutional right of habeas data, as a data subject you can:

1. Know, update and correct your data. This includes data that is partial, inaccurate, incomplete, fragmented or misleading, or whose processing is prohibited or wasn't authorized.
2. Ask for proof of the authorization you gave us.
3. Be told, if you ask, how we use your data.
4. File complaints with the Superintendence of Industry and Commerce (SIC) about violations of the law, after making your query or claim with us.
5. Revoke your authorization or ask us to delete your data, when we don't respect the principles, rights and guarantees of the law. This doesn't apply if you have a legal or contractual duty to remain in the database.
6. Access your personal data free of charge.

What you recorded in a care team. If we delete your data, the entries you made in a care team stay in that team's record, so the elder's history stays accurate. If you ask, we replace your name with "Former member" (section 15).

Who can use these rights: you, after proving your identity; your successors (causahabientes); your legal representative or attorney-in-fact; a support person, when the support agreement or court decision provides for it; and anyone in whose favor the right was stipulated. The elder, or whoever acts for the elder, doesn't need an Anido account.

How do you make a query or a claim?

Area responsible: the Orchid Media LLC privacy team handles your queries and claims.

• Email: privacy@anidoapp.com
• In the app: Settings › Privacy & data
• By mail: Orchid Media LLC, Attn: Privacy, 110 Somerville Ave, Chattanooga, TN 37405, USA

Queries and claims are free.

Queries (consultas). Use a query to find out what data we have about you or how we use it. Write to us with your name, the email where we should reply, and what you want to know.

• We answer within 10 business days of receiving it.
• If we can't, we'll tell you why and when we'll answer. That will never be more than 5 business days after the first deadline.

Claims (reclamos). Use a claim to correct, update or delete your data, revoke your authorization, or tell us you think we broke the law. Your claim must include:

1. Your name and how you identify yourself.
2. A description of the facts.
3. The email or address where we should reply.
4. Any documents you want to use as proof.

Here's how we handle it:

• If something is missing, we ask you for it within 5 days of receiving the claim. If 2 months pass without you completing it, we treat the claim as withdrawn.
• If the claim isn't for us, we forward it to whoever should handle it within 2 business days and tell you.
• Once the claim is complete, within 2 business days we tag your data with the label "claim in process" (reclamo en trámite) and the reason. The label stays until we decide.
• We answer within 15 business days, counted from the day after we receive it.
• If we can't, we'll tell you why and when we'll answer. That will never be more than 8 business days after the first deadline.

Before you go to the SIC. The law asks you to make your query or claim with us first. After that, if you disagree with our answer, you can file a complaint with the Superintendence of Industry and Commerce (SIC), Office for the Protection of Personal Data (Delegatura para la Protección de Datos Personales).

Who do we communicate your data to?

• Your care team. They see the elder's care information, based on each person's role (section 5).
• Our processors. Our service providers, like hosting, database, email, notifications, AI and crash reports, process data only on our behalf. Colombian law calls this a transmission (transmisión). Each one signs a contract that requires it to process data only on our instructions and under this policy, protect it and keep it confidential. The list is at anidoapp.com/subprocessors.
• Ad measurement partners. Only if you authorize it, and they never receive health data (section 9).
• Authorities. Only when the law or a court order requires it.

Your data leaves Colombia. We store it in the United States (section 11). The SIC includes the United States on its list of countries with an adequate level of data protection. Our contracts with processors also require them to protect it the way this policy does.

Before we share your information with third parties in any new way, we'll ask you first. Section 8.4 explains how.

How do we protect your data?

We use encryption, access limited to each care team, very limited staff access and security logs (section 13). If a security incident affects your data, we report it to the SIC as the law requires, and we tell you.

When does this policy apply, and for how long?

This policy applies from October 2, 2026. Our databases stay in force while we offer Anido and the data is needed for the purposes in this section. Each kind of data is kept for the times in section 12, and then deleted or de-identified.

How will we tell you about changes?

We'll post each new version at anidoapp.com/es/colombia with its date. If a change is substantial, we'll tell you in the app and by email at least 30 days before it applies.

If a change affects the purposes or who is responsible for your data, we'll ask for a new authorization. If you don't give it, we won't use your data for the new purpose. Earlier versions are available on request.

22.C.2 Other Latin American countries

Your rights in every Spanish-speaking country. You can ask to see, correct, update and delete your data, object to a use, and withdraw consent, as in section 14. Email privacy@anidoapp.com or use Settings › Privacy & data. We answer within the time your country's law sets, shown below.

Health data consent everywhere. We ask for consent to process health data with a separate, unticked box when you create your account, again when an organizer creates an elder's profile, and before you first invite someone to see it. You never have to give health data, and we'll always tell you which questions are about health. Without it, though, Anido can't keep a care record.

Transfers to the United States. Your data is stored in the United States (section 11). When you create your account, the health information box asks your consent to store it there. We also have contracts with our service providers that require them to protect your data.

If you live in Colombia, your rules are in 22.C.1, not in this table.

Argentina. You have the right to access your data free of charge at intervals of no less than six months, unless you show a legitimate interest in asking sooner. The AAIP, as the authority for Law 25.326, handles complaints about violations of personal data rules.

Chile. Chile's new data law, Ley 21.719, is scheduled to take effect on December 1, 2026. A bill may move this date. Until then, Ley 19.628 applies.

22.D European Union and United Kingdom

We don't offer or advertise Anido in the EU or UK. If you live there and someone invites you to a care team, the EU or UK General Data Protection Regulation (GDPR) may apply. This section explains your rights.

• Controller: Orchid Media LLC (section 1).
• Representative: Not appointed (Anido isn't offered in the EU or UK at this time)
• Data protection officer: Not appointed (Anido isn't offered in the EU or UK at this time)
• Legal bases: see the EU and UK column in section 7.1. We process health information only with explicit consent.
• The elder's information. If the elder lives in the EU or UK, their information comes from the care team, not from them. This policy and the notice at anidoapp.com/elder-information-notice tell them what we hold and how to use their rights.
• Transfers: your information is stored in the United States. We rely on the EU-U.S. Data Privacy Framework (and its UK Extension) for providers certified under it, and on the European Commission's standard contract clauses (with the UK Addendum) for others.
• Your rights: access, correction, deletion, restriction, data portability, objection, and withdrawing consent at any time. Use the steps in section 14. We'll answer within one month, or within three months for complex requests, and we'll tell you if we need longer.
• No automated decisions with legal or similar significant effects. AI summaries are explanations a person reviews.
• Complaints: you can complain to the data protection authority where you live or work. In the UK, that's the Information Commissioner's Office (ICO).
• Age: you must be 18 or older to have an account.