Privacy Policy

We protect your information, especially your medical information. Here we explain in plain language what information we collect, why, who sees it, how long we keep it, and what your rights are.

1Who is responsible for your information

Medical information (visits, records, treatment plan, health readings, photos, chat with a healthcare professional) is the responsibility of the service provider who treated you. Currently this is Care Plus (Care Plus (2020) Ltd, Company No. 516233723, info@careplus.co.il). The service provider is the "database owner".

Hospedale is a service of Care Plus (2020) Ltd, Company No. 516233723, which operates the website and the app and provides the medical service. Care Plus (2020) Ltd is therefore the database owner for all the information: the details you gave in forms on the website, your account details, your use of the app, and your medical information. If other service providers join in the future, we will update this policy, and the service provider's name will appear on every booking.

Privacy Protection Officer: Nissim Asbi, info@careplus.co.il

2What information we collect

Information	Examples	Source
Account details	Name, phone, email, address, date of birth, and the patient's ID number, used to open a patient file and identify the patient. The ID number is stored encrypted, and is never sent by email or WhatsApp	From you: in the app, in a call with a representative, or during a visit. The booking form on the service provider's website sends only name, address, and phone or email, with no ID number
Family members and permissions	Who is authorized, the type of relationship, a copy of a power of attorney, a court order, or an ID card appendix	From you
Bookings and payments	Service, time, treatment address, price, receipts	From you, and from the service provider
Medical information	What you need (the reason for booking, answers to the intake questions, whether there is a medical order, and any note you wrote), visit records, treatment plan, results, photos you sent	From you, in the app or in the booking form on the service provider's website (the reason for booking is required, the rest is optional, and you give explicit consent before sending), from the staff member, and from the service provider. If someone else filled in the form for you, they declared that they did so with your consent, or as someone authorized to do so
Health readings	Blood pressure, blood sugar, weight, and more	From you: manual entry, a photo, or a device you connected
Conversations	Chat with a healthcare professional, chat with the support center, conversations with the virtual assistant	From you
Location	Only when you tap "Near me"	From your phone, with your permission
Technical information	Device type, app version, IP address, sign-in log	From your phone
Reviews	What you wrote about the service	From you

We do not store credit card details. Payments are processed by Grow, and we keep only a token.

3Why we use your information

To provide the service: to book appointments, send the staff member, treat you, and keep records.

To charge you, issue receipts, and handle refunds.

To let family members help, only with the permission you gave (Terms of Use, section 5).

To keep things secure: to identify you, log who viewed your information, and prevent fraud.

To comply with the law: medical record-keeping duties, tax duties, and reporting when the law requires it.

To improve the service: using statistical information only, with no identifying details.

Marketing: only if you agreed to it separately (section 9).

We will not use your information for any other purpose without asking you, and we will not sell it to anyone.

4Who sees your information

The staff member treating you, and service provider staff who need the information for their work. Every view of your file is logged.

Family members, only according to the permission you gave or a legal document (Terms of Use, section 5). In the app, you can see who viewed your information.

Other service providers in the app do not see your information, unless you booked a service with them.

Vendors who work for us ("data processors"), only what they need for their work, and under an agreement that requires them to protect the information:

Vendor	Why
Oracle Cloud	The servers that run the system, and the backups. Everything is in Israel (Jerusalem region). Backups are encrypted before they leave the server
Google	Email and account services. Maps (Google Maps): turning the treatment address into a point on the map and calculating the driving distance, for pricing (section 7)
Meta (WhatsApp)	WhatsApp messages: codes and confirmations from 050-522-3408, and conversations with the support center at 053-353-3379
Grow	Credit card processing
Morning	Issuing receipts and invoices
OpenAI and Anthropic	The virtual assistant (section 6)
Apple and Google	Phone notifications, and connecting to health devices if you chose to

Authorities: only when the law requires it.

5Transferring information abroad

Some vendors store or process information outside Israel. We transfer information abroad only in accordance with the Privacy Protection Regulations (Transfer of Data to Databases Abroad), and only to vendors who have committed to protecting it. Our servers and database are in Israel. Vendors that receive information outside Israel: Meta (WhatsApp, in the US) receives the phone number and the content of the message, such as a sign-in code or a booking confirmation. Google (Maps) receives a city name or the address where care is given, without a name, a phone number or medical information, to calculate distance. Emails, to you and within the team, go through Google. The AI providers (section 6) will receive information only once the assistant is turned on.

6The virtual assistant (AI)

When you write or speak to the assistant, your message is sent to an AI provider (OpenAI or Anthropic) so it can answer you.

Before the message is sent, we hide names, ID numbers, phone numbers, and addresses.

The assistant will only be turned on after we sign an agreement with the AI providers that requires them not to store the information and not to train models on it. The virtual assistant in the app is not active yet.

In a voice conversation, we will ask for your consent before recording. The recording is converted to text, and the audio file is deleted.

Conversations are kept by us without identifying details, for a period of TBD, to improve the service.

7Location

We will ask for location access only when you tap "Near me", and the permission applies only while you are using the app.

We do not keep a location history. Your location is used only for the search. A booking stores the address you confirmed.

You can always type a city or address instead of sharing your location.

Treatment address and travel price: Some services are priced by the distance to your address. So our server sends only the address to Google Maps, to turn it into a point on the map and calculate the driving distance by road. No name, phone number, or medical information is sent. We do not keep the map point, only the calculated number of kilometers.

Estimated price by city: When you type only a city name to see an estimated price, only the city name is sent to Google Maps. We keep the city's map point for up to 30 days, and it is not linked to you.

When the staff member is on the way to you, you will see their location only until they arrive.

8Health readings and devices

We connect to a device or a health app (such as Apple Health) only with your permission, separately for each type of reading. You can disconnect at any time.

Readings that were added to your file are kept in it as part of your medical record.

9Messages and marketing

Service messages (booking confirmation, "The staff member is on the way", receipt) are sent in the app, by SMS, or by WhatsApp from 050-522-3408.

Marketing messages are sent only if you checked that you agree, separately from signing up. You can stop them at any time, free of charge, and the opt-out takes effect immediately.

10Information security

Sensitive information is encrypted, both in transit and at rest. Files and documents are stored encrypted, never in a public folder.

Access is limited by role, and every view of personal information is logged.

Care Plus holds ISO 27001 and ISO 27799 certificates, the standards for information security and health information security. Hospedale's systems are not yet within the scope of the certification. They are being built to the same standards, and extending the certification to them is planned. We also follow the Privacy Protection Regulations (Data Security).

If a security incident happens, we will follow our procedure and report it to the Israeli Privacy Protection Authority and to you when the law requires it.

11How long we keep information

Information	How long
Medical record (including chat with a healthcare professional, readings in your file, photos)	As the law requires of the service provider, many years after the last treatment
Receipts and invoices	As tax law requires
Access logs and consents	At least 24 months, and as needed to prove that consent was given
Account details	As long as the account is open
Conversations with the virtual assistantTBD, without identifying details	Location
Not stored	Backup copies (encrypted)

Deleted in the regular backup cycle. Even information you deleted stays in the encrypted backup until it is deleted

12Your rights

To access your information and get a copy of your medical file. You can request this in the app or through the support center.

To request a correction of information that is incorrect, incomplete, or out of date.

To close your account. When you close your account, we will delete:

Sign-in details;

Saved card;

Marketing preferences;

Device connections;

Family member permissions;

Conversations with the assistant.

Medical records and receipts are kept, because the law requires it. They are kept locked, and we will not use them for any other purpose. We will handle your request within 30 days at most, and usually within a few days. You have 7 days to change your mind.

To stop receiving marketing messages, immediately.

To revoke a family member's permission, immediately.

To complain to the Israeli Privacy Protection Authority if you think we did not respect your rights.

13Children

A child under 18 does not open an account on their own. A parent or guardian manages the profile for them, and at 18 the child takes control of it.

14Cookies and tracking in the app

The website and the app have no advertising or tracking tools, and no third-party cookies. The website does not store cookies. Your browser keeps only your choice in the cookie notice, and the request number until the thank-you page is shown. The app has two cookies of our own: one that keeps you signed in, and one that remembers the city you chose, for 180 days. If we add a tracking or advertising tool, we will ask for your consent first.

15Changes to this policy

We will notify you in the app of any material change before it takes effect. If a change requires new consent, we will ask for it.

16Contact us