Last updated October 22, 2026.
Your account info (name, email, password, language preference), and whatever your family chooses to enter for the people you're caring for — medications, appointments, symptoms, notes, photos and documents, and audio recordings of visits (which are transcribed to text).
Everything lives in a managed Postgres database (Neon). Uploaded photos and documents are never given a public web address — they're served only through a route that checks you're logged in and belong to the right Circle first.
Only the members of your own Circle. Every record in the app is tied to a specific Circle, and every page and action checks that tie before showing anything — members of a different family's Circle cannot see your data, and you cannot see theirs.
Being honest about this: the person who operates Tovela has underlying technical access to the database it runs on, the same way any small self-run service works. This is not an independently audited or certified environment. We only ever access family data to fix a real problem or if you ask us to, never routinely.
When you use an AI feature (reading a photo/document, chatting with Tovela, transcribing a recording, or translating a note), the relevant content is sent to our AI providers — Anthropic (Claude) and Deepgram (transcription) — to generate the result. A few summaries (such as a person's "current situation") also refresh automatically when their records change. We send only the content that feature needs, not your whole account. These providers process that content to return the response to Tovela; they are not given ongoing access to your account.
We use Anthropic through its commercial API, whose terms state that content sent through it is not used to train its models. For transcription, we have opted out of Deepgram's model-improvement program, so your recordings are not used to train its models. The audio of a recording is not saved by Tovela — only the resulting text is kept. We do not sell your data, and we use no advertising or analytics trackers.
All traffic to Tovela is encrypted in transit (HTTPS). Passwords are stored only as one-way hashes, never in readable form. Sessions use signed, HTTP-only cookies. Every record belongs to one Circle and every page and action checks that membership first. You can add an app PIN, and a separate PIN for any person's private document vault. We keep the list of services that handle your data short: Neon (database), Vercel (hosting), Resend (email), Anthropic and Deepgram (AI, as described above), and Paddle (payments).
Tovela is not a HIPAA-covered entity and has not undergone formal healthcare-compliance certification. We handle your family's information carefully and honestly, but we don't want to overstate our security posture — treat this the way you'd treat any small, independently-run family tool, not a hospital's official record system.
If you subscribe to a paid plan, your payment is handled by Paddle. Paddle collects your card or other payment details and your billing information directly under its own privacy policy — Tovela never sees or stores your full card number. Tovela only receives what it needs to run your subscription, such as your plan, its status, and renewal date.
We use a small number of functional cookies only: one to keep you signed in, one to remember your language choice, and (if you set an app PIN) one to remember that you've unlocked the app recently. We don't use any analytics or advertising trackers.
We keep your family's data as long as your account is active. A Circle administrator can permanently delete a person from the app at any time, which removes that person's records and documents. An administrator can also download a copy of the Circle's written records and then permanently delete the whole Circle and all its data themselves, at any time, from Settings → Your family groups (an active subscription must be canceled first). Members who belong to no other Circle lose their login with it. You can also ask us to delete your account or your whole Circle's data — contact us below and we'll do it within 30 days. If you stop subscribing, your data is kept for you until you delete it or ask us to. Paddle keeps its own billing and tax records, as the law requires.
If this policy changes in a meaningful way, we'll update the date below and do our best to let active users know.
Tovela is operated by Harp Enterprises Corp. Questions about your data? Reach out at luis@harpenterprisescorp.com.