Your family's information, treated with care

Who we are

Alutra is a care coordination app built in New Zealand and used by families around the world. It is operated by Alutra Care Limited, a New Zealand company. In this policy, “we”, “us” and “our” mean Alutra Care Limited. This policy covers both this website (alutra.care) and the Alutra app (alutra.app).

We handle personal information in line with the New Zealand Privacy Act 2020, and we honour the privacy rights that apply to you under the laws of the place where you live.

What we collect

On this website: very little. The site carries Meta's advertising pixel — see Advertising, below, for exactly what it does and doesn't see. The Resource Hub's self-check runs entirely in your browser — nothing you answer is stored or sent anywhere. Beyond that, the only personal information involved is technical: like most websites, our hosting provider keeps short-lived logs (such as IP addresses) to keep the site running and secure, and nothing more.

The Carer Check (at alutra.care/carer-check) is the one page that asks you questions, so it is worth being exact about. Your answers are not stored — not on our servers, not against your name, not anywhere. The eight questions are worked out in your own browser, and when you reach the result we record a single anonymous line: which of the four result shapes came back, which suggestion was highlighted, and whether you arrived from an ad, a shared link or directly. That line has no email address, no identifier, and no date more precise than the day, so there is deliberately no way to connect it back to you or to anything else we hold.

If you then ask us to email your result, that address is stored — because we need it to send the email. That is a single message you asked for. The tickbox beside it is separate and starts unticked; only ticking it adds you to our occasional emails for carers, and every one of those carries an unsubscribe link that works immediately.

Advertising: this website carries Meta's advertising pixel on every page, because that is how we know whether an ad was worth running. It records that a page was visited and, on the Care Kit and Funding Guide pages, that a kit was requested. The events we send it carry nothing else — no names, no email addresses, no answers, and nothing from inside the app. Like all Meta pixels, it uses a Meta cookie to recognise a returning browser. Our lead-magnet pages can also carry Google's conversion tag, for the same purpose. On the Carer Check, a conversion is recorded only when you submit the form to have your result emailed — never as you answer questions, and never on the result itself.

In the app, we collect what's needed to make a circle work:

• Account basics: your name, email address, and timezone, so we can sign you in and show things at the right local time.
• What your family chooses to share in the circle: details about the person being cared for, medications, appointments, tasks, notes, messages, and photos. Some of this is health information — your family decides what goes in, and it stays within the circle.
• Notification details: if you turn on notifications, your browser gives us a push subscription so we can deliver them. You can turn this off any time in your device or browser settings.
• Payment status: if your family subscribes on the web, Stripe processes the payment and tells us your subscription status. Your card details go to Stripe, not to us.

How we use it

We use your information to run Alutra — nothing more:

• Showing each circle member what their role allows them to see
• Sending the notifications and reminders your circle has turned on
• Keeping the service secure and fixing problems
• Answering you when you contact us

We don't sell personal information. We don't use it for advertising. We don't use the contents of your circle to train AI models.

Who can see your circle

The people your family invites — and that's the design, not just the promise. Access rules are enforced on every record in our database. What each member sees depends on their role: for example, detailed medical information is visible to care coordinators, while other family members see safety basics. The person receiving care controls their own private information too.

Our small team can access systems for maintenance and support, under confidentiality obligations, and we look at circle content only when it's genuinely needed to fix a problem you've raised. We would disclose information outside these rules only if the law required it or someone's safety depended on it.

The services that help us run Alutra

A short list of providers processes data on our behalf, each doing one job:

• Supabase — our database and sign-in service, where circle data is stored
• Vercel — hosts the website and the app
• Stripe — processes payments
• Resend — delivers sign-in emails (magic links)

These providers may store data in countries other than your own. We choose providers with strong security and privacy safeguards, and we remain responsible for your information wherever it is stored on our behalf.

How we protect it

• All connections are encrypted (HTTPS), and data is encrypted at rest by our database provider.
• Row-level security rules are enforced in the database itself — every request is checked against who you are and which circle you belong to, on every single record.
• Sensitive medical fields have additional access restrictions on top of circle membership.
• Sign-in is handled by Supabase Auth; we never store passwords ourselves.

No system is perfect. If a breach ever put your information at risk, we would tell you — and notify the relevant privacy regulator — promptly, as the law requires.

Your choices and rights

• See it: ask us for a copy of the personal information we hold about you.
• Fix it: correct anything that's wrong — most details you can edit yourself in the app.
• Delete it: delete your account and your personal information — in the app under Settings → My profile, or see how to delete your account if you can no longer sign in.
• Quiet it: turn notifications off any time in your settings.

Depending on where you live, local law may give you additional rights over your personal information. We will honour the rights that apply to you under your local law, and we consider all other reasonable requests in good faith. Email hello@alutra.care — we respond promptly and we don't charge for these requests.

If you feel we haven't handled your information properly, you can also complain to your local privacy regulator. In New Zealand that's the Office of the Privacy Commissioner (privacy.org.nz); in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the United Kingdom, the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to put things right first.

If information about you is in a circle — but you're not a user

Alutra circles often hold information about the person receiving care, and that person may not have an Alutra account themselves. If a circle holds information about you, you can ask us what that is and ask us to correct anything that's wrong — whether or not you've ever signed in. Email hello@alutra.care; we'll verify who you are before acting. Where you ask us to remove information about you, we'll work with the circle to resolve it, and we'll honour any right to deletion you have under your local law.

We also ask every circle to share thoughtfully: add information about someone the way you'd want information about you added — with their knowledge and, wherever possible, their agreement.

How long we keep things

For as long as your circle needs them. If you delete something, it's removed from your circle.

When you delete your account, you lose access straight away and we permanently erase your personal information within 30 days. We hold it for those 30 days for one reason: so that a deletion made by mistake, or by someone who is not you, can be undone. Your private direct messages are deleted.

One thing does not go with you, and we want to be plain about it. Alutra circles are shared records of caring for someone. The care notes, check-ins, appointments and photos you added are part of another family's history — often of a person who is unwell, and sometimes of a person who has since died. We keep that content in the circle and remove you from it: your name is replaced with “Former member”, and it can no longer be linked back to you. Messages you sent to the person being cared for stay with them for the same reason. If you want particular things you wrote removed as well, email hello@alutra.care and we'll work through it with you and the circle.

We also keep payment records for as long as tax and accounting law requires, and anything else the law requires us to hold for as long as it requires. Nothing more. The full process, including what to do if you have uninstalled the app, is on our account deletion page.

Children

Alutra accounts are designed for adults. We do not knowingly collect personal information from children under 13, and Alutra is not directed at them. If we learn that a child under 13 has created an account, we will delete it and the associated personal information. If your family includes younger members, an adult in the circle should decide what's shared with them and about them.

Changes to this policy

If we change this policy in a way that matters, we'll say so in the app before the change takes effect — not just quietly update this page. The date at the top always tells you when it was last revised.

How to reach us

Questions, requests, or concerns: hello@alutra.care. A human reads it.

Alutra Care Limited is the company responsible for your personal information under this policy.