Data Safety Requests

Effective date: September 27, 2026

You can request access, correction, export, or deletion. Clients can download their data and delete their account themselves from Settings → Your data; every other request is handled manually. Visiting this page does not submit a request or delete anything.

Self-service for clients

• Export. Ask for an export and CareCircle prepares a ZIP file of what you can see in your portal: your profile, journals, habits, health logs, messages, appointments, released session notes, invoices, signed forms, and shared files. We email you when it is ready; you download it from your signed-in account. The file is deleted after 7 days, and you can ask for a new one once every 24 hours. Clinician notes that have not been released to you and the Practice's internal notes are not included; ask the Practice for its full record.
• Account deletion. You confirm by typing your account email. Your account is deleted 30 days later; until then you are signed out on other devices, can only download your data or cancel, and receive a reminder 7 days before. When it runs, CareCircle deletes your sign-in and the data it controls: journals, habits, health logs, AI conversations, personal notes and resources, notifications, and your messages in conversations with other clients. The Practice keeps its clinical record (profile details, appointments, session notes, invoices, signed forms, shared files, and conversations with clinicians) for the period its rules require, and is told that your portal account was closed.
• Both actions need a recent sign-in, and both are recorded in the audit log.

How to ask

For a clinical record, first contact the professional or practice that invited you. It controls that record and decides what must be retained. For a CareCircle account or platform privacy request, email Nicholas Ponari, Data Privacy Officer, at nicholas@ponari.ca or write to 5150 Rue Buchan, Montréal, Québec H4P 0A9, Canada. State the request type, your name, and the Practice name; do not include clinical details in an ordinary email or letter. We will arrange a secure identity check and transfer method.

What happens next

We aim to acknowledge a received request within five business days and provide a substantive response within 30 calendar days, subject to the shorter deadline that applies by law. If an authorized extension is needed, we will explain why and when to expect an answer. We will verify identity, route clinical requests to the Practice, and tell you whether information can be corrected, exported, or deleted. Legal or professional record-keeping may prevent immediate deletion; we will explain the specific reason and any remaining copies.

Professionals and Practices do not have self-service export or deletion yet, because their accounts carry records other people rely on; email the address above. We will coordinate a manual export or deletion where lawful and technically possible, record the outcome, and confirm completion or an unresolved limitation. The Retention Policy explains which records may have to remain. The Privacy Policy explains complaint options if you disagree with our response.