Privacy Policy

Last updated: November 4, 2026

At Protect & Assist, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.

Information We Collect

Account Information

When you create an account, we collect:

  • Name and email address
  • Phone numbers (for call forwarding and notifications)
  • Payment information (processed by our payment processor)
  • The family or partner invite link you signed up with, if any

If you use "Email me a link to finish later" on our pricing or phone check page, we use your email address only to send you that link and, if you ask, one reminder 3 days later. We keep it up to 14 days, then delete it. You can stop the reminder, or unsubscribe, from the link in the email.

Call Data

To provide our call protection services, we collect:

  • Incoming and outgoing call metadata (phone numbers, timestamps, duration)
  • Call recordings (with your consent, for screening and monitoring purposes)
  • AI-generated transcripts and summaries
  • Caller identification information provided by callers during screening

Support calls. When you call our support line, an AI assistant answers first. Support calls are recorded and transcribed by our service providers so we can help you, and we keep support call records for 90 days.

Care Plan Data

If you use our care plan features, we collect:

  • Medication names, dosages, and schedules
  • Health-related notes and observations
  • Appointment information
  • Drug interaction alerts generated by our system

Documents, Images, and Communications

If you use these features, we may process uploaded medication-label images, screenshots, medical timeline documents, support messages, device tokens, and notification preferences.

Android App, On-Device Call Screening, and Paired Phones

Our Android app can be installed in two roles. On a family member's phone it signs in to the dashboard and receives push notifications. On the protected person's phone it is paired with a one-time code instead of a login and can act as the phone's call-screening app. When it does, we process:

  • Incoming call decisions. For each incoming call the app checks the caller's number on the phone against the Protect & Assist numbers and trusted contacts your family set up. Calls from numbers saved in the phone's own contacts ring normally without being sent to us. An unknown call is not rung; the app answers "busy" or silences it so your carrier's conditional forwarding sends it to the Protect & Assist screening number, where it is handled like any other screened call. The app also sends us the caller's number, the time, and the decision so the phone's home screen and the family dashboard can show it. We do not read your contact list, call log, or call audio, and we do not request those permissions.
  • Pairing and device records. A device token, platform and model, app version, the SIM carrier name and network code (used only to choose the right call-forwarding code), whether call protection and notifications are turned on, and when the phone last checked in.
  • Call forwarding setup. When you tap "Turn on forwarding", the app dials your carrier's conditional-forwarding code, or opens the dialer with it filled in, so calls the phone does not take are sent to the Protect & Assist screening number. To verify it, Protect & Assist may place a short test call to the phone that the app diverts without ringing; that call is recorded only as a setup check.
  • Medication alarm responses. Whether "Yes, I took it" or "Not yet" was tapped and when, which becomes part of the medication record your family sees. If there is no answer, we may call the phone to remind them.
  • Push notifications. A push notification service delivers alarms and screened-call banners. Push tokens are removed when a phone is unpaired or an account is deleted.

The app does not contain advertising and does not use the Android advertising ID. Family members can remove a paired phone at any time from Settings, and the protected person can disconnect the phone from its home screen.

iPhone App and Paired iPhones

The iPhone app is waiting for Apple's review, so it isn't in the App Store yet. Our iPhone app can also be installed in two roles. On a family member's iPhone it signs in to the dashboard and receives push notifications. On the protected person's iPhone (iOS 26 or later) it is paired with a one-time code instead of a login. An iPhone does not screen calls in the app: the phone's own settings and the carrier's call forwarding are used instead.

  • Pairing and device records. A device token, platform and model, app version, whether notifications and alarms are allowed, and when the phone last checked in.
  • Medication alarms. The app schedules medication reminders as alarms on the phone. Whether "I took it" was tapped, and when, becomes part of the medication record your family sees. If there is no answer, we may call the phone to remind them.
  • Push notifications. Push notification services deliver alerts. Push tokens are removed when a phone is unpaired or an account is deleted.

The iPhone app does not contain advertising and does not track you across other companies' apps or websites.

Location of the Protected Person's Phone (Place Alerts)

Only if the protected person turns on location sharing on their own phone, the Protect & Assist app on that phone uses its precise location, including when the app is closed. The phone sends its latest position and the places it stops at, not a continuous route. We use it to show family members where the phone is when they look, and so they can be alerted about a long stop, or a visit to a bank, ATM or similar place after a call about money. We use a mapping service to look up the name and type of a place.

Of the positions the phone sends, we keep only the most recent one, and delete it when location is turned off or a day after it was taken, whichever comes first. Stops are kept for 30 days, and the usual length of a stop at each place for as long as the account exists. The protected person can turn location off at any time on the phone, or in the phone's settings; turning it off deletes the latest position. Location is not used for advertising and is not sold.

Activity of the Protected Person's Phone (Activity Alerts)

Only if the family turns on activity alerts and the protected person turns on activity sharing on their own phone (on iPhone, by allowing Motion & Fitness), the Protect & Assist app on that phone shares when the phone has been carried or moved, from the phone's motion and step history, and, at moments the app checks, whether the phone is unlocked. It never shares what the person does on the phone, which apps they use, or what is on the screen. Together with information we already have, such as answered calls, medicine reminders answered and when the app is opened, we use it to learn the person's usual daily routine; to show family members today's activity next to an average day; to ring an alarm on the phone asking the person to tap I'm OK when no activity has been seen by their usual time; and to alert family members when that alarm isn't answered, when the phone is in use at an hour that's unusual for the person, or when a day is much quieter than usual.

Phone activity is kept for 90 days. The protected person can turn activity sharing off at any time on the phone, and family members can turn activity alerts off in the app. Activity information is not used for advertising and is not sold.

Usage Data

We automatically collect:

  • Device information and browser type
  • IP address and general location
  • Pages visited and features used
  • Error logs and performance data

How We Use Your Information

We use your information to:

  • Provide and improve our call protection and care plan services
  • Screen calls and detect potential scam activity
  • Send medication reminders and make verification calls
  • Alert family members to suspicious activity
  • Process payments and manage your account
  • Communicate with you about your account and our services
  • Analyze usage patterns to improve our AI and services
  • Comply with legal obligations

Data Storage and Security

We use administrative, technical, and physical safeguards designed to protect personal information. No method of storage or transmission is completely secure.

  • Supported connections use encrypted transport
  • Cloud data and call recordings are protected by access controls
  • Payment card details are handled by our payment processor rather than stored by Protect & Assist
  • We restrict administrative access and log sensitive administrative actions
  • Requests that look like attacks on the service are blocked automatically. To block them, we keep a one-way code made from the network address they came from, never the address itself, while the block lasts and for up to 30 days after it ends

Health Information and HIPAA

Protect & Assist is a consumer support service and is not a healthcare provider, emergency service, or substitute for professional medical care. Do not assume that HIPAA applies to information you submit. If we contract with a HIPAA covered entity or business associate, any required business associate agreement and additional controls must be in place before regulated data is used in that relationship.

Third-Party Services

We use these kinds of service providers to provide our platform:

  • Sign-in and app infrastructure - Authentication and real-time features
  • Telephony and text messaging - Calls, and sending and receiving text alerts
  • Payment processing - Subscriptions and billing
  • Cloud hosting and AI services - Hosting, and AI processing, including transcription, call analysis, reading documents and photos you add, checking care plan details such as possible medication interactions, and answering messages to the assistant
  • Speech-to-text - Speaker transcription or diarization where enabled
  • Email delivery - Support email
  • Security and content delivery - Security and performance
  • Mapping - Looking up the name and type of a place, for place alerts
  • Push notifications - Delivering notifications to phones

Each of these providers has their own privacy policies governing their handling of data. We share personal information with these providers only as needed to run the Services, and we require them to protect it with the same or equal protection as this Privacy Policy.

Data Sharing

We do not sell your personal information. We may share your information:

  • With family members you've authorized to access your account
  • With service providers who assist in operating our platform
  • With the advertising platform whose ad you followed to our site, to measure our ads, as described under Campaign measurement
  • When required by law or to protect our rights
  • In connection with a business transfer (merger, acquisition, etc.)

Text messages. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the text message services. What we send and how to stop are on our Text Alerts page.

Your Rights

You have the right to:

  • Access - Request a copy of your personal data
  • Correction - Update or correct inaccurate information
  • Deletion - Delete your account and data in the app under Settings → Account → Delete account, or at protectandassist.com/delete-account from any browser: you confirm it is you and type DELETE. If you own more than one family account, Settings → Account → Danger Zone → Delete This Account deletes only the family account you are viewing.
  • Export - Download your data in a portable format
  • Opt-out - Unsubscribe from marketing communications

Account deletion removes your sign-in, the family accounts you solely own, their protected line, call history, care plan and medication records, paired phones and notification devices, and cancels any active subscription. Records we must keep for billing, consent, security or legal reasons are retained as described under Data Retention. To exercise any other right, contact us.

Data Retention

Retention depends on the feature, account settings, legal obligations, backups, and operational requirements. Our current service targets are:

  • Account and care-plan information: while the account is active and as reasonably necessary afterward.
  • Call recordings and transcripts are deleted automatically 90 days after the call, unless a legal hold applies.
  • Call summaries (AI notes) and the call list: while the account is active
  • Place alerts: a phone's latest position, until location is turned off and no longer than a day; stops, 30 days; the usual length of a stop at each place, until the account is deleted
  • Activity alerts: phone activity, 90 days; activity checks and alert records, 180 days
  • Security, billing, consent, and audit records: as needed for fraud prevention, compliance, and dispute resolution
  • First-month price, 30-day refunds and family invites: which invite a new account used and the dates of its payments and credits, and one-way codes (hashes) made from sign-ins, email addresses, phone numbers and payment cards. We keep the one-way codes after an account is deleted, so the first-month price and the 30-day refund stay once per customer and families can't invite themselves.
  • "Email me a link to finish later": the email address, up to 14 days
  • Backups: until overwritten through normal backup cycles

Deletion requests may be limited where retention is required by law, needed to complete a transaction, protect users, resolve disputes, or maintain security records.

Cookies & Local Storage

We keep tracking to the minimum needed to run the service. We do not use advertising cookies, cross-site trackers, or sell browsing data — ever.

  • Essential sign-in (required): Our sign-in provider stores tokens in your browser (cookies and local storage) so you stay signed in securely. The service cannot work without these.
  • Preferences (required for features you use): we store small settings in your browser's local storage — for example which protected line you last viewed, your setup-guide progress, and your support-chat session — so pages remember where you left off.
  • Family invite links (for a feature you use): when you open a family's or a partner's invite link, we keep its code in this browser's local storage for up to 30 days, so the account you create gets the invite. We use this stored code for nothing else (campaign measurement, below, is separate), and it is removed once it no longer applies.
  • Payments: if you subscribe, our payment processor sets cookies during checkout for security and fraud prevention.
  • Fonts & delivery: pages load fonts and libraries from content delivery networks; those providers receive your IP address as part of serving the file. We do not send them anything about your account.
  • Third-party analytics & advertising: we do not run third-party analytics, ad trackers or advertising pixels on this site. If you arrive from one of our ads, we tell that advertising platform that a sign-up or purchase happened, using a scrambled (hashed) email, the ad's click code and your browser type, so it can measure our ads.
  • How the site is used (our own count): we count which pages are opened, which buttons and links are tapped, how long a page is looked at, and where visits end, on our own servers, to make the site easier to use. It sets no cookies and stores nothing in your browser. Visits are grouped by a code that changes every day. From a visit's network address we work out its general area (city, state and country) as it arrives, and we keep the address itself for 30 days, to tell visits apart and to spot abuse, then delete it; the area stays. When you're signed in, it notes which pages of your account you open. Our phone apps don't send it, and it is skipped when your browser sends Global Privacy Control or Do Not Track.
  • Campaign measurement: when you arrive from one of our ads, a referral link or another site, we store a random first-party campaign code on this browser for up to 30 days, so a sign-up can be credited to where it came from. If you clear campaign information, that choice is saved so we can respect it. This is separate from essential sign-in storage.

Your choices: you can clear cookies and site data at any time in your browser settings (you'll be signed out and preferences reset). Campaign measurement is off in our phone apps and when your browser sends Global Privacy Control or Do Not Track, and you can turn it off with "Clear campaign information" under Campaign measurement. Apart from campaign measurement, if we ever add non-essential cookies, we will ask for your consent first. California residents: we do not sell personal information. Telling an advertising platform that someone who followed our ad signed up or paid may count as "sharing" under the CCPA/CPRA; Global Privacy Control and "Clear campaign information" opt you out of it. For any privacy request, use the contact below.

Campaign measurement

When you arrive from one of our ads, a referral link or another site, we link where you came from to your new account so we can compare signups, confirmed payments and completed phone setup by where they came from. We keep the campaign labels on the link, the ad's click code and the name of the site you came from. A referral link gets the credit first, otherwise the latest such visit within 30 days before signup; a later visit does not change it. Codes on this browser expire after 30 days, visits no account claims are deleted, and click codes are erased 120 days after signup. An account's campaign association remains until you remove it or delete your account. If you email yourself a link to finish later, the link carries this browser's campaign code, so signing up on another device is credited the same way; we don't keep the code with your email.

This feature does not store full web addresses, browsing history, fingerprints, or call content, and no advertising script runs on our pages. If you came from one of our ads, our servers tell that advertising platform when you sign up and when you first pay, using a scrambled (hashed) email, the ad's click code and your browser type, so it can measure our ads; nothing else about you or your family is sent. Our system still records account creation, billing and setup to operate the service. Turning campaign measurement off leaves those records unattributed.

You can turn it off without affecting signup or service. We treat a browser's Global Privacy Control or Do Not Track signal the same way. Clear campaign information below; sign in on this browser to also remove a campaign association already linked to your account and stop any ad platform notice not yet sent. This does not delete necessary account, payment or setup records.

Children's Privacy

Our services are not intended for children under 18. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through our platform. Your continued use of our services after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy, please contact us.