How Carl protects your data

01

Our philosophy

Security, privacy, and professional confidentiality aren’t features added as an afterthought: they’re part of Carl’s design from the very first line of code.

Three principles guide every one of our technical decisions: collect only what’s necessary, never let sensitive information travel or be stored without protection, and leave the professional — you — in final control of your data and the clinical decisions that follow from it.

02

Your data belongs to you

The data stored in Carl remains your exclusive property. You keep control of your information at all times: you can view it, edit it, export it, or delete it whenever you need to.

Carl claims no rights over the content of your patient records. Our business model relies on your subscription — never on exploiting your data.

03

Primary hosting in Europe

Carl’s primary application data — including patient records, notes, and documents stored in the application — is hosted in the European Union by Supabase.

Some providers required to deliver the service may nevertheless process data outside the European Economic Area. Where necessary, these processing activities are covered by the safeguards required under the GDPR.

04

Data encryption

The security of your data starts with how it’s protected. All communication between your device and Carl’s servers is encrypted, and your data is also encrypted when it’s stored.

This encryption protects your information from unauthorized access, both while it’s being transmitted and while it’s kept on our infrastructure.

05

Audio recordings

Carl never records your sessions. When you use voice dictation to take notes, three steps happen in sequence: your recording is transmitted securely, a transcript is generated, and then the audio is deleted.

Audio is never kept after transcription. Only the text you choose to keep stays saved in your Carl workspace — never the sound of your voice.

06

Protecting your identity and your patients’ identity

Carl is designed around the principle of data minimization: we encourage using only the information that’s strictly necessary for your practice.

Where compatible with how you work, using a first name only or internal identifiers further limits the exposure of your patients’ personal data.

07

Access control

The confidentiality of your patient records is an absolute priority. Access to production systems is strictly limited to authorized personnel, following the principle of least privilege.

Carl’s teams do not have access to your patient records: our architecture is designed so that maintenance and operations can be carried out without accessing the clinical content you record. Every access to our systems is monitored, limited, and secured.

08

Backups and service continuity

Your data can represent several years of work. That’s why it’s protected by automatic backup mechanisms, performed regularly, encrypted, and stored in secure environments — with the same level of protection as your primary data.

In the event of a hardware or software incident, recovery procedures help preserve the integrity of your information and ensure service continuity. Our goal is simple: you should be able to find your data whenever you need it.

09

Protecting your account

Access to your Carl workspace is secured. We implement mechanisms designed to protect your account from unauthorized access, and we continuously evolve our security measures to keep up with industry best practices.

10

Responsible AI, never clinical

Carl’s artificial intelligence remains an assistant: it never replaces your expertise, never makes a diagnosis, never interprets a clinical situation, and never issues a therapeutic recommendation.

Its role is limited to:

• Structuring your notes

• Generating summaries

• Quickly retrieving information

• Preparing your upcoming sessions

• Simplifying your organization

All clinical decisions remain entirely in your hands.

11

What Carl will never do

We believe certain rules should be simple and unambiguous.

12

GDPR compliance and your rights

Carl is developed in accordance with the requirements of the General Data Protection Regulation. In particular, we apply the following principles:

• Data minimization

• Purpose limitation

• Transparency

• Security of processing

• Confidentiality

You have, at any time, the rights guaranteed by the GDPR over the data you process with Carl: the right of access, rectification, erasure, and data portability.

13

Our subprocessors and their DPAs

We select every subprocessor after reviewing its purpose, security measures, processing locations, international transfers, and its own subprocessors. Only providers that are necessary to operate Carl receive the data strictly required for the service they deliver.

In accordance with Article 28 of the GDPR, every relationship that qualifies as processing on our behalf is governed by a Data Processing Agreement, or DPA.

Our subprocessor list and the corresponding DPA documents are available on request. To obtain them, contact our DPO using the contact form.

14

Security as continuous improvement

Security is never a finished task. We continuously evolve our infrastructure, procedures, and tools to maintain a high level of protection against emerging threats.

In accordance with the GDPR, any data breach likely to pose a risk to your rights is reported to the competent supervisory authority within 72 hours, and you are informed if you are affected. Our ambition is to offer a solution that is ever more reliable, more transparent, and more respectful of the confidentiality of care and support professionals.

15

Frequently asked questions