Privacy Policy — Arropi

Applicable in the EU (GDPR) and internationally. Last updated: 26 October 2026.

🗑️ Delete your account and your data

If you have the app installed:

Open Arropi on the caregiver's phone.
Go to Settings › 👤 My account.
Tap “🗑️ Delete my cloud account” and press and hold for 2 seconds to confirm.

This deletes your account and all your cloud data: tasks, confirmations, help alerts (including location) and any linked phones. The people in your care are deleted too, but only if no other caregiver is still linked to them — if someone else is, their data stays for that person, and if you were the primary caregiver, the one who has been invited the longest takes over. What is on your device is not deleted with it; to keep using Arropi in “I care for someone” or “I look after myself” you will need another account, and what is on the device is erased in Settings › Privacy.

To delete only one person in your care (without deleting your account), use Settings › 🧓 The person you care for › 🗑️ Delete (only available to the primary caregiver).

If you do NOT have the app installed, or cannot access it:
Write to [email protected] requesting the deletion of your account (or of a person in your care), stating the name and email you registered with. We will handle the request within one month, per GDPR Article 17.

1. Introduction

Arropi (the "app") is a mobile application developed by S.L., a tool for daily support and organisation of care, built for caregivers and the people in their care.

This policy describes how we handle personal and health data of our users, in compliance with the EU General Data Protection Regulation (GDPR) 2016/679 and international data protection laws.

2. Account holder and person in care

Arropi distinguishes two roles: the caregiver (who creates and manages the account) and the person in care (whose health data is stored in the app). The account is opened by the caregiver, who acts as the representative of the person in care and declares, on creating it, that they have authorisation to register and manage their health data on their behalf.

Name, date of birth, medications, tasks and health records are data belonging to the person in care, even though the caregiver is the one who enters and manages them.
GDPR rights (arts. 15, 17 and 20: access, deletion and portability) over that data are exercised by the caregiver through the buttons in the app (Settings › Privacy) on behalf of the person in care.
If the person in care has legal capacity and wants to exercise their own rights — common in the early stages of the condition that motivates using the app — they can write to [email protected] identifying themselves as the person whose data is processed. We respond within the same timeframe (30 days).
If there is a conflict between what the caregiver and the person in care request, the wishes of the latter prevail: they are the data subject.

3. What data do we collect?

A) Data you enter directly:

Name and photo of patient/caregiver
Patient's date of birth
Diagnosis/disease (selected from options, not clinically assessed)
Medications, dosages, schedules
Tasks, routines, reminders
Mood, sentiment and symptom logs (voluntary)
Private notes, caregiver journal
Emergency contacts
Recorded voice/audio (if using voice banking)

B) Operational data (collected automatically):

Configured language
Font size, high-contrast mode
Device information (type, resolution, OS)

The app does not record which tabs are opened or when, and does not send error reports: that data is not collected (see section 6.B).

C) Data we do NOT collect:

Continuous or background GPS location. The location at that moment is taken only in two cases: when a HELP alert is sent (the button or a fall) and when the caregiver asks for it with “Where is the person now?”, with Arropi open on the cared-for person's device, which shows a notice every time
Biometric data: the accelerometer (fall detection) and the camera (the mirror and the counter in the speech-therapy exercises) are processed on the device itself and are never stored or sent. A fall alert is recorded only when a person confirms it
Browser history or third-party navigation
Tracking cookies or pixels

4. Where is data stored?

🔒 On the device itself: all data mentioned is stored on the user's device (phone/tablet), in local memory (browser localStorage), under the storage key miAsistenteV3. This lets the app work offline too. That local copy is lost if you uninstall the app or clear the device's local storage; the one on the servers is not.

☁️ On the servers, with the account (required since 9 October 2026 in the “I care for someone” and “I look after myself” modes): the caregiver —or the person who looks after themselves— creates an account (email and password, or “Continue with Google”), and the cared-for person's phone is linked to it with a 6-digit code, with no account of its own (“Someone looks after me” mode). The data of the person in care is uploaded to the account when they are added to it: when the account is created, if there is nobody in it yet, or from Settings.

Data that IS then stored on servers:

Tasks: title, instruction, notes, time, whether they are medication and how important, which days they repeat, and any photo added to them
Whether each task was done, at what time, and whether it was postponed
About the cared-for person: name, photo, date of birth, time zone, diagnosis, allergies, conditions, doctor's appointments and the questions noted down for the doctor
Their medication: name, dose, schedule, reminder times and, if one is taken, a photo of the box
The caregiver's name, phone and email, the way they use Arropi (Caring for or On my own), so it opens that way when they log in on another device, and the link between them; the names and phone numbers of any other caregivers and family members added, with their photos
Invitations to another caregiver: a fingerprint of the code (never the code itself), which person it gives access to, who created it and until when it is valid; it is deleted when used or, if nobody uses it, when it expires after 48 hours. For a mistyped code, the account that tried it and the time, deleted after one hour
Single-use codes to keep the profile when moving from “Someone looks after me” to “I look after myself”, only when the caregiver proposed it: a fingerprint of the code (never the code itself), whose profile it is, which request it comes from, until when it is valid and which account used it; it expires after 24 hours and is deleted after 7 days
Requests to change the mode in which a phone uses Arropi, made by a caregiver or by Arropi support: which person or account they are for, which mode, who made the request, the reason if Arropi support made it, and how it ended; they expire after 7 days without an answer and are deleted after 180
Memories (photos and songs) and the family song
Voice recordings: the phrases recorded in Voice Banking, with their audio, so that they play on the cared-for person's phone
History: the caregiver journal (the messages sent to the person being cared for, with any photo attached), daily notes, weight, weekly trends, what is tapped on the communication board, team notes (with who wrote them and when), and a daily summary for the report (tasks and doses done, mood, falls, choking incidents and swallows)
App settings: language, text size, contrast and voice
HELP alerts (SOS or detected fall) with the GPS location at that moment, when available
Location requested from the caregiver's phone (“Where is the person now?”): only if Arropi is open on the cared-for person's phone, which shows a notice every time; only whoever asked can see it, and it is deleted after 24 hours
A notification identifier (push token) per device

Data that is NOT synced and stays local only: symptom and on/off fluctuation episodes and the fluids and incontinence log.

Processors acting on our behalf:

Supabase — database, accounts and server functions. Project hosted in the European Union (eu-west-1, Ireland).
Google — three independent uses. Firebase Cloud Messaging, whenever you turn on syncing: delivery of the alert to the device only. Most notifications — reminders, unconfirmed medication — carry only a generic alert and identifiers; the detail is resolved by the authenticated app on the device itself. The exception is the SOS or possible-fall alert: its title deliberately names the cared-for person and the type of alert, so it is recognised at a glance and reacted to faster in an emergency; that text passes, like the rest, through Google's servers as technical carrier. Sign in with Google, only if you choose "Continue with Google" instead of creating a password when setting up your caregiver account: Google shares with Supabase your email address and the name on the Google account you use to sign in, and nothing else — never any data about the person you care for. Gmail, only if you write to us at [email protected]: our inbox is a Gmail account, so your message, with your address and whatever you tell us, is kept there, and we reply from it.
Brevo — delivery of your account emails: the confirmation message when you sign up and the password-reset message. It receives your email address and the text of that message — no data about the person you care for. The button in those emails goes through a Brevo server before it opens Arropi: when you press it, Brevo sees your device's IP address and counts the open and the click anonymously, without linking them to your email address; this tracking cannot be switched off. It is a French company and the processing takes place in the European Union, so it is not an international transfer.
Cloudflare — hosting of the web application, the encrypted backup copy of the database (stored in the European Union), and routing of incoming email addressed to [email protected]: if you write to us, that message passes through Cloudflare before reaching our Gmail inbox (see Google, above).
CIMA / AEMPS — only when you add a medication, and only with the app set to Spanish. When saved, we send only the name you type to the public medicines database of Spain's Medicines Agency (AEMPS), to link that medication's exact official leaflet instead of a generic search. We do not send the cared-for person's name, date of birth, or any other data of theirs. It is an open-access database run by a Spanish public body; the lookup does not run outside the Spanish-language app.

International transfers. Google (Google LLC) and Cloudflare (Cloudflare, Inc.) are United States companies, so some of the data they process may travel there. Both participate in the EU-U.S. Data Privacy Framework, which is covered by a European Commission adequacy decision (Art. 45 GDPR); should that certification lapse, the safeguard becomes the standard contractual clauses approved by the Commission (Art. 46). Supabase stores the database in Ireland, but the company may access it from outside the European Union (the United States or Singapore) to provide support and keep the service running; those transfers rely on the Commission's standard contractual clauses. You can ask us for a copy of these safeguards by writing to [email protected].

All traffic is encrypted (HTTPS). Access to the data is restricted server-side by row-level security (RLS): a caregiver can only see the data of the people they are linked to.

The primary caregiver can invite others, up to five in total, with a single-use code. Whoever accepts it with their own account becomes linked: they see and edit the same data about that person and get the same alerts. The caregivers of the same person can see each other's name and email. The primary caregiver can remove the access of any invited caregiver, and each of them can leave whenever they want; the copy on their phone is then deleted. If the caregiver proposes that the person switches from “Someone looks after me” to “I look after myself” and the person accepts and signs in with their own account, that account becomes the primary one and the previous primary caregiver stays on as an invited caregiver, with the same access to the data.

Support. Only if you or your family ask us to, Arropi support can change the mode in which an account or a person's phone uses Arropi (for example, so that it switches to “Someone looks after me”). To do so, the support screen shows the email of that account, its mode and the names of the people it cares for, and nothing else: no tasks, no medication, no other health data. The change carries the reason in writing, which the person sees on the phone before it is applied. Every time support looks up an account by its email, which account, who looked it up and when are recorded; that record is deleted after a year. To know how Arropi is used, support also sees counts without names: how many accounts, people and phones there are in each mode.

5. Deleting synced data

Deleting a person in your care from Settings › 🧓 The person you care for › Delete removes their data from the device AND from the servers: tasks, confirmations, help alerts including location, and any linked phones. Deletion is immediate and irreversible, and only the primary caregiver can do it. Server backups: an encrypted copy of the database is saved once a week and deleted after two months. Anything deleted in the application disappears from those backups when they expire, and a backup is only restored to repair a failure.

To delete the caregiver account, and to exercise your rights of access, rectification, restriction, portability or objection, see the "🗑️ Delete your account and your data" section above, or write to [email protected] — we will respond within one month.

6. How do we use data?

A) App functionality: saving and retrieving tasks, medications and reminders; displaying reports for the caregiver; sending local notifications and reminders; adapting the UI by disease (text size, contrast, etc.).

B) Product improvement: the app carries no analytics, no usage counters and no error-log reporting. There is nothing to enable or disable, because none of that is collected. If it is ever added, it will be optional and we will ask for your consent first, and this policy will be updated before that happens.

C) We do NOT use data for: targeted marketing or advertising, selling data to third parties, or research without explicit consent.

7. Your rights (GDPR)

You have the right to: access and portability (with the "⬇️ Export my data" button in Settings › Privacy, which downloads a JSON copy of everything the app stores on the device), rectification (by changing the data in the app), erasure (with the "🗑️ Delete all data" button on the same screen; for the copy on the servers, see section 5), restriction and objection. For anything that cannot be done from the app, or if something does not work on your device, contact [email protected]. We will respond within 30 days.

8. Security

Local data is not exposed in transit or on remote servers; browser storage is protected by OS sandboxing; we do not use tracking cookies; the app's Service Worker does not share data with third parties; HTTPS is mandatory for backend connections. No app is 100% secure, but local storage is safer than a centralised server.

9. Third-party data

The app loads nothing from third parties on its own: no fonts from outside servers and no embedded maps. When there is a location — a HELP alert or “Where is the person now?” — the caregiver sees a link to Google Maps; only if the caregiver taps it does Google Maps open with those coordinates, and from then on Google processes them under its own policy. There is no analytics of any kind (no Plausible, no Matomo, no Google Analytics). The third parties that do process data today are the processors listed in section 4 (Supabase, Google/FCM, Brevo, Cloudflare and CIMA/AEMPS). Supabase, Google/FCM, Brevo and Cloudflare are part of how the account works —required in “I care for someone” and “I look after myself”— and of linking with a code in “Someone looks after me”; none of them can be switched off separately. CIMA/AEMPS, by contrast, depends on adding a medication with the app set to Spanish.

Buying the workbooks as PDFs (outside the app). If you buy a Mente Activa workbook as a PDF from arropi.com, the purchase takes place on the checkout page of Payhip (United Kingdom, a country with an EU adequacy decision), which handles the order, sends the download link and calculates VAT. Payment is taken by Stripe (card) or PayPal, depending on the method you choose. They receive your name, email, country and payment details, and each also processes them under its own privacy policy. Arropi receives your name, email and order details from Payhip, to help you and to issue an invoice if you ask for one, and keeps them for as long as tax law requires; it never sees your card details. This purchase is never linked to any data in the app or about the person you care for. The terms are in “Terms of purchase for the workbooks”, at the end of this page.

10. Data retention

On the device: tasks, medication and the rest of the app's data are kept indefinitely until you delete them. No error logs and no analytics data are stored, because none are collected. You can delete all your local data in Settings › Privacy.

On the servers: tasks and their confirmations, the history, help alerts —including the location, when it is sent— and the identifiers used to send notifications are kept for as long as the person in care they belong to exists in the account. Deleting that person, or the whole account, deletes them along with it; no copy is left behind and there is no further retention period. The only thing kept, for 180 days, is their internal identifier —a random code, with no name or any other data— and the date of deletion, so that the person's phone knows to stop the medication reminders.

Unused accounts: if an account goes 12 months without any use —neither by the person who opened it nor from the device of any of the people they care for—, we send an email saying it will be deleted after 30 days, and a reminder 7 days before. Simply opening the app keeps it. Otherwise it is deleted exactly as with “🗑️ Delete my cloud account” (section 5), and we confirm it with a final email. To tell whether an account is in use we only look at dates: the last sign-in or sync and the last confirmed task.

One exception, a much shorter one: when a linking code is redeemed, the IP address it is redeemed from is stored temporarily, for the sole purpose of limiting the number of attempts and stopping anyone from brute-forcing codes. It is deleted as soon as linking succeeds; if it does not, a scheduled task that runs every hour deletes it, so it is never kept for more than two hours. The 6-digit code itself, which expires after 10 minutes, is deleted the same way.

Backups: if you use an external backup of your device, that data follows the policy of whichever service makes it.

11. Consent

On first app launch, local storage is enabled automatically (necessary for the app to work). Microphone/camera features are optional (the operating system asks for permission). The account, on the other hand, is required in the “I care for someone” and “I look after myself” modes: creating it means accepting that the data is stored on the servers to sync it (section 4); in “Someone looks after me”, linking the phone with the code does the same.

There is no consent screen with toggles, because there is nothing optional to consent to beyond the above: microphone and camera permissions are revoked in the operating system's settings, and the copy on the servers is deleted by deleting the account (see “🗑️ Delete your account and your data”) or by writing to [email protected].

12. Contact / data protection

Data Controller: S.L.
Email: [email protected]
Supervisory Authority: your country's data protection agency (EU: edpb.europa.eu).

If you have complaints about our data processing, you can lodge a complaint with your country's data protection authority.

13. Changes to this policy

We may update this policy if the app changes. The latest version is always in the app (Settings › Legal Notice) and on this same page. We will notify you of significant changes inside the app.

14. Service Availability

Arropi is served from arropi.com, and the app lives at arropi.com/app. The addresses used before, arropi.app and arropi.es, take you there automatically.

In rare cases, an Internet Service Provider or telecommunications operator may temporarily block access to arropi.com for reasons beyond Arropi's control (for example, blocks on shared IP ranges). This does NOT mean the app is down, nor that there is a security issue.

What to do if it doesn't load?

Open a terminal / PowerShell and run: curl.exe -sS -w "HTTP %{http_code}\n" https://arropi.com
If it returns "HTTP 200", the server is online. The problem is with your connection or your ISP.
If it returns "HTTP 000" or "SEC_E_UNTRUSTED_ROOT", contact [email protected] with the time and your ISP name.

Your app data is saved on your device, tied to the address you open the app from. If you used arropi.app or arropi.es before, you won't see on arropi.com what was only stored on that device: whatever is in your account comes back when you sign in, and a linked phone is linked again with a new code.

Is it safe? Yes — all three domains use valid SSL (Google Trust Services and Cloudflare certificates), and all traffic is encrypted, including the hop from an old address to arropi.com.

15. Accessibility Statement (WCAG 2.1 AA)

S.L. is committed to making Arropi accessible to everyone, including people with disabilities, in line with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA conformance criteria and the EN 301 549 standard.

Accessibility features implemented:

Visual — configurable high contrast (black/white, yellow), adjustable text size (0.85×–2.1×), pictograms alongside text (not icons alone), and everything that must be seen without looking for it (medication alerts, SOS, the current task's instruction, safety warnings) placed at the top of the screen — many users have trouble reliably looking downward.
Hearing — text-to-speech for every task, with adjustable speed; visual feedback in addition to sound.
Motor — large buttons (15–20 mm minimum), press-and-hold instead of double-tap for critical actions, no complex cognitive sequences.
Cognitive — a single task on screen at a time, plain and direct language, insistent medication reminders, a distraction-free mode.
Technical — semantic HTML and ARIA roles, labels tied to their controls, colour is never the only way information is conveyed, minimum 4.5:1 contrast in both light and dark mode.

Known limitations: the “Home walkthrough” does not analyse the camera image: the points are ticked by the person walking through the home, and the only thing the app measures is the frame's mean brightness. The fall sensor uses the device's real accelerometer and does not replace supervision; “Yes/No by breath” uses the real microphone but only measures how loud the sound is and whether it sounds like breath or like a voice: it is not speech recognition, and a cough or a loud noise can count as an answer (if the device has no microphone, manual YES/NO buttons appear). The camera in “Photo of the box” does not read the label: it only saves the photo the caregiver takes.

Assistive technologies: the app is designed to be compatible with screen readers (NVDA, JAWS, VoiceOver), screen magnifiers, and the operating system's own voice controls; testing with a screen reader is still pending. Tested on iPad (Safari) and on Chrome on Android and on desktop — the PWA does not offer every feature on desktop.

Found an accessibility problem? Write to [email protected] with your device, browser, and the feature that isn't working. We aim to respond within 7 days.

Terms of use

These terms govern the use of Arropi: the app and the pages on arropi.com. They are offered by S.L. (details in the legal notice). By using Arropi or creating an account, you accept them. If you do not agree, please do not use it.

1. What Arropi is. A tool for organising day-to-day care: tasks, reminders, alerts and communication between the person being cared for and the people caring for them. It helps you get organised: it is not a medical device, it does not diagnose or recommend treatments, and it does not replace the judgement of healthcare professionals or the attention of a person. Decisions about medication and health always belong to the person being cared for, their family and their professionals.

2. Alerts help, but they are not a guarantee. The medication alert, the fall alert and the SOS button depend on the device, the permissions it has, its battery, silent mode, the connection and third-party services (mobile networks, system notifications). They can arrive late or not at all. Arropi is not an emergency service: in an emergency, call 112 or your local emergency number.

3. Your account. Accounts are opened by adults. If you record someone else's data, you confirm that you have their permission or act as their representative, as section 2 of this policy explains. Keep your sign-in details safe and do not share access with anyone who should not have it. You can delete your account at any time from Settings, or by writing to [email protected].

4. Fair use. Arropi is for personal and family use, not for commercial purposes. You may not use it for anything illegal or to harm others, try to get into other people's accounts or data, interfere with its operation or its servers, or copy or redistribute it. To use it in a care home, a centre or a company, please write to [email protected] first.

5. Your data. What you keep in Arropi belongs to you and to the person being cared for, not to Arropi. How it is processed, where it is stored and how to download or delete it is explained in this privacy policy.

6. Price, and changes to the service. Arropi is free today. If any feature becomes paid in the future, you will be told in the app beforehand, with its price and terms, and nothing will ever be charged without your express agreement. Arropi may change, be interrupted for a while for maintenance or because of faults, or stop being offered. If cloud sync is discontinued, you will be told in the app at least 30 days in advance, so that you can download your data.

7. Liability. S.L. is liable as the law requires, and nothing in these terms limits your rights under consumer law, or liability for wilful misconduct, gross negligence or harm to life or health caused by its fault. Outside those cases, and because Arropi is an aid for getting organised, S.L. is not liable for harm that comes from using it instead of a person's supervision or professional care, from failures of the device, the network or third-party services, or for data lost by deleting it or because it was stored on one device only.

8. Intellectual property. Arropi's code, texts, drawings, icons and trademark belong to S.L., as stated in the legal notice. Third-party components keep their own licences.

9. Suspending an account. If an account is used for anything illegal or to harm others, S.L. may suspend it. Except in urgent cases, it will first let you know by email and give you the chance to explain and to download your data.

10. Changes to these terms. If they change, the new version is published here with its date, and important changes are announced in the app before they take effect. If you do not agree, you can stop using Arropi and delete your account.

11. Governing law. These terms are governed by Spanish law. If you are a consumer, you keep the protection of the laws of your country of residence and may go to the courts where you live. For any question or complaint: [email protected].

In force since 8 October 2026.

Terms of purchase for the workbooks (PDF)

These terms apply to buying the Mente Activa workbooks as PDFs from arropi.com. They are sold by S.L. (details in the legal notice). The checkout page and the delivery of the file are handled by Payhip, and card payments by Stripe. By buying, you accept these terms.

1. What you buy. A workbook as a colour PDF, A4 size, to print at home: Mente Activa 1 (easy), 2 (medium) or 3 (hard), or the bundle of all three. Each workbook includes the PDF in Spanish and English. It is for personal and family use: you may print it as often as you need for the person you support, but not resell, publish or share it outside the home. To use it in a care home, a centre or a practice, please write first to [email protected].

2. Price. €7.99 per workbook and €17.99 for the bundle of three, VAT included. The final price, with your country's VAT, is shown before you pay. There are no shipping costs.

3. Payment. By card or by the other methods offered on the checkout page. Arropi never sees or stores your card details.

4. Delivery. Straight after payment: the download link appears on screen and is sent to you by email. If it has not arrived within an hour, check your spam folder or write to us.

5. Right of withdrawal. Distance purchases can usually be cancelled within 14 days. A PDF is digital content not supplied on a physical medium: when you buy, you ask for the download to be available immediately and you acknowledge that once the download begins, you lose your right of withdrawal (art. 16(m) of Directive 2011/83/EU). If you have not downloaded it yet, you may withdraw within those 14 days by writing to [email protected], and we will refund the full amount.

6. If something goes wrong. If the file is damaged, will not open or is not the workbook you bought, write to us: we will send it again or, if that does not fix it, refund you. You also keep the legal guarantee of conformity that the law gives you.

7. Not a medical device. The workbooks are stimulation exercises to do together. They do not diagnose or treat any condition and do not replace the judgement of healthcare professionals.

8. Invoice. If you need an invoice, ask for it at [email protected] with your name, tax number and address.

9. Governing law and complaints. Spanish law applies. If you are a consumer, you keep the protection of the laws of your country of residence and may go to the courts where you live or to the consumer authorities. For any question or complaint: [email protected].

In force since 16 November 2026.

Legal notice (Spanish LSSI-CE, art. 10)

Owner: S.L. — full name: Sebastian Leandro · individual · NIE (Spanish tax ID): Y-2483011-Z · Address: C. Ruperto Chavarri, 28224 Pozuelo de Alarcón (Madrid), Spain · [email protected]. The owner is also the controller of the personal data described in this policy.

Intellectual property and trademark: Arropi's code, texts, drawings and icons are the work of S.L. © 2026 S.L. All rights reserved. Third-party components included in the app keep their own licences. “Arropi™” is a trademark of S.L.