TurnlyPrivacy policy
Last updated:
This document is currently available in English and Portuguese. If a translation differs, the English version applies.
Turnly helps families and carers coordinate the care of an older relative: medicines, appointments, tasks, notes and shared expenses. This means we handle information about you, about the other people in your care circle and about the person you care for, some of it about health. This policy explains what we do with it, in plain language.
1. Who is responsible
The service is operated by: Rosini Solutions Sàrl, Chemin des Bulesses 16, 1814 La Tour-de-Peilz, Switzerland.
Contact for anything about your data: hello@turnly.org.
Our representative in the European Union (GDPR Art. 27) is being appointed and will be named here.
This policy covers the website turnly.org, the web app at turnly.org/app, the Turnly apps for iPhone and Android, and the former waiting list.
2. What we collect
- Account: your email address, the name you choose, your language, and your sign-in sessions. If you sign in with Google or Apple, we receive your name and email address from them.
- Care circle: who belongs to it, each person's role and permissions, and invitations (the email address an invitation was sent to, if you choose to send it by email).
- The person cared for: name, date of birth, emergency contacts, routine and, if the circle adds them, identity and health insurance documents (number, issuer, expiry date and copies).
- Health information: medicines and doses, allergies, conditions, measurements, appointments, journal notes, incidents and the care record. Measurements can also be imported, with your permission, from Withings, Apple Health or Health Connect.
- Expenses: amounts, how they are split, reimbursements and photos or PDFs of receipts (which can reveal health information, for example a pharmacy).
- Files you upload: photos and PDFs of receipts and documents.
- Notifications: what was sent to whom, through which channel, and whether it was delivered. If you allow push notifications, your device's push token.
- Technical data: who did what and when in a circle (activity history and previous versions of corrected records), a security log of sensitive actions (such as opening receipts, exporting data or changing permissions), and IP addresses and the type of browser or device, recorded with your sign-in sessions, in the security log and to limit repeated attempts.
- Waiting list (closed): email, country, how you take part in care, number of siblings sharing it, whether you accepted an interview, the page language, the campaign that brought you, and the date of your consent.
Much of this is about people who may not use Turnly themselves, in particular the person cared for. Please only record what the circle needs, and only with that person's agreement or the authority to act for them.
We do not collect your location, contacts or browsing on other sites, and we do not use advertising or analytics trackers.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Providing Turnly: your account, your circles, tasks, medicines, agenda, journal, expenses, files, notifications and reminders | Performance of our contract with you (Art. 6(1)(b)) |
| Health information about you or the person cared for | Explicit consent (Art. 9(2)(a)), given by the person concerned or by someone legally entitled to act for them. You can withdraw it at any time by deleting the information, the circle or your account. |
| Importing measurements from a health app or device | Explicit consent for each integration and each person cared for, recorded when you connect it (Art. 9(2)(a)) |
| Optional AI features (written summaries, reading receipts and prescriptions) | Consent switched on by the circle's family admin, off by default (Art. 6(1)(a) and 9(2)(a)) |
| Sending an invitation email to someone a member wants to invite | Legitimate interest of the member and of the circle in inviting that person (Art. 6(1)(f)) |
| Security: preventing abuse, limiting sign-in attempts, keeping a log of sensitive actions | Legitimate interest in keeping the service and your data safe (Art. 6(1)(f)) |
| Waiting list | Your consent (Art. 6(1)(a)) |
| Meeting legal obligations, such as answering a lawful request from an authority | Legal obligation (Art. 6(1)(c)) |
Because we are established in Switzerland, our processing is governed by the Swiss Federal Act on Data Protection (FADP). The GDPR also applies when we offer Turnly to people in the European Union and the EEA, and the UK GDPR to people in the UK; the legal bases above are those of the GDPR, and under the FADP we rely on the same grounds (in particular consent for health data, Art. 6(7) and 31 FADP). In Brazil, we process data in line with the LGPD (Art. 7 and 11, in particular consent and the performance of a contract). Elsewhere, we apply the same rules as a minimum.
We never sell personal data, never use it for advertising and never make decisions about anyone by automated means. AI features only draft text or suggest values that a person checks; they never act on their own.
5. Transfers outside Europe
We are in Switzerland and Turnly's data is hosted in the European Union. The European Commission recognises Switzerland as providing an adequate level of protection, and Switzerland recognises the same of the EU countries, so no additional safeguards are needed between them.
Some optional providers listed above are in the USA. When data goes to them, we rely on the Swiss-US and EU-US Data Privacy Frameworks (and the UK extension), recognised by the Swiss Federal Council and the European Commission, where the provider is certified, or on standard contractual clauses approved by the European Commission and recognised in Switzerland, the UK and Brazil.
You can ask us for more information about these safeguards at hello@turnly.org.
6. How long we keep it
- Your account: until you delete it. Sign-in sessions expire after 60 days without use.
- Sign-in codes are valid for 10 minutes and are deleted the following day; the record of each send (a scrambled form of the email address and the result) is deleted after 30 days.
- Entries used to limit repeated attempts, which may contain an IP address, are deleted after one day.
- Circle data: as long as the circle exists. The family admin can delete the circle and everything in it at any time. A circle in which you are the only member is deleted together with your account.
- When you delete your account, what you recorded in a circle shared with others stays there for the rest of the circle, without your account attached, because the care history belongs to the whole circle. In the notifications other members already received, your name is replaced by “Former member”.
- Removed files are permanently erased 30 days after removal.
- Notifications (and the record of their delivery) are deleted after 12 months.
- Activity history, previous versions of corrected records and the security log are currently kept as long as the circle exists. We are defining shorter periods and will update this policy.
- Waiting list: until the public launch, and for at most 18 months after you signed up.
- Deleted data may remain for a limited time in our hosting provider's backups before being overwritten.
7. Your rights
Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent at any time without affecting what was done before.
- In the app: Settings → Download my data (a JSON file with your profile and what you recorded) and Settings → Delete my account.
- For anything else, including requests about a person cared for who does not use Turnly, write to hello@turnly.org. We answer within one month, and may ask you to confirm your identity.
The authority responsible for us is the Swiss Federal Data Protection and Information Commissioner (FDPIC). You can also complain to the authority where you live or work: in the EU, your national authority; in the UK, the Information Commissioner's Office (ICO); in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD).
If you live in a US state with a consumer privacy or consumer health data law, you have rights similar to the above. We do not sell or share personal data for targeted advertising.
8. How we protect it
- Sign-in without passwords, with a single-use code by email (stored only in scrambled form, valid for 10 minutes, with a limited number of attempts), or with Google or Apple.
- Encrypted connections (HTTPS). Each circle is isolated, and the server checks each person's role and permissions on every request.
- Files are never publicly accessible: they open through links that expire after 5 minutes and are tied to the person who asked.
- An optional PIN lock for shared tablets.
- A log of sensitive actions, such as opening receipts and exporting data.
No system is perfectly secure. If a breach puts your data at risk, we will tell the competent authority and, where required, the people affected.
10. Children
Turnly is meant for adults. You must be at least 18 to create an account. We do not knowingly collect data from children, other than information a circle may record about its own household.
11. Changes
If we change this policy in a way that matters, we will tell you in the app or by email before the change applies. The date at the top shows the current version.