LifeCare.ID® privacy notice
Who is responsible
Enbarca Inc., a Florida corporation in the United States, doing business as HCVC.net, decides how and why the data below is handled ("we", "us"). Three roles run this network, and a role can move to another company later: the network keeper, steward of LifeCare.ID®, the service described here; the node operator, which runs the node where your health data is held; and the app publisher, which publishes the app you use. Enbarca Inc. holds all three today.
What we hold about you
Exactly this, and nothing else:
- Your identifier, a
did:webaddress derived from your device's public key. - The public half of your device key, and any earlier public key retired by a recovery.
- Your recovery e-mail address, if you gave one, and whether you confirmed it.
- Your permission diary: every grant, every use and every withdrawal, with the scope, the purpose, the date and the app it names.
- Your resource registry: what data exists about you, who holds it, where, and which version. Identifiers, categories, versions and hashes. No values.
- Your acceptance: which version of the member terms you accepted, when, and your confirmation that you are 18 or older.
- Sign-in records: the passkeys bound to your identifier and the sessions issued to them.
Why: to give you an identifier nobody else can use, to let you permit and withdraw access and prove afterwards that you did, to show you what exists about you and where, and to get you back in if you lose your device. Each grant of access to your health data is your own explicit consent, and the diary is what makes that consent demonstrable.
What we never hold
No health values. Not a glucose reading, a weight, a lab result, a medication, a symptom, or anything you say to a guardian. Health data stays on the node where it was created and travels directly between the holder and whoever you authorize. A complete compromise of this service yields identifiers, public keys, tokens and permission metadata. That is how it is built, not a promise about how we behave.
We do not sell your data
We do not sell, rent or license anything we hold about you, we do not use it for advertising, and no one pays us for access to it. There is little here to sell in the first place: this service holds identifiers, keys and permission records, never a health value. The network has no blockchain and no token, and no central pool of raw health data: raw data stays where it was created, and an app or partner reaches your health data only on a permission you granted. The node operator can technically read the health data on the node it runs, and today that is also Enbarca Inc.; for that data the protection is the commitment on this page, and the next section binds whoever holds the role.
If a role changes hands or the company closes
The three roles named above (network keeper, node operator and app publisher) are all held today by Enbarca Inc. If the company is sold, merges with another company or closes, or if any of the three roles moves to another company:
- What that role holds about you is not sold or transferred as a business asset.
- We tell you at least 30 days before anything changes. In that time you can download your permission diary and your resource map, ask the node that holds your health data for a copy of it or have it erased, and retire your identifier.
- Your data passes to a new holder of a role only if that holder takes on this notice and the member terms as written. If none will, your health data is erased by destroying its key and your identifier is retired.
How consent works, and what you can see
A grant names a scope and a purpose and has an end date. You withdraw it in one tap: the token dies in under half a second, and the withdrawal is published in the public revocation registry, so a holder that checks the registry sees it too. Your permission diary is append only, meaning entries are added and never rewritten, so it is a record you can rely on rather than a screen we control.
Closing your account
Write to hello@lifecare.id and we retire your identifier and unbind your passkey, so nothing can act as you and no new permission can be granted. Your permission diary and your resource registry stay as a record of what was permitted and what was withdrawn. Those entries carry no health values, only identifiers, dates, scopes and purposes. Health data itself is erased by the node that holds it, on your request to that node. A full account closure procedure, one that states exactly what is erased, what is kept, for how long, and how you get proof of it, is still being designed and is on the list for our counsel review.
How long we keep it
- Identifier, keys, permission diary and resource registry: while your account is open, and afterwards as the record described above.
- Recovery e-mail: until you remove it, or your identifier is retired.
- One-time links: a recovery link is single use and expires 15 minutes after it is sent.
- Sessions: they expire on their own, and you can end them by signing out.
Who else processes it
- Cloudflare, which serves this site, carries the encrypted tunnel to the node, and delivers our e-mail.
- Google, which holds backup copies of the identity service's data.
Both act on our instructions under contract, and the data described here is processed in the United States. There are no advertising networks and no analytics on the identity and consent pages.
Your rights
You can ask to see what we hold about you, ask us to correct it, ask us to retire your identifier, and download your permission diary and your resource map. Much of that you can do yourself: the diary and the map are readable and exportable in your app, and any grant is withdrawable in one tap. For the rest, write to hello@lifecare.id, and we answer within 45 days.
Consumer health data laws in several states, Washington, Nevada and Connecticut among them, give you consent, access and deletion rights over health-related data. We honour such a request from anyone who makes one, wherever you live. If we learn that someone reached your data without permission, we tell you promptly and within the time the law sets. The rule that applies to a service like this one is the Federal Trade Commission's Health Breach Notification Rule.
Software, not a person
Any guardian or assistant you talk to on this network is software, not a person, and the app you are talking to tells you so. It reads only what your grant allows, and every read lands in your permission diary.
Age
LifeCare.ID® is for people 18 or older, confirmed at sign-up. We do not knowingly hold data about children.
Changes and versions
Each version carries the date at the top of this page, and the version you accepted is recorded against your identifier. For material changes we ask you to accept the new version and say what changed. On 7 October 2026 we added two sections, “We do not sell your data” and “If a role changes hands or the company closes”; they add commitments and take nothing away, so the version you accepted stays in force. This notice is subject to legal review and changes.
Contact
Privacy questions and requests: hello@lifecare.id. Security reports: security@lifecare.id. See also the member terms. LifeCare.ID® is a registered trademark of Enbarca Inc. in the United States.