Notice of Privacy Practices

Connect Care transmits and stores Protected Health Information (PHI) about residents in assisted living and memory care — including names, mood observations, medication, meals, activities, and messages from families. Access to PHI is restricted to the resident's assigned caregivers, linked family members, and facility administrators.

• Every account has a role: family, caregiver, or administrator.
• Caregivers only see residents they are explicitly assigned to.
• Family members only see residents linked to their account.
• Administrators can perform emergency ("break-glass") access; every such access is recorded.
• Sessions expire after 15 minutes of inactivity.
• Passwords are checked against known-breached password lists.

Every view, post, edit, delete, and reaction is written to an append-only audit log with the actor's user ID, timestamp, resource, and device details. Logs are readable only by facility administrators.

• All traffic is encrypted in transit (HTTPS/TLS).
• Database at rest is encrypted by the hosting provider.
• The facility must have a Business Associate Agreement (BAA) with its hosting provider before storing production PHI.
• Photos of residents are PHI and are subject to the same controls.

• Care updates, notes, chat messages, vitals, incidents and medication logs are kept for the resident's stay plus seven years.
• Photos follow the same schedule and are removed sooner on a family's written request.
• Audit logs are append-only and kept for seven years; they cannot be edited or deleted from within the app.
• When an account is deactivated, access ends immediately, but entries that person authored remain part of the resident's record.

Family members may request a copy of the updates and notes concerning their loved one, or ask for corrections, by contacting the facility administrator.

If you believe PHI has been exposed, disclosed, or accessed without authorization, contact the facility's Privacy Officer immediately.