How we protect care information

Each older adult has their own care space. Records belong to that space, and one care space is never combined with another. People only see the care spaces they were invited to.

Every person in a Care Circle has a role — Owner, Organizer, Contributor, Viewer, or Emergency Viewer — that decides what they can see and change. When someone is removed from a Care Circle, their access ends immediately.

Access rules are enforced in the database itself with row-level security, not only in the interface. A request that is not authorized for a care space is refused by the database, even if it is made directly.

Whether a care space has paid features is decided on the server from verified payment provider events. The browser cannot grant itself paid features, and returning from a checkout page does not by itself unlock anything.

Uploaded documents are stored privately. They are not publicly reachable by URL. When an authorized person opens a document, the server issues a short-lived link for that person only.

An Emergency Profile can be shared with a link that expires and can be revoked at any time. Link tokens are stored only as hashes, never in readable form, and lookups are rate limited.

Anyone holding an unexpired link can view that emergency profile, so share links only with people who need them and revoke a link when it is no longer needed.

Sensitive actions — such as opening a shared Emergency Profile or confirming an extracted record — are logged with a timestamp so a care space owner can review what happened.

AI features receive only the confirmed records needed to answer the question asked, from the one care space the person is authorized for. The assistant never writes to the care record. It can only prepare a draft that a permitted person reviews and confirms.

Payments are handled by Stripe. EldersCare AI does not receive or store card numbers.

• No online service can promise perfect security, and we do not claim to be completely secure.
• EldersCare AI does not claim HIPAA compliance, FDA approval, medical-device status, or clinical accuracy.
• Account security also depends on you: use a strong, unique password and invite only people you trust.
• Information shared outside the app — printed pages, forwarded links, screenshots — is no longer protected by these controls.

If you believe you have found a security problem, email support@elderscare.ai with the details. Please do not include another person's health information in your message.