Data Handling & Security Summary

Health and medical information we hold

Everything here is typed in by the family or the care circle. Nothing is pulled in from a hospital, a clinic, or an insurer.

• –Health profile: allergies, current diagnoses, medical and surgical history
• –Code status, such as full code, DNR, or comfort care, plus an uploaded POLST form if the family has one
• –Medications: name, dosage, schedule, who prescribed it, and start and end dates
• –A medication log showing what was given, the dose, the route, and the time
• –Vitals: temperature, blood pressure, heart rate, breathing rate, oxygen saturation, glucose, and weight
• –Daily care notes: toileting and hygiene, mood, sleep, meals, and activity
• –A log of medical care received, with optional photos, plus a directory of doctors and clinics with phone numbers and addresses
• –An Emergency Summary the family can export as a one-page PDF to hand to a first responder
• –A private journal and team chat, where someone could type sensitive health details

Other sensitive information we hold

• –Money and estate records: accounts, trusts, balances, income, expenses, assets, check numbers, and uploaded statements
• –Legal and legacy documents: powers of attorney, final wishes, and funeral or ceremony preferences
• –Basic identifiers: name, date of birth, photo, and email address
• –The recovery code and security answer are stored only as one-way hashes. We never keep the plaintext.

Who can see what

• –Access is set per person and per category: health, financial matters, after-loss instructions, the calendar, logs, journal, contacts, tasks, chat, and member management. Each is set to edit, view, or hide, and nothing is visible by default.
• –Membership is by invitation only. There is no public directory, and access can be pulled back at any time.
• –Every record belongs to one care plan, and only that plan’s approved members can read it.
• –Uploaded documents sit in private storage and are reached through short-lived links created per request.
• –Emergency break-glass access through a Recovery Designee is limited to one named person and needs both a recovery code and a custom security question. Failed attempts are counted and lockouts apply.
• –Nothing is shared outside the platform by default. Calendar sync stays off until a member connects their own calendar, and any export is started by the user.
• –An activity feed with timestamps shows who changed what and when.
• –The owner can export everything or delete a care plan outright. We never sell data to advertisers, brokers, or anyone else.

What LifeCircle is, and what it is not

• –It is a private, family-controlled place to keep care and legacy information together, with the family holding the keys to who sees it.
• –It is not a covered entity or a business associate. We do not provide medical care, and we are not a provider, payer, or clearinghouse.
• –It is not a clinical record system. It is not an EHR, an e-prescribing tool, or a billing system, and it does not connect to a hospital, a doctor’s office, or an insurer.
• –It does not give medical, legal, financial, or tax advice. It keeps and organizes information. It never directs care or replaces a professional.
• –It is not a consumer data business. There is no advertising model and no selling or brokering of user data.

Where it runs, and how that platform protects it

LifeCircle runs on Base44, and Base44 holds the stored data. The points below are what the platform documents.

• –Data is encrypted while moving and while stored. The data tables and private apps are encrypted.
• –The platform states SOC 2 Type II, ISO 27001, and GDPR compliance.
• –Data is not end-to-end encrypted. Platform administrators can access data when required. That is normal for hosted software, but it is not a no-access model.
• –Storage is in the United States by default, with EU or UK residency available on eligible plans.

One open item on HIPAA: the platform documentation does not confirm HIPAA compliance or whether it offers a Business Associate Agreement. It is worth asking them in writing.