Updated September 22, 2026
Privacy for development testing
This notice covers invited development testing, not a public medical-record service. Use only fictional people, vendor-provided test accounts and synthetic health records. Do not connect a real patient portal or upload anyone’s medical records to this preview. Production medical-record retrieval, purchases and consumer calls are not enabled by this notice.
Information used in the preview
Sign-in uses your account identifier, email, email-verification status and session credentials. Development testing may also store synthetic records, source identifiers, connection permissions, test answers, resource versions, support requests and technical events needed to understand failures. Hosting and identity services may process network and device information when you use them.
We use this information to authenticate testers, restrict access, exercise record import and saving, investigate failures and respond to help requests. Do not put passwords, government identification, payment details or real health information in test records, messages or support requests.
Services involved
- Auth0 / Okta handles managed sign-in. CareCompanion receives identity and session information, not your Auth0 password.
- OpenAI Sites and Cloudflare host the CareCompanion website, backend, database and stored test files. Authorized project operators can access development data for support and verification.
- Fasten Health and its test portal providers handle sandbox connection authorization and return synthetic records. CareCompanion stores the connection identifiers, permissions, import progress and returned test records. Use only the test accounts supplied for those environments; do not enter a real portal password.
- Expo builds and distributes development applications. Build uploads contain application source and assets, not patient records or backend credentials.
These providers operate their own services and privacy notices. This notice does not claim that provider logs or backups disappear when a CareCompanion session ends. Other existing CareCompanion pilot features, including optional scheduling texts, have a separate scope; this preview does not enroll you in them.
Access, sharing and choices
Signing in does not grant access to another person’s care space. Development records remain subject to account and care-space permissions. Do not intentionally share them publicly. We do not sell preview information or use it for advertising.
Stopping a test connection stops future retrieval in CareCompanion but does not itself erase imported copies or revoke an upstream portal grant. Remove the grant in the test portal’s connected-app settings as well when that option is available.
Retention and deletion
Test records and technical receipts may remain after a session so the team can verify persistence and investigate failures. There is not yet a fixed automatic deletion schedule. You may request access, correction, connection removal or deletion by emailing theshiftreport@icloud.com.
Preview requests are handled by the project operator, including any separate identity-provider or integration cleanup. We may need to verify that you control the account. We will distinguish removal from active CareCompanion storage from any provider retention, backups or downloaded copies that remain; a request is not a completed deletion.
Before real patient use
A separate, accurate patient-facing notice, appropriate authorization, provider eligibility and verified operational safeguards are required before this development integration is opened for real medical records. This page is not a HIPAA certification, medical consent or authorization to use another person’s records.
Questions or an accidental sensitive upload? Contact theshiftreport@icloud.com. This address is not an emergency or clinical service.