Written the way we would answer it in a room with your compliance lead, including the parts that are not flattering.
Access rules are enforced on the record itself, in the data layer, rather than by hiding buttons in the interface. A request for a record that a user is not entitled to returns nothing, regardless of how the request is made.
This is what keeps a multi-community portfolio genuinely separated. A staff member assigned to one community cannot read, change, or delete another community's huddles, issues, appointments, or messages.
Every member holds an organization role: owner, regional, administrator, manager, or staff. What a role can do is resolved through a permission mapping, not by comparing role names in code, so an ability can be adjusted without rewriting access logic.
Community assignment decides which buildings a person reaches. Owners and regional leaders reach every community in their organization. Administrators, managers and staff reach only the communities they are assigned to.
Platform-level roles are stored separately from ordinary user data, and a member cannot grant a role at or above their own level.
Role changes, community assignment changes, invitations, and logins are written to an audit trail with the actor, the action, the affected record, and the time.
Membership, assignment and invitation records are removed by soft delete, so the history of who had access to what remains reviewable rather than disappearing.
The platform is built for operational coordination, not clinical charting. Resident-level clinical documentation belongs in your EHR and we do not ask you to move it.
What the platform holds is operational: census and staffing numbers, department updates, appointments and movement, concerns and their resolution trail, and coordination between staff. Fields are scoped to that purpose.
Direct messages between team members are deleted after 30 days by an automated cleanup process. The retention notice is displayed inside the conversation so no one assumes a message thread is a permanent record.
Operational records behave differently on purpose: huddles, department updates, issues and front desk history are retained so any past day can be reviewed and a month can be exported.
We do not hold HIPAA certification. No vendor does, because HIPAA certification is not a thing that exists as a formal status. Compliance is a property of how a covered entity and its vendors operate together.
We do not hold a SOC 2 report today, and we will not imply otherwise on a sales call.
If your organization requires a business associate agreement, a security questionnaire, or specific contractual terms, raise it on the demo and we will answer precisely, including where the answer is no.
Twenty minutes. We will go through access scoping and retention with your own portfolio structure on the screen.