Privacy

What Cohort holds, and what leaves it.

In plain words. If this page and a screen in the product disagree, the screen is the bug.

Protected health information

Fourteen tables. Residents, their allergies and diagnoses, medication orders and doses, care notes, incidents and plan versions — everything a shift is run from.

Personal information

Two tables: the people who sign in, and their membership of an organisation and its houses.

Public

Three tables, holding nothing about any person.

Where it lives

Records are held in Convex, in the United States, under a business associate agreement. Stripe takes payment and holds the card; we never see a number. Email goes through Resend. Those three are the only processors.

Because it holds protected health information, you accept a customer business associate agreement at signup, presented in full.

What leaves the product

Channel by channel.

Push says: “WH-1: 4 medications due” A house code and a count. Never a name. The set of messages is closed, so nothing can invent one.
Logs: The Convex dashboard only. No third-party log destination.
URLs: Opaque short-codes. A link cannot be read for a name.

This website

If you join the early-access list, this site keeps the email you typed, a phone number if you gave one, the licence track and house count you picked, and the time you sent it. No analytics script, no advertising pixel, no third-party tag. We write once, when the product opens. Reply and we delete the row.

Cookies, and what is kept on your device

Nothing is kept until you answer the cookie question, except the display choices you made in the header. Saying no keeps nothing but the no.

pho-consent: Your answer, as the word all or min. It lasts a year so you are not asked on every visit.
pho-mode: Your dark-mode choice, and where offered your text-size choice as pho-text, in this browser’s local storage. Never sent to a server.
pho-draft: Only if you said yes. What you typed into a form and have not sent, so a refresh does not lose it. Deleted the moment the message sends.

None of it identifies you to us or follows you anywhere. Clear this browser’s site data and you are simply asked again.

Your rights

Export everything the product holds for your organisation at any time, and after a cancellation. Ask us to delete a record and we delete it; the audit log of who did what is kept, because a record that can be quietly removed is not an audit log.

The Terms of Service and, where one applies, the customer business associate agreement are presented at signup and kept in your account. This page summarises; it does not replace them.

Back to Cohort