There is no badge on this page. Every security badge you have seen on a vendor’s website is something they wrote about themselves. Here is what we actually do instead, including the parts we would rather not put in writing.
Rulebook in force: 2026.08.23.1 · see the rules
Our role
The retirement home or agency is the health information custodian. We are not. We act as its agent, and as an electronic service provider, under PHIPA and O. Reg. 329/04.
What we may collect, who may see it, and when to stop. We follow those instructions; we do not set them.
Personal health information is used only to deliver the service the home asked for. It is not sold, not shared, and not used to train anybody's model.
If the home leaves, its record leaves with it. We export it and delete our copy.
Still being confirmed. We do not believe we are a health information network provider, that is the arrangement where one system lets two or more custodians disclose to each other, and we never move a resident's information between homes. We are having that confirmed rather than assuming it.
Where the data is
Resident records are held in Airtable, which stores data in the United States. Call audio and transcripts are processed by Retell AI. Our application runs on Vercel.
So today your residents' information is processed outside Canada. We are telling you that before you ask, because you would find out during a security review and it should not be a surprise then.
Moving the record to a database in a Canadian region is the largest single piece of engineering work in front of us. It is not done. When it is, this page will say so and will say when.
| Who | What they do | Where |
|---|---|---|
| Airtable | The resident record and every alert, task and note. | United States |
| Retell AI | Places the calls, and produces the transcript. | United States |
| Twilio | Text messages for escalation and family notices. | United States |
| Resend | Family email digests and notices. | United States |
| Clerk | Staff sign-in. Never sees resident information. | United States |
| Vercel | Runs the application. | United States |
| Google (FCM) | Delivers push notifications to the Android app. Carries no resident detail when discreet notifications are on. | United States |
What we keep
Retention is decided by what a thing is for, not by what somebody paid. It is not a pricing tier and it never will be.
Permanent, and the home's to take with it. What was found, who responded, and when.
90 days. An offhand sentence on a Tuesday should not follow somebody for the rest of their life.
Not retained after the transcript is produced.
Kept for as long as the account exists, because 'who saw this' is part of the record.
Controls
Nobody is called without consent recorded against their name, and the calls stop the moment it is withdrawn.
A director sees her building and nothing else. An account we cannot place sees nothing at all and is told why.
Who did it, and when. Silence is recorded as silence rather than as an outcome.
TLS everywhere. The Android app refuses plaintext and refuses mixed content.
Sign-in is per person. Owner, director, caregiver and family each see a different product.
An independent monitor checks the engine ran. If it goes dark, we are paged, you should not be the monitoring system for the thing monitoring for you.
What we do not claim
This list will get shorter. Until it does, it is here, because a vendor who only tells you the good half has told you nothing.
There is no report, and no auditor. When a customer needs one we will start the audit and say so here, with the date it began.
Nobody certifies that, and a claim nobody can check is not worth making. We say what we do instead, above, so you can judge it.
No diagnosis, no treatment, no clinical decision. Signals and routing, with your staff deciding.
Emergencies go to emergency services. Iris says so on the call.
Not yet. It is on the list, and this page will name the firm and the date when it has been.
One named person is accountable for privacy and security. Write to them directly.