This staging summary describes the product’s current privacy architecture. A reviewed privacy notice will replace it before any public pilot.
What the product is designed to keep
Account identity and language preference.
My Forest entries: a display name, entry type, ZIP code, sensitivity, and alert settings.
Care Circle invitations, acceptance, revocation, and entry-specific grants.
Consent events and the readings, rules, and delivery events needed for an auditable alert history.
What the product avoids
No free-form medical-risk notes.
No Care Circle access without an explicit active grant.
No plaintext contact destination in application-facing tables.
No external notification dispatch while staging or shadow mode is active.
Control and retention
Residents will be able to revoke Care Circle access and request deletion. Evidence required for consent, safety review, or a lawful hold may follow a separately approved retention schedule.
Exact retention periods, privacy contacts, service providers, and jurisdiction-specific rights remain under review and must be approved before the pilot.