DRAFT · OPERATOR REVIEW REQUIRED
Privacy notice
This private family pilot is operated by the Atiman Daily family administrator. For privacy, support, export, correction or access requests, contact the family administrator who invited you through your usual private family contact. No public support mailbox is provided. This notice still requires review before real patient information is collected.
Information and purpose
Atiman Daily coordinates shared care through account identity, patient profiles, membership and authorization records, care plans, manually entered care records, and audit history. Authorized participants can see their patient’s shared records. Access depends on active membership, never possession of a Patient ID.
Storage and devices
Connected records are stored in the operator’s configured Supabase environment and accessed through the authenticated application. Connected patient records are not designed for offline storage. The service worker caches public shell assets only. The fictional demo uses separate synthetic browser storage.
Session cookies maintain sign-in. Optional notification subscriptions identify a device to its push service. Lock-screen notification content is generic; notifications are best-effort and do not establish that care was provided or a message was seen.
Control and requests
Patient Admins manage participant access. You can request account deletion from account settings. Requests require operator review; deleting an individual account must not silently destroy shared care records or audit history. Access, correction, export, retention, and erasure requests need an operator-managed process.
Before real use
The pilot uses Vercel hosting and Supabase authentication/database services, with the database in Singapore. Google handles Google account sign-in. Care records remain in the shared profile until an administrator reviews an appropriate retention or erasure request; removing a membership or account does not erase shared history.
The intended encrypted backup retention is 30 days. Automated hosted backup coverage is not yet active. The administrator must verify the first hosted backup and recovery procedure before relying on it, review requests and incidents, and approve the authorization and privacy arrangements before real use. A public launch requires a named responsible operator and monitored contact.
This draft does not claim legal compliance or approve real-data use.