Question 1

Is CareSync HIPAA-compliant, and does it handle PHI?

Accepted Answer

CareSync applies HIPAA-aligned technical safeguards — AES-256 encryption at rest, TLS in transit, access-scoped data, and regular third-party security audits — so the information you store is protected to the same standard covered entities must meet.

That said, CareSync is a family care-coordination tool, not a covered entity or a business associate under HIPAA. The calendar entries, documents, and notes you share with your care circle are not automatically "Protected Health Information" under HIPAA's legal definition unless you are using CareSync in a covered-entity context (e.g., as a healthcare provider). For most families, the data you enter is personal health information in the plain-language sense, not a legal PHI record — and that is exactly what CareSync is built to protect.

Question 2

Who in the care circle can see calendar entries, documents, and messages?

Accepted Answer

Only the people you explicitly invite to the care circle can see anything. Within the circle, visibility follows role-based access: the circle owner controls which members can view or edit each resource type. Calendar appointments are visible to all active members by default; documents and messages respect the permissions set by the owner. No data is visible to outside parties, Polsia staff, or other CareSync users — ever.

Question 3

What happens to a member's access when they leave the circle?

Accepted Answer

Access is revoked immediately and completely. The moment you remove a member — or they leave — they lose all visibility into the circle's calendar, documents, messages, and contacts. They cannot retrieve previously viewed files or re-access the circle without a new invitation from the owner. Historical activity logs retain the member's past actions for the owner's audit trail, but the departing member cannot see those logs.

Question 4

How is my account secured, and what happens if I forget my password?

Accepted Answer

Accounts are protected with bcrypt-hashed credentials, HTTPS-only sessions, and optional two-factor authentication. If you forget your password, use the "Forgot password" link on the sign-in page to receive a one-time reset link sent to your verified email address. The link expires after 30 minutes. CareSync staff cannot view or recover your password — the reset flow is the only path, which ensures that only you (with access to your email) can regain entry.

Question 5

Does CareSync replace my doctor, medical records, or a covered-entity system?

Accepted Answer

No — and it is not designed to. CareSync sits alongside your medical records, not in place of them. It coordinates the humans who support your loved one: scheduling appointments, sharing documents (like discharge summaries you already have), delegating tasks, and keeping everyone's communication in one place. The source of clinical truth remains your provider's EHR. Think of CareSync as the logistics layer that connects your care team, not a substitute for the clinical record.

Frequently asked questions

Is CareSync HIPAA-compliant, and does it handle PHI?

Who in the care circle can see calendar entries, documents, and messages?

What happens to a member's access when they leave the circle?

How is my account secured, and what happens if I forget my password?

Does CareSync replace my doctor, medical records, or a covered-entity system?