Feature

Who can see what, and why

Sharing a medication routine is a real disclosure. The right answer is not "we take privacy seriously". It is a specific list of what the other person can see.

The exact list

A caregiver in a Care Circle can see:

• the medications in that circle: name, dose, schedule, and any note;
• whether each dose was taken, skipped or missed, and when it was confirmed;
• the history of those doses and the resulting adherence figure.

A caregiver cannot see:

• location, movement, or whether the phone has been used;
• messages, calls, photos, contacts, or any other app;
• anything at all outside the Care Circle they were invited to.

CareDuo is a care app, not a monitoring app. The distinction is that the person being cared for chooses, and can un-choose.

Nobody joins a circle silently

Access starts with an invitation, a link or a six-character code, that the other person must accept on their own device. Opening the link does not accept it. The acceptance screen states plainly what is being shared before anything is granted.

Codes are single use, expire after a few days, and are stored hashed, so a database export yields nothing usable. Repeated failed attempts are rate-limited, which is what stops codes being guessed at scale.

Permissions are enforced on the server

The app shows a caregiver a limited view; the server independently enforces it. That is the difference between a permission and a suggestion. A caregiver's credentials cannot read another circle's data, and cannot write medication, even if a client were modified to try.

Marking a dose missed is not a client's decision

Only the server can record a dose as missed, and it never overwrites a dose somebody confirmed. That prevents the failure mode that would matter most: a device with a wrong clock quietly recording that a person failed to take medication they actually took.

Notifications are written to be read by strangers

Every CareDuo notification assumes a lock screen is visible to whoever is in the room. Alerts name a person and a time of day; medication names stay inside the app.

Taking it back

The person taking medication can remove a caregiver at any time. Removal is immediate: no more dose visibility, no more alerts. Devices stop receiving notifications at sign-out.

For the formal account of what is stored, for how long, and how to delete it, see the privacy policy.

Common questions