Privacy notice

1. Data Minimization Principle

Bram Health operates strictly on the principle of data minimization. We collect and retain only the minimal operational information necessary to provide account access, coordinate care introductions, schedule home visits, and support daily family routines. We do not sell user data, track users across third-party websites, or use commercial advertising networks.

2. No Protected Health Information (PHI)

Bram Health is a technology network platform, not a licensed healthcare provider, medical practice, hospital, or HIPAA-covered entity. The platform is not an electronic health record (EHR) system. Do not submit medical records, psychiatric assessments, diagnostic reports, clinical chart notes, or government identification numbers into forms, referral notes, or companion check-ins. Direct clinical care, medical intake, and sensitive health communication must take place directly with your chosen healthcare provider through their certified secure communications channels.

3. Information We Collect and Process

Depending on your role and how you interact with Bram Health, we collect the following categories of information:

• Account & Authentication: Email address, display name, user ID, and assigned role (family member, partner staff, home manager, reviewer, or administrator) authenticated through Firebase Authentication. Real accounts never inherit test roles.
• Care Requests & Referrals (/find-care): Individual or contact name, requested care category (e.g. pediatric care, behavioral health, residential care), chosen destination practice or home, preferred contact method, and non-clinical coordination notes.
• Visit Requests & Capacity: Requested visit date/time, family contact name, confirmed appointment time, and residence capacity figures for residential homes (e.g. Camellia Oak Residence LLC, Mariposa Willow Residence LLC).
• Family Companion (/solutions/family-companion): Everyday household member nicknames, daily routines, non-clinical feeling check-ins, mission completions, and reminder preferences. Data is stored locally in browser storage and can synchronize with Firestore when signed into a verified family account.
• Partner Applications & Staff Profiles (/partners/apply, /partners/workspace/): Organization legal name, practice category, service descriptions, public state license numbers and verification sources, business address, professional headshot photo rights, and staff contact details.
• Operational Inquiries & Concerns: Waitlist inquiries, provider applications, and reported concerns submitted through designated forms.

4. How Information Is Stored and Protected

Operational data is stored using Google Cloud Firebase (Firestore project bram-health-care) with granular, role-based security rules enforcing tenant and role isolation:

• Families can view and edit only their own referral requests, visit bookings, and companion progress.
• Partner staff and home managers access only requests and visits specifically routed to their assigned facility.
• Admin and reviewer consoles require verified reviewer claims before displaying onboarding queues or directory moderation tools.
• Form endpoints check the request origin and limit repeated submissions to reduce automated abuse.

5. Information Sharing and Disclosure

We do not disclose your personal information to third parties except:

• With your designated destination: Care requests and visit inquiries are shared directly with the specific care partner practice or residential home you explicitly selected.
• With trusted infrastructure service providers: Essential hosting, database, and authentication providers (Vercel, Google Cloud/Firebase) operating under strict data protection terms.
• As required by law: Where required by valid legal process, subpoena, or applicable statutory obligation.

6. Cookies and Local Storage

The application uses functional browser storage (localStorage and sessionStorage) exclusively to maintain your active authentication session, role preferences, companion state, and search filters. No third-party advertising tracking cookies or analytics pixels are deployed.

7. Data Retention and Deletion Rights

You have the right to request access to the information associated with your account, request corrections to inaccurate business records, or request complete deletion of your account and personal data. To make any of these requests, contact our team. A self-serve deletion option is not available yet.

8. Contact Us

For inquiries regarding this draft privacy notice or data handling practices, contact our team. A dedicated privacy mailbox will be listed here before launch.