GOOD FAMILY CARE

Privacy & care agreement

Privacy & care agreement · Version 2026-10-17.5-preview

Here is what this dashboard stores, who can access it and the personal information protection practices that apply. Ask for support or a printed copy if that is easier. You can choose another way to coordinate care.

Purpose and administration

Good Family Care is a private family care-coordination portal administered by Michael Stuckless and designated family administrators. This agreement addresses the collection, storage, access, creation, use and disclosure of information for Margaret’s and Harold’s agreed care and related family administration. It does not establish a professional treatment relationship or replace a care provider’s clinical record.

Information and permitted purposes

The portal holds care plans, medication directions and administration records, appointments, observations, agreed supports, contacts, provider instructions, relevant documents, profile photographs, account details and activity records. Information is processed to coordinate care, maintain continuity, communicate relevant observations, administer authorized access and preserve an attributable record. Collection is limited to information reasonably necessary for those purposes. Unrelated commercial use, advertising, sale and research are outside this agreement.

Authority and the person’s choices

The family administrator manages the underlying authority and permission for Margaret’s and Harold’s care information, including the permission provided through their guardian. The portal’s single account checkbox records confidentiality and appropriate-use agreement; it is not a separate consent-to-treatment form or a substitute for the guardian’s legal authority. The person’s choices, preferences and applicable information rights remain relevant. An account role does not expand the scope of any guardian, attorney or executor appointment.

Access and confidentiality

Approved care-team members may access shared care information for Margaret and Harold within their assigned role. The owner and administrators manage membership, plans and records. Caregivers record care and coordinate tasks and appointments; viewers read shared information. Administrator-only documents, including their titles and notes, are restricted to the owner and administrators. New uploads default to this restricted audience. Older documents retain their previous sharing unless an administrator changes it. Only administrators may export the full record or agreement evidence. An administrative account does not confer legal authority as an executor, attorney or substitute decision-maker.

Hosting and service-provider access

For the production deployment described by this agreement, care records and uploaded documents are hosted on the family-managed OVHcloud server in Beauharnois, Quebec, Canada. OVHcloud provides the underlying infrastructure; the family administrators remain responsible for application configuration, user access and ongoing administration. Supabase provides the sign-in service; the currently configured authentication project is in US East, so account and authentication information is not represented as exclusively Canadian. The configured email delivery service and recipients’ email providers process sign-in messages. Authorized technical administrators and service providers may process or access information as necessary for operation, support, security or lawful requirements under their applicable arrangements. Family-only access does not exclude such technical processing.

Personal information protection measures

Access uses individual approved accounts and server-side permission checks. Owner and administrator accounts require authenticator-based multi-factor authentication before care information or administrator controls are available. Disabled accounts are denied further application access. Connections use HTTPS, and email-session cookies are Secure and HttpOnly. Changes, full-record exports and source-document downloads are attributed to the signed-in account; this does not mean every view or external copy is logged. Files are delivered through authenticated endpoints. The application does not introduce advertising trackers or remote web fonts. Safeguards are proportionate measures rather than a guarantee against loss, unauthorized access or service interruption; this agreement does not assert end-to-end encryption or privacy-law certification.

Common documentation and privacy practices

Documentation is factual, respectful, relevant and timely, with the person’s choices and agreed supports distinguished from assumptions. Medication administration is recorded after the event; corrections preserve the original record and an explanation. Access is limited to the care or administrative purpose for which it was authorized. Accounts and verification codes remain individual. Downloads, printed records and calendar exports are managed securely because they leave portal access controls. Any summary copied from an administrator-only document into a shared record becomes visible to the care team and requires appropriate authority. Uploads do not automatically transcribe, verify or activate instructions.

Health numbers and other sensitive identifiers

A health-card number is not required to join or use the portal. Where a person voluntarily provides it for a necessary, legally permitted health-care purpose, such as arranging or expediting covered care, its purpose, authority and recipients must be established before collection. It is not used as a general identifier, account credential or access condition. Access is limited to authorized recipients who need it; an administrator-only record is appropriate where the wider care team does not require it. A card image is not collected merely because the number is available. Hosting in Canada does not itself authorize collection or disclosure.

Access requests, corrections, withdrawal and retention

Requests for access, copies, correction, restriction, deletion or withdrawal are directed to michaelstuckless@me.com. The administrator verifies the request and reviews applicable obligations before responding. Withdrawal is prospective: withdrawal of an account agreement prevents further care access by that account. Requests concerning Margaret’s or Harold’s underlying permissions are handled with the guardian and family administrator. It does not retrieve earlier copies or automatically erase historical care records or agreement evidence. Records are retained only for the care, accountability and applicable legal purposes for which they remain necessary. Administrators review membership and retention, address deletion requests and account for backup copies and their actual retention arrangements.

Privacy incidents and care concerns

Suspected unauthorized access, lost devices, mistaken disclosure or other privacy incidents are reported promptly to the administrator. The response includes containing access, preserving relevant evidence, assessing the information and people affected, and making notifications required by applicable law. Care questions are directed to the appropriate provider. This portal does not diagnose, prescribe, authorize medication changes or continuously monitor emergencies. Call 911 for an emergency.

Applicable requirements and agreement record

Use is subject to applicable law, including Ontario PHIPA where it applies to the relevant person and activity, applicable private-sector privacy requirements, professional obligations and service-provider terms. Personal family use does not automatically impose every organizational requirement, and family participation does not excuse a professional from their own duties. Express agreement is captured by an unchecked checkbox submitted from the user’s signed-in account, with the account, policy version and server timestamp recorded. No handwritten or typed signature is required by this portal. Material changes to information handling require an updated notice and renewed agreement. Nothing in this agreement waives statutory rights or creates legal authority that a user does not otherwise hold.

Information and sources

Privacy contact: michaelstuckless@me.com. Please avoid sending medical details in ordinary email.