Privacy

While you build a draft

• Pasted text and PDFs are sent to AfterVisit's server to build the draft. They are processed in memory and are not saved.
• Photos are read in your browser. The photo is not uploaded; only the text read from it is sent to build the draft.
• The draft is built by AfterVisit's built-in parser, running on AfterVisit's server.
• Your draft stays in this browser tab until you create a handoff or close the tab.

What is saved when you create a handoff

• Only the items you reviewed and confirmed: visit details, medication changes, next steps and who is responsible, things to watch for, questions, and any notes you kept. Each item may include the sentence from the summary it came from.
• For each person you share with: their name and role, which parts they can see, when they opened their link, when they tapped “I've read this,” and any updates they made to their next steps (including notes). Your first name is saved too.
• The full text of the summary is not saved.
• The original document is saved only if you turn on Attach the original summary. It is kept in private storage, opens only through a link that checks the handoff still exists, and is deleted with the handoff.
• When someone taps “I've read this,” the name they typed and the time are saved.
• PINs, personal links and your private manage key are stored only as one-way hashes.
• If you send feedback, it is stored without any link to a handoff, your IP address or your name.

Who can open a handoff

• Each person you share with gets their own link and sees only the parts you chose for them. You can remove one person's access, or send them a new link, at any time without affecting anyone else.
• Anyone who has a person's link can open it if the handoff has no PIN. Links are long random codes that are hard to guess, but a link can be forwarded.
• New handoffs are protected with a 4-digit PIN by default. A PIN adds a second step; it does not confirm who someone is. Three wrong tries lock that person's link for 10 minutes, and repeated lockouts last longer until the caregiver unlocks it. One person's wrong tries never lock anyone else out.
• “I've read this” and updates to next steps are recorded against the personal link they came from. That shows which link was used, not who was holding the phone: AfterVisit does not verify identity, so these are self-reported.
• Handoff pages ask search engines not to index them and send no referrer to other sites.

How long it lasts, and deleting it

• Every handoff expires 30 days after it is created. Expired handoffs stop opening right away and are deleted, along with any attached original, by a daily cleanup.
• You can delete a handoff at any time from your private manage link. Deletion is immediate.

Accounts, cookies and services we use

• You don't need an account to build, share or open a handoff.
• Caregivers who start a care circle sign in with Google. Google shares your name, email address and profile photo with AfterVisit's sign-in service, Supabase. AfterVisit never sees your Google password.
• People added to a circle don't need an account. They open their personal link, and their browser keeps a signed cookie for up to 90 days so they stay signed in to that circle.
• Cookies are used only to keep you signed in. There are no tracking cookies.
• The site is hosted on Vercel. Handoffs and attached originals are stored with Supabase in the United States.
• Page visits are counted with Vercel Web Analytics, which does not use cookies.
• To prevent abuse, a salted one-way hash of your IP address is kept for one day to count requests per hour.

Sharing someone's health information

Only share information you are allowed to share. Before creating a handoff you confirm that you are the patient, or that you have the patient's permission or legal authority to share it with the people you choose.

Where AfterVisit stands

AfterVisit is a prototype. It has not completed a formal privacy, security or HIPAA compliance review, and it does not give medical advice: it organizes what the clinician wrote.

Open source

The source code is public under the AGPL-3.0 license, so you can read exactly how the site works. Read the source code. Being open source makes the code inspectable; it does not by itself make a service secure.