Privacy Policy

1 Who We Are

GuardianStep ("we," "our," or "us") is a software platform designed to help legal guardians, conservators, and holders of power of attorney manage elder care responsibilities. Our services include care coordination, financial tracking, document management, health record connectivity, and court report generation for individuals serving in a guardianship or similar fiduciary role.

For purposes of this Privacy Policy, "you" refers to the guardian, account holder, or authorized user of the GuardianStep platform. Information about the person in your care (the "ward" or "elder") is handled with the same protections described in this policy.

Privacy Contact: For privacy questions, data requests, or HIPAA-related inquiries, contact our Privacy Officer at privacy@guardianstep.com.

2 Information We Collect

Information You Provide Directly

• Account information: name, email address, username, and password (hashed using bcrypt)
• Elder/ward profile: name, date of birth, address, contact information, facility information
• Care records: medications, physician details, care team notes, health vitals, allergies, and medical directives you enter
• Financial records: bank account names and last-4 digits, transaction amounts, descriptions, categories, and dates you manually record or import
• Legal documents: power of attorney records, advance directives, and court reports you generate or upload
• Asset inventory: descriptions, estimated values, photos, and ownership records for the ward's property and assets
• Communications: messages or notes logged within the platform

Information From Third-Party Integrations

• Plaid: If you connect a bank account, Plaid transmits account names, balances, and transaction history to GuardianStep on your behalf. See Section 5 for full details.
• EHR Connectivity (1upHealth / Flexpa / FHIR APIs): If you use optional health record connectivity, we receive standardized health data (FHIR R4 resources) including medications, conditions, observations (vitals), care team details, and allergies from authorized health systems. See Section 7 for full details.
• CLEAR Identity Verification: If you complete CLEAR biometric identity verification, we receive a confirmation token indicating successful identity verification. We do not receive biometric data — that is processed and stored exclusively by CLEAR.

Information We Collect Automatically

• Log data: IP address, browser type, pages visited, and timestamps of access
• Authentication events: login attempts, MFA usage, and session tokens
• Usage data: features accessed and actions taken within the application (not the content of those actions)

3 How We Use Your Information

We do not use your information for advertising, behavioral tracking, sale to third parties, or training AI/ML models without your explicit consent.

4 How We Share Your Information

We share your information only in the following limited circumstances:

• Infrastructure providers: Replit, Inc. (hosting infrastructure, operating under a HIPAA Business Associate Agreement) and Neon (managed PostgreSQL database) process data solely on our behalf under data processing agreements.
• Financial connectivity: Plaid Technologies, Inc. facilitates bank account connectivity. See Section 5.
• Health record connectivity: 1upHealth, Flexpa, or similar FHIR-enabled aggregators facilitate EHR data access under Business Associate Agreements. See Section 7.
• Identity verification: CLEAR (Secure Identity LLC) processes biometric verification. GuardianStep receives only a verification result token — no biometric data is shared with or stored by GuardianStep.
• AI processing: OpenAI, LLC processes anonymized item descriptions for the Inventory Valuation feature. No PHI, financial data, or personally identifiable information about the ward is transmitted to OpenAI.
• Legal requirements: We may disclose data if required by law, court order, or government authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may transfer as part of that transaction. We will notify you in advance.
• With your consent: Guest access you explicitly grant (e.g., to a co-agent or care manager) shares only the data within that guest's permission scope.

We never sell, rent, or trade personal information or Protected Health Information to third parties for their own marketing or commercial purposes.

5 Financial Data & Plaid

Plaid's collection and use of your information is governed by Plaid's Privacy Policy, available at plaid.com/legal.

What We Receive From Plaid

• Account holder name and account type
• Account number (last 4 digits only — never the full number)
• Current and available balance
• Transaction history: date, amount, merchant name, and category

How We Protect Financial Data

• Financial data is encrypted at rest using AES-256-GCM field-level encryption before storage in our database. Even database administrators cannot read financial values without the encryption key.
• All data in transit is protected by TLS 1.2 or higher.
• Access to financial pages requires CLEAR biometric step-up authentication.
• We do not store Plaid access tokens beyond their operational purpose.

Revoking Bank Access

You may disconnect your bank account at any time from the Finances section of GuardianStep. Doing so will revoke Plaid's ongoing access to your financial institution. Historical transaction data already imported remains in your account until you delete it.

6 HIPAA and Protected Health Information

Our Role Under HIPAA

GuardianStep operates as a Business Associate under HIPAA when processing PHI on behalf of Covered Entities (such as health plans or healthcare providers), and as a platform used by individuals acting as personal representatives of patients under 45 C.F.R. § 164.502(g). Legal guardians and court-appointed conservators generally qualify as personal representatives under HIPAA and are authorized to access and manage the PHI of their wards.

What Constitutes PHI in GuardianStep

The following data elements may constitute PHI when associated with an identifiable individual:

• Medications, dosages, and prescribing physicians
• Medical conditions and diagnoses
• Health vitals (blood pressure, weight, oxygen saturation, etc.)
• Physician and care team information
• Allergies and adverse reactions
• Care notes and visit records that reference health status
• Health records imported from connected EHR systems

HIPAA Safeguards We Maintain

• Encryption at rest: All database storage uses AES-256 encryption. Sensitive fields use additional field-level encryption.
• Encryption in transit: All communications use TLS 1.2 or higher.
• Access controls: Role-based access limits what each user can see. Sensitive medical pages require step-up identity verification.
• Audit logging: All access to PHI-containing records is logged with user identity, timestamp, and action.
• Minimum necessary: We access and process only the PHI necessary to provide the requested service.
• Business Associate Agreements: We maintain BAAs with all subcontractors who process PHI on our behalf (Replit Enterprise for infrastructure, 1upHealth or Flexpa for EHR connectivity).

Breach Notification

In the event of a breach of unsecured PHI, GuardianStep will notify affected individuals without unreasonable delay and no later than 60 days after discovery of the breach, as required by the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D).

Enterprise BAA

Organizations that require a formal Business Associate Agreement with GuardianStep for enterprise or institutional deployments should contact us at privacy@guardianstep.com.

7 Electronic Health Record (EHR) Connectivity

How It Works

GuardianStep uses FHIR R4 APIs (mandated by the 21st Century Cures Act) and authorized health data aggregators to retrieve a ward's health records from connected health systems. The guardian or authorized personal representative initiates the connection and grants explicit authorization through the health system's OAuth consent flow.

Data We Receive From EHR Connections

• MedicationStatement / MedicationRequest: current and historical medications
• Condition: diagnosed conditions and problem list items
• Observation: vitals (blood pressure, weight, oxygen saturation, blood glucose, etc.)
• Practitioner / CareTeam: attending physicians and care team members
• AllergyIntolerance: known allergies and adverse reactions

How We Handle EHR Data

• Imported health data is stored in your GuardianStep account and subject to the same encryption and access controls as manually entered data.
• Imported data is attributed to its source health system and marked with an import timestamp.
• We do not modify data received from EHR systems before storing it.
• We maintain BAAs with all EHR aggregators (e.g., 1upHealth) who process PHI on our behalf.

Disconnecting EHR Access

You may disconnect any EHR connection at any time from your account settings. Disconnection revokes ongoing access to that health system. Health data already imported remains in your account and can be manually deleted from within the application.

Accuracy Disclaimer

GuardianStep does not guarantee the accuracy, completeness, or currency of data received from third-party health systems. All imported health data should be reviewed by you and, where appropriate, verified with the ward's care team before relying on it for care decisions or court submissions.

8 Data Security

GuardianStep implements multiple layers of security controls:

• Encryption at rest: Sensitive financial fields (balances, account names, transaction descriptions) use AES-256-GCM field-level encryption. All database storage uses AES-256 disk-level encryption.
• Encryption in transit: All communications use TLS 1.2 or higher. Older protocol versions are rejected at the infrastructure level.
• Authentication: Passwords are hashed using bcrypt. CLEAR biometric step-up authentication is required for access to financial, medical, and sensitive data sections.
• Access controls: Role-based access limits what each user can see and do. Guest access is scoped and audited.
• Audit logging: All significant platform actions are logged with user identity, IP address, and timestamp.
• Infrastructure: Hosted on Replit Enterprise infrastructure under a HIPAA Business Associate Agreement, maintaining SOC 2 compliance.

9 Data Retention

We retain your data for as long as your account is active or as needed to provide the service. Specific retention rules:

• Active accounts: All data is retained while your account is active.
• After account deletion: Personal data is purged within 30 days. Aggregated, de-identified analytics data may be retained longer.
• HIPAA records: Policies, procedures, and records related to HIPAA compliance are retained for a minimum of six (6) years from creation or last effective date, per 45 C.F.R. § 164.530(j).
• Legal holds: We may retain data longer if required by law or if it is subject to a legal dispute.
• Audit logs: Authentication and security logs are retained for 12 months.

10 Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data.
• Portability: Request an export of your data in a machine-readable format.
• Objection / Restriction: Object to certain processing or request we restrict it.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email privacy@guardianstep.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

HIPAA Individual Rights: To the extent GuardianStep processes PHI on your behalf as a personal representative of a ward, individuals have rights under HIPAA including the right to access, amend, and receive an accounting of disclosures of their PHI. Requests should be directed to privacy@guardianstep.com.

California residents: You have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of sale of personal information. GuardianStep does not sell personal information.

11 Cookies & Tracking

GuardianStep uses minimal cookies and local storage:

• Authentication token: Stored in browser local storage to maintain your session. Cleared on sign-out.
• Functional preferences: Theme or display preferences you set, stored locally in your browser.

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that track you across websites.

12 Children's Privacy

GuardianStep is designed for use by adults in a fiduciary or caregiving role. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

13 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page and, for material changes, notify you by email or in-app notification at least 14 days before the changes take effect.

Your continued use of GuardianStep after the effective date constitutes acceptance of the updated policy.

Version 2.0 (April 18, 2026): Added HIPAA compliance section, EHR connectivity section, CLEAR identity verification disclosures, updated infrastructure disclosures to reflect Replit Enterprise BAA, and updated AI/OpenAI disclosure for Inventory Valuation feature.

14 SMS / Text Messaging Program

GuardianStep operates an SMS messaging program to deliver time-sensitive alerts and notifications related to your account and the people you care for.

Program description. The GuardianStep SMS program sends transactional and account-related text messages, including: care alerts (medication reminders, missed check-ins, vitals out of range), document expiration notices, two-factor authentication codes, temporary access link confirmations, court-deadline reminders, and team-invitation notifications. We do not use SMS for marketing or promotional content.

How you opt in. By providing your mobile phone number during account signup, profile update, team invitation acceptance, or temporary-access enrollment, and by checking the consent box that accompanies the phone-number field, you expressly consent to receive text messages from GuardianStep at that number. You may also reply START or YES to a GuardianStep number to re-enroll after opting out.

Message frequency. Message frequency varies based on account activity and the events you have configured for the people you care for. A typical user receives between 2 and 20 messages per month. Two-factor authentication users may receive additional messages on each sign-in.

Carrier disclosure. Message and data rates may apply. GuardianStep is not responsible for any charges your wireless carrier may impose. Carriers are not liable for delayed or undelivered messages.

How to opt out. You may opt out of GuardianStep SMS messages at any time by replying STOP to any message you receive from us. After you reply STOP, we will send a single confirmation message and you will receive no further texts from that program. To rejoin, reply START. For help, reply HELP or contact customerservice@guardianstep.com.

Mobile information sharing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of personal information described in this Privacy Policy exclude mobile opt-in data and consent; this information will not be shared with any third parties. Mobile phone numbers are shared only with our SMS service provider (Twilio Inc.) for the sole purpose of transmitting the messages described above.

Supported carriers. The GuardianStep SMS program is available on most major U.S. wireless carriers, including AT&T, Verizon Wireless, T-Mobile, Sprint, U.S. Cellular, Boost Mobile, MetroPCS, Cricket, and Google Fi. Carriers are not liable for delayed or undelivered messages.

15 Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:

• General inquiries: customerservice@guardianstep.com
• Privacy & HIPAA: privacy@guardianstep.com
• Enterprise BAA inquiries: privacy@guardianstep.com — include "BAA Request" in your subject line
• Website: guardianstep.com

We aim to respond to all privacy inquiries within 5 business days.