Your recovery, your data.

• Your account: email, a name you choose, time zone and a securely hashed password.
• The journey: a first name or nickname, the specialty template, discharge date, city, and the plan that you or the care team typed in.
• Daily check-ins: five answers on simple scales, any ticked warning signs, and an optional note.
• Outcomes your care team records: if your team tracks measures such as a walking test or a pain score, the totals they enter and any return to hospital. loci never scores or interprets them.
• The circle: who joined, their role, shared errands and a short activity log.
• Taste: favorites you added, filters you ticked, and whether outings are welcome.
• Reminders: the time you chose and your channels. A mobile number only while SMS or WhatsApp reminders are on, and those messages never mention your health.

We do not ask for surnames, dates of birth, insurance numbers or medical record numbers. Please do not type them in.

• The care circle: only people who joined with an invite link you created.
• A care team: only if the person or main caregiver switches sharing on. Switching it off removes their access straight away.
• A welcome card link: only the first name, a message and taste rituals. Never the plan, a condition or a check-in.
• Nobody else. No advertising, no data sales, no sharing with employers or insurers without the switch above.

Qloo powers the comfort picks. It receives only the favorite names you added, a city point, and generic tags like “vegetarian” or “quiet” that you ticked.

It never receives a name, an email, the specialty, the plan, any check-in or any warning sign. Taste data is never used to infer a health condition, and it never affects flags, plans or any eligibility decision. Picks are labeled as aggregate taste affinity.

Qloo answers are cached on our server for up to a day so we make fewer calls. They are never published.

Every change to care-team sharing and to research consent is written to a consent log with the time and the person who made it. You can read it in your data export.

Research consent is a separate switch in Settings. It is off unless the person or main caregiver switches it on, and sharing with a care team never switches it on.

• What counts: check-in scores, whether a check-in raised a flag, outcome measures the team chose from standard instruments, and whether there was a return to hospital, grouped by specialty and week of recovery.
• What never counts: names, emails, phone numbers, invite codes, dates, notes, messages, custom measures, comfort favorites and anything from Qloo.
• Groups only: the care team sees counts and averages, never one person. Any group with fewer than 10 people is hidden, not rounded.
• Logged: every view and export of the research numbers is logged with who did it.
• Switch it off any time: you leave the numbers straight away. Stopping sharing with the team also stops research.

• Export: Settings, Export your data. One JSON file with everything we hold about you and your circles.
• Delete: Settings, Delete everything. Your account and every journey you own are erased at once, including other members' entries on them.
• Demo accounts erase themselves within 24 hours, or the moment you sign out.

Passwords are hashed with Argon2. Sessions are random tokens stored as hashes in an HttpOnly cookie. All traffic uses HTTPS. Access to every journey is checked on the server for every request.