For providers
Questions from clinicians
Notifications, patients who are wary of tracking anything, attestation, the clinical record, device loss, HIPAA, and open source.
Will I be notified when a patient logs something?
No, and there is no setting that changes it. Nobody is watching — not us, not you, not an on-call service. You see what was logged when you open the app, usually when preparing for a session.
This is deliberate. An app that implied someone was watching, and then wasn’t, would be worse than one that never implied it. When you introduce Bronwin to a patient, say this part out loud.
My patient is nervous about tracking this on a phone at all.
That instinct is the reason the board looks the way it does. A paper sheet is legible to whoever picks it up; a normal tracking app announces what it is on the lock screen and lists their symptoms in plain language when it opens. Bronwin opens to six colored buttons with no words on them, and what those buttons stand for is encrypted behind a PIN on their phone as well as yours.
Someone reading over their shoulder sees a colored dot and a number. So does anyone who takes the phone, and so do we. They can also disconnect at any point without asking you.
What am I attesting to when I connect someone?
Two things: that the person is your current patient, and that they are 18 or older. The gate is on you because you’re the one who knows. We have no way to verify either, and no way to check afterward.
It’s also what makes a misdirected invite link harmless — a stranger’s name in front of a clinician who knows their own caseload goes nowhere.
Is this my clinical record?
No, and don’t let it become one. Transcribe what’s clinically relevant into your own system. Export a date range to PDF, legend included, if you want the raw log in the chart.
What if my patient loses their phone?
Reconnect them the same way as the first time. Their history restores from your copy, and a new verification number appears for the two of you to check.
What if I lose mine?
You restore from a recovery phrase you wrote down at signup, or from a second enrolled device. Set one of those up before you connect your first patient.
If you lose your only device with no recovery phrase, every patient history goes with it and we cannot help you. That is the same property that makes the rest of this page true — we hold no key, so there is nothing for us to restore from.
Can I see patterns across my whole caseload?
No. Every connection has its own keys and there is no aggregate view. Building one would require a key that spans your patients, and we don’t hold any key at all.
Is this HIPAA compliant?
We are a Business Associate and we sign a BAA with every provider on every plan, including free. Encryption doesn’t remove that obligation — HHS addressed this exact fact pattern in its 2016 cloud computing guidance, and a service that stores encrypted PHI without the key is still a Business Associate. Anyone claiming otherwise is selling you something.
What encryption changes is what a breach means. Content encrypted under keys we have never possessed is a much weaker thing to lose, and that is the honest version of the security argument.
Can a patient stop?
Any time, without asking you. Disconnecting stops new data from being shared. You keep what you already have, the same as any notes you’ve taken.
Is the app open source?
The client is, with reproducible builds. Every promise on this page is a claim about what the app does on a phone, so a closed binary would leave you taking our word for all of it — which is the trust this whole design is meant to make unnecessary.
Reproducible builds close the rest of the gap: they let anyone confirm that the binary in the App Store was built from the published source.