ExpressAgainSecurity built for sensitive care communication.
ExpressAgain is built HIPAA-ready from day one — designed to safeguard patient information at every step, from the words a patient taps to the messages a family shares.
HIPAA-ready by design
Architected from day one around the safeguards HIPAA expects.
Role-based access
Three isolated layers — patient, family, and care team — each with its own credentials.
Encrypted in transit & at rest
TLS on every connection; encryption at rest on our managed infrastructure.
Private by design
We collect only what care requires — and never sell data.
Layered protections you can trust
Built with safeguards at every level.
A communication app for people in care holds some of the most personal information there is. That's why protection isn't one feature — it's layered through how the product is designed, how it's built, and where it runs.
Below is exactly what protects your information today, and — marked honestly — what's still on our roadmap.
Administrative
How we run ExpressAgain — the rules and habits behind the product.
- Least-privilege design — every role sees only what its job requires.
- Minimal data collection — we ask only for what care requires, nothing more.
- Separation of duties between patient, family, and care-team roles.
- Incident response commitment — if something affects your data, we tell you plainly and quickly.
- Formal written policies and Business Associate Agreements (BAAs).Roadmap
Technical
The protections built directly into the software.
- TLS 1.2+ encryption for all data in transit.
- Industry-standard encryption at rest on our managed infrastructure.
- Passwords hashed with scrypt — never stored in plain text.
- Isolated, role-based API surfaces — each access layer talks to its own endpoints.
- Photos, audio, and video served only through short-lived signed links to signed-in users.
- Single-use family invite codes and single-use therapist codes — one code, one person.
- Multi-factor authentication (MFA).Roadmap
Infrastructure
Where ExpressAgain runs, and who keeps that ground secure.
- Hosted on Vercel, Neon, and Cloudflare — providers whose data centers maintain SOC 2 / ISO 27001 certifications.
- Media stored in a private bucket, never publicly listable.
- Automated backups managed by our database provider.
- Your data is never sold. Ever.
What this means in plain language
Security shouldn't require a glossary. Here's how it works for the person using ExpressAgain and the people around them.
Access isolation
Three separate sign-ins, three separate surfaces. Clinicians never see the family feed; family members never see the patient's private account data.
Account security
Passwords are hashed with scrypt, and sessions use secure tokens — credentials are never stored in plain text.
Data isolation
A family member can't read her private vault or journal, and the care team can't browse family photos. Each layer keeps its own lane.
Secure hosting
ExpressAgain runs on US-based managed cloud infrastructure with encryption at rest handled by our providers.
Privacy controls
You control who joins the circle. Every invite code is single-use and tied to one person, so you always know who was let in.
Working toward formal compliance, in the open.
Business Associate Agreements (BAAs) and formal compliance documentationRoadmap are part of our organizational rollout — we won't claim certifications we don't hold yet. If you're a hospital or care facility, we'd rather show you exactly where we are and plan the path together during pilot scoping.
Questions about security or privacy?
A real person will answer — plainly, and honestly.