Private to the member
- Journal entries
- Nightly reflections
- Gratitude lists
- Meditation history
- The member's own recovery plan
- Personal meeting plans and private reminders
- The private attendance record
- The member's blocked-members list
Trust
Privacy and security
Alumni are former patients. This page is the plain-language version of how the product treats their information. The Privacy policy is the governing document.
What staff cannot read
These are private to the member who wrote them. Center staff have no read access to any of them through the product.
Visible to authorized center staff
- The member profile and directory details the member chose to fill in
- Community activity the member intentionally posted or sent
- Check-in and aftercare signals, and support requests
- Referrals the member submitted, and moderation information
Enforced, not promised
That boundary lives in the database rules, so it holds regardless of what any screen chooses to show. An automated check runs in our build and fails it if the boundary is ever crossed — which means a change that broke it could not ship quietly.
The rest of it, briefly
No scoring, no monitoring, no diagnosis
The product does not score a member, does not predict relapse, does not diagnose anything, and does not watch anyone continuously. It is not a medical device and not a clinical record.
Staff see the ask, not the writing
Outreach shows that someone asked for help, or has been quiet. It does not show what they wrote privately, and a staff follow-up note is not mirrored back onto the request.
One center at a time
Each community is private to its own center. A member’s access is scoped to their center on every read.
Location is asked for once, and blurred
Only when a member taps to find meetings nearby. The coordinates are reduced to roughly neighborhood precision before they leave the device, are not saved as a history, and background location is never requested. Searching by city or ZIP needs no location access at all.
Lock-screen safe
Sensitive detail does not appear in a notification preview.
Member control, easy to find
Hide from the directory, block, report, leave a center, export your information, and delete your account — all from inside the app.
This website collects nothing
Separate from the app, and worth stating on the page that makes the claim: alumnicopilot.com loads no analytics vendor, no tag manager, no third-party font, no embedded video player, and no advertising or tracking script of any kind. There is no contact form here, and no cookie banner, because there is nothing to consent to.
What exists is ordinary server access logs kept by the host that serves these pages. A product whose central claim is a privacy boundary should not load a third-party tracker on the page making that claim.
Where we stand on compliance
There is no such thing as a certified product here — HHS does not certify software, and compliance is a property of a deployment: the center’s role, the data flow, the signed agreements, and the configuration. Alumni Co-Pilot should not be described as “HIPAA compliant” on the strength of software features alone, by us or by anyone else.
A person’s relationship with a substance-use treatment program can remain protected after treatment ends, so we treat center-linked information as sensitive rather than assuming alumni data is exempt. Depending on the center and the information involved, HIPAA, 42 CFR Part 2, state privacy laws, and contractual obligations may apply.
We keep a written posture document covering how the architecture relates to HIPAA and 42 CFR Part 2, what is enforced in code today, and the specific agreements that need to be in place before a center pilot begins — including the open items. It is written for a compliance reviewer, and your team can have it.