What we hold, and who can see it
Helping someone with their technology means we end up seeing some of their information. This page says what, plainly. It is not a substitute for the agreement we sign with you, and if anything here matters to your decision, ask us and we will answer directly.
If you fill in a form on this site
The help request form collects your name, a phone number or email address, and whatever else you choose to put in it. That goes into our system and to our inbox, and we use it to get back to you. We do not sell it, we do not share it with anyone else, and we do not send marketing email.
Please do not put passwords, bank details or medical records into that form. It reaches us as ordinary email, which is not a safe place for any of those.
When we help you with a device
Sorting out a phone or a computer means we will sometimes see what is on it. We look at what we need to fix the problem and nothing else, we do not copy anything off your devices, and we never keep your passwords. Where a password needs setting up, you choose it and you keep it.
If you use a family page or portal we set up
Some of what we build — a FreeStyle Libre 3 setup, for instance — includes a private page your family can sign in to. It can hold a calendar, notes about visits and calls, and, where there is consent on file, health information such as current glucose readings.
Some specifics that are true today:
- Accounts are created by invitation only. There is no public sign-up.
- Each person has their own sign-in. Shared logins defeat the whole point of the record below.
- Seeing health information is a separate permission from having an account. Family members who should see the calendar but not the medical side are set up that way.
- Every view of health information is recorded, with who and when. Administrators can read that record. So can the person the information is about, or their representative, on request.
- We keep the smallest amount that makes the portal useful. Glucose readings are read from the monitoring system a minute at a time and are not accumulated here.
- Everything travels over an encrypted connection, and sessions time out.
Consent
Nobody’s health information goes into the portal without their agreement, or the agreement of whoever holds the legal authority to give it. That agreement is written down, dated, and kept on file, and it says who it covers. It can be narrowed or withdrawn at any time, by telling us — and if it is withdrawn, access stops.
About HIPAA
The Makers, LLC is a technology services company. We are not a doctor, a hospital, a health plan or a clearinghouse, so we are generally not what HIPAA calls a covered entity. If we ever work under contract for one — a hospital or a physician’s practice, for instance — we would be a business associate, we would sign the agreement that comes with that, and we would meet the obligations in it.
Either way, we have built this system to the standard we would have to meet if HIPAA applied in full: named accounts, access granted per person and no wider than necessary, an audit trail of every view, encryption in transit, automatic sign-out, and written consent on file. We think that is the right floor regardless of which side of a legal line we sit on.
Asking us about your information
You can ask what we hold about you or about the person you care for, ask for a copy, ask for it to be corrected, or ask us to delete it. Use the contact form and say what you would like; we will reply to the email address or phone number you give us there. Some records we have to keep for a period to meet our own legal and insurance obligations, and if that applies we will tell you which and for how long.