What protects the records, and what does not exist yet.

You are handing us health information about people who cannot easily advocate for themselves. This page says what is actually in place and, further down, what is not. We would rather lose a sale here than be found out in month three.

How access works

One provider cannot see another's records

Separation is enforced by the database itself, on every query, not by application code remembering to filter. A request carries who you are; the database decides what that person is allowed to read.

Who you are comes from your session, not from the request

Your organisation and identity are read from the verified sign-in token. A request cannot claim to be somebody else by changing what it sends.

A carer's assistant cannot be talked into another person's data

The carer's version of Hera takes no identity as input at all — it only ever knows the carer who is signed in. There is no argument to change, so asking it for a colleague's visits has nowhere to go. That is a structural limit, not a rule we ask it to follow.

Nothing the AI does is applied without you

Every change to a clinical, identity, status or rota record is prepared as a confirmation showing exactly what will change and how many records it touches. Cancelling visits and closing a safeguarding concern additionally require a typed reason, which is kept with the record.

Every write keeps a copy of what was there before

The audit trail is append-only and records the actor, the action, and the state of the record before the change. Twenty-three kinds of action can be undone, and undoing writes a new entry rather than erasing the old one.

Voice mode cannot write anything

The model you speak to holds no write tools and no authority to apply a change. It can look things up and explain them; anything that alters a record comes back as a confirmation you press.

Reading a document makes the rest of the turn more cautious

If Hera reads an uploaded document during a conversation, every subsequent action in that conversation is downgraded to require confirmation — so text hidden inside a document cannot cause a silent change.

Files are private by default

Staff documents and generated images live in private storage and are reached only through short-lived links that expire in minutes.

What we do not collect

This website and the product load no analytics, no session recording, no advertising pixels and no third-party scripts of any kind. We do not know which pages you read. The only cookies are the ones that keep you signed in, which is why you have not been asked to accept any.

Care data is stored in our database in Tokyo, Japan — a country the UK has formally found to provide adequate protection — and text you send to Hera is processed by OpenAI in order to answer it.

What we do not have

In full, so you can decide now rather than later. If any of these is a requirement for your service, we are not the right choice yet, and it is better that you know.

Certifications: We hold no ISO 27001, SOC 2, Cyber Essentials or DSPT certification.
Clinical safety standards: DCB0129 and DCB0160 have not been undertaken, and no Clinical Safety Officer has been appointed.
Two-factor sign-in: Not built. Sign-in is email and password, with a minimum of eight characters and no forced rotation.
Single sign-on: Not built.
Where your data lives: Your records are stored in a database in Tokyo, Japan. Japan holds a UK adequacy decision, so the transfer is lawful without additional safeguards — but the data is not in the UK or the EEA, and if that is a condition of your contract we are not the right choice. AI processing happens through OpenAI on their default infrastructure. We will not claim a UK or EU processing guarantee until one exists.
Whole-service data export: You can export individual generated documents as Word or PDF. There is no bulk export of your whole record set yet.
Offline working: The mobile app needs a signal. A visit in a notspot is recorded when the carer is back in coverage.
Electronic signatures: Agreements generate and download, and you can mark one as sent, but nothing is delivered or signed inside HeraIQ.
eMAR: Medication is recorded through care planning and visit notes, not as a formal administration chart.
Payroll, invoicing and family portals: Out of scope.
Penetration testing: No third-party penetration test has been commissioned.

Reporting something

If you believe you have found a security problem, email security@heraiq.io with enough detail to reproduce it. We will confirm we have received it, and we will not take action against anyone who reports a genuine issue in good faith.