Only the account owner can close the account, from Settings, Privacy and Security, under Close this account. The section is closed until you open it; it explains what closing does, counts what is about to be deleted (members, logins, organizations, health entries, doses, posts, notes, shifts, documents and files in storage), and lists what is kept and why. A caregiver-role account, a family member, a friend or a care-team login never sees it, and the server refuses them.
To go ahead, type CLOSE in capital letters and enter the account password; the password is checked the same way sign-in checks it, and five wrong tries pause the button for fifteen minutes. There is no undo. When it finishes, the device is signed out and taken to the home page.
What closing does, in order. Every partner connection is revoked and every organization following the patient through ExpressAgain is ended, exactly as when the family ends one from the Care Team page (an agency gets its frozen former-client record the same way). Every Home Team and care team login on the circle is switched off, and their house and door codes are revoked; a professional's own login row and profile are theirs and stay, switched off for this circle. Every family member and friend is unlinked; their own logins are not deleted (with no other circle, a login stays empty, and each person can delete it from their own Settings). Then every photo, video, voice note and document the circle recorded is deleted from storage, the voice provider is asked to delete a cloned voice, every row of the circle's data is deleted (the patient profile, the day plan, Health Tracking, medications and doses, the feed and the Love Bucket, the schedule, shifts, pay terms, house codes, the public page, support requests, the circle's own professional reviews), the names are removed from the audit rows that stay, and the login is deleted. A device that still holds a session for the closed account is signed out at its next request.
What is kept. Three kinds of record only. First, audit rows with every name removed: the sign-in history, the pay-detail and insurance reveal logs, the house-entry code audit and the Partner API access log; they hold ids, times and a device label, and are kept for six years from the day the account closes. Second, the records a professional or an organization legally keeps as its own: invoices and the shift parts they billed, signed agreements and their signing trail, consent records (marked revoked), an organization's own enrollment and sponsorship rows (marked ended), an agency's client record and former-client record, an organization's visit reports and an agency's billing setup, authorizations, payments and billing trail; these stay with that professional's or organization's own account, and the family's id on them no longer names anyone. Third, one closure line: the account id, an 8-character fingerprint of the email (never the address), the day, the counts and what was kept.
What closing cannot reach. The Willie owl chat keeps transcripts by chat session, not by account, so closing does not delete them. Emails and texts already delivered sit in the recipients' inboxes and with the email and text providers under their own policies. The database and storage providers keep backups for the period set in their consoles, which is separate from the app. The full schedule is in docs/data-retention.md in the code.
If closing stops partway, the app remembers which steps finished and a second tap finishes the rest; nothing is repeated. You can also email privacy@expressagain.com to ask for deletion or an export.
Step by step
- 1Sign in as the account owner and open Settings, then the Privacy and Security tab.
- 2Open Close this account at the bottom of the tab and read what is deleted and what is kept; the counts are the real numbers for this account.
- 3Type CLOSE in capital letters and enter the account password.
- 4Tap Close the account for good. You are signed out and taken to the home page.