Security built for sensitive care communication.
ExpressAgain is built from day one to safeguard patient information at every step, from the words a patient taps to the messages a family shares.
Privacy by design
Architected from day one around the safeguards HIPAA expects.
Role-based access
Three isolated layers — patient, family, and care team — each with its own credentials.
Encrypted in transit & at rest
TLS on every connection; encryption at rest on our managed infrastructure.
Private by design
We collect only what care requires — and never sell data.
Layered protections you can trust
Built with safeguards at every level.
A communication app for people in care holds some of the most personal information there is. That's why protection isn't one feature — it's layered through how the product is designed, how it's built, and where it runs.
Below is exactly what protects your information today, and — marked honestly — what's still on our roadmap.
Administrative
How we run ExpressAgain — the rules and habits behind the product.
- Least-privilege design — every role sees only what its job requires.
- Minimal data collection — we ask only for what care requires, nothing more.
- Separation of duties between patient, family, and care-team roles.
- Incident response commitment — if something affects your data, we tell you plainly and quickly.
- Business Associate Agreement: we sign a BAA with partner organizations once our vendor agreements are complete — in progress now; ask us for the timeline.Roadmap
Technical
The protections built directly into the software.
- TLS 1.2+ encryption for all data in transit.
- Industry-standard encryption at rest on our managed infrastructure.
- Passwords hashed with scrypt — never stored in plain text.
- Isolated, role-based API surfaces — each access layer talks to its own endpoints.
- Photos, audio, and video served only through short-lived signed links to signed-in users.
- Single-use family invite codes and single-use therapist codes — one code, one person.
- Multi-factor authentication (MFA).Roadmap
Infrastructure
Where ExpressAgain runs, and who keeps that ground secure.
- Hosted on Vercel, Neon, Amazon Web Services, and Cloudflare — providers whose data centers maintain SOC 2 / ISO 27001 certifications.
- Media stored in a private bucket, never publicly listable.
- Automated backups managed by our database provider.
- Your data is never sold. Ever.
Questions about security or privacy?
A real person will answer — plainly, and honestly.
What this means in plain language
Security shouldn't require a glossary. Here's how it works for the person using ExpressAgain and the people around them.
Access isolation
Three separate sign-ins, three separate surfaces. Clinicians never see the family feed; family members never see the patient's private account data.
Account security
Passwords are hashed with scrypt, and sessions use secure tokens — credentials are never stored in plain text.
Data isolation
A family member can't read the patient's private vault or journal, and the care team can't browse family photos. Each layer keeps its own lane.
Secure hosting
ExpressAgain runs on US-based managed cloud infrastructure with encryption at rest handled by our providers.
Privacy controls
You control who joins the circle. Every invite code is single-use and tied to one person, so you always know who was let in.
Working toward formal compliance, in the open.
Business Associate AgreementRoadmap: we sign a BAA with partner organizations once our vendor agreements are complete — in progress now; ask us for the timeline. Formal compliance documentation is part of the same rollout — we won't claim certifications we don't hold yet. If you're a hospital or care facility, we'd rather show you exactly where we are and plan the path together during pilot scoping.