Resident identities are never stored
When a partner agency enters a resident into the system, the person's name and identifying details are immediately converted into a one-way hash using a secret server-side key. We cannot reverse the hash, and we do not store names, dates of birth, addresses, or Social Security numbers in a readable form. Two agencies can recognize that they are helping the same person only by comparing these hashes within the network, and only when the resident has given consent for that sharing.
Consent is required before any sharing
Every resident has a consent record that controls what partner agencies can see. If no consent record exists, the system defaults to the least sharing possible — usually no access at all. Residents can expand or restrict access over time, and every change is recorded in an audit trail that shows who made the change, when, and what data scope changed. Agencies receive a notification when their access to a resident's history changes.
Role-based access and least privilege
Partner agency staff only see the data they need for their work. Network administrators can manage directory entries and agency approvals, but they do not access case notes or referral details between agencies. Organization admins can invite and manage their own team members. Row-level security policies in the database enforce these rules at the data layer, not just in the application interface.
Encrypted connections and infrastructure
All traffic between your browser and our servers uses HTTPS/TLS. Passwords are hashed with modern algorithms. The database is hosted by a managed cloud provider with encryption at rest and regular automated backups. We do not sell, rent, or share resident or agency data with advertisers, data brokers, or unrelated third parties.
Audit trails and accountability
The system keeps timestamped records of major actions: referral creation, status changes, assignments, consent updates, and profile edits. Agency staff can view the history for referrals and consent records they are authorized to see. This supports quality improvement and makes it easier to understand what happened if a case needs review.
Responsible disclosure
If you believe you have found a security or privacy issue in Kalamazoo Care Network, please report it to us privately. We will investigate promptly and keep your report confidential while we assess it.