Legal and responsible use
Clear policy language for a sensitive therapy workflow.
This page explains how QARELOG describes privacy, acceptable use, AI-assisted processing, caregiver sharing, security, service providers, and data-request expectations.
Privacy Policy
QARELOG processes information needed to operate therapy documentation, progress tracking, reporting, caregiver collaboration, authentication, feedback, and support workflows. Access depends on user role and client relationship.
- Account information such as name, email, role, approval status, specialty, and authentication-related profile fields.
- Client profile and therapy workflow information, including histories, assessments, goals, sessions, measurements, reports, and caregiver relationships.
- Security and audit information used for role-aware access, sensitive-action verification, session handling, and operational review.
- Feedback and support information submitted through QARELOG feedback channels.
- Local preferences and recovery choices stored in browser storage for interface state, role intent, and opted-in draft recovery.
Terms / Acceptable Use
Users are responsible for using QARELOG according to their organization policies, professional duties, and assigned role. Users should protect credentials, keep account access personal, and avoid adding information that is not needed for the therapy workflow.
- Therapists remain responsible for clinical judgment, documentation review, report approval, and caregiver disclosure decisions.
- Managers and administrators must use privileged access only for authorized operational purposes.
- Users should report suspected privacy, security, or account-access issues through established support or organization channels.
Cookies & Local Storage
QARELOG uses authentication cookies for signed-in sessions and browser storage for selected interface preferences, role intent, and optional local draft recovery behavior.
- Session cookies support authenticated access and role-aware routing.
- Local storage may preserve sidebar state, selected role hints, device identifiers for session work, and opted-in draft recovery data.
- Session storage may support temporary login or Google redirect flow state.
AI-Assisted Processing
AI assists with drafting, recommendations, analysis, and reporting workflows where enabled. AI output is not the final clinical authority.
- Clinicians review, edit, and approve AI-assisted content before it is saved or shared through caregiver-facing workflows.
- QARELOG does not present AI as an autonomous diagnostic authority or automatic report publisher.
- AI-assisted workflows should be used with professional review and organization-approved data practices.
Caregiver Sharing
Caregiver-visible information is controlled through explicit product workflows and should be appropriate for caregiver review.
- Caregivers should receive reviewed reports, approved caregiver-facing summaries, home-support details, or related information only when access is permitted.
- Internal therapist notes, draft AI content, and clinician-only context are not presented as ordinary caregiver-facing material.
- Report email disclosure is limited to eligible caregiver recipients linked to the client.
Data Security
QARELOG uses role-aware access, authentication sessions, recent verification for sensitive actions, audit logging, and controlled sharing paths to reduce inappropriate access.
- Sensitive administrative mutations require server-side authorization and recent two-factor verification.
- Clinical report access is checked server-side by role, assignment, and client relationship.
- Audit logs are intended to track important operational and security events without storing clinical narrative unnecessarily.
Data Retention / Deletion Requests
Retention periods may depend on the organization using QARELOG, the type of information involved, applicable requirements, and the purpose for which the information is maintained. Requests for access, correction, export, or deletion should be directed through the organization responsible for the account or an approved QARELOG support channel.
Service Providers
QARELOG relies on third-party infrastructure and service providers to operate parts of the service, including authentication and data services, hosting, email delivery, and AI-assisted functionality where enabled. Current implementation references include Firebase services, Google AI-assisted functionality where enabled, and Vercel hosting. Information shared with providers is limited to what is needed for the relevant service and remains subject to applicable provider and QARELOG arrangements.
Children / Client Data
Client and child-related information can include therapy history, assessments, goals, sessions, reports, progress details, caregiver relationships, and supporting documentation. Access should remain limited to authorized roles and assigned relationships.
Changes to Policy
We may update this policy as QARELOG features, service providers, legal requirements, or operating practices change. Material updates should be reflected on this page.