Privacy policy

Your child's records stay yours.

Spectrum is built so that we can't read your family's medical records — not as a promise, as a property of how it works. This page says exactly what the app does with data, in plain language. Last updated 17 September 2026.

The short version

• Everything you record lives in an encrypted database on your own phone. There is no account and no copy on our servers by default.
• Data leaves your phone only when you choose to sync or share it, and it is encrypted on your phone first with a passphrase we never see. Our server stores ciphertext it cannot open.
• The one optional feature that sends record text to a third party — turning a journal note into suggested entries — is labelled, happens only when you tap it, and is described below.
• No analytics, no advertising, no tracking SDKs, no selling or sharing data with anyone.

What Spectrum stores, and where

On your phone: your child's profile, conditions, timeline events, symptom logs, notes (typed, voice, photo, video), interventions, providers, appointments, and visit questions. The database is encrypted at rest (SQLCipher, AES-256) with a key held in the phone's hardware security module (Secure Enclave on iPhone, Android Keystore / StrongBox on Android). Photos, videos and voice notes are encrypted individually with a key derived from the same root. Deleting the app deletes all of it.

On our server (only if you use sync or sharing): an opaque random identifier and encrypted blobs. The server also sees what any web server sees — your IP address, the time of the request, and the size of what you sent. It does not see, and cannot derive, any of the content.

Sync between your devices

If you turn on sync, your phone encrypts the whole record with a passphrase you choose (PBKDF2-derived keys, AES-256, authenticated) and uploads the result to a "mailbox slot" identified by a random id. The passphrase is never sent to us. Another device — a second phone, or the web companion at /app — downloads the blob and decrypts it locally with the same passphrase. Writes to a slot are authorised by a token derived from your passphrase on your device; the server keeps only a hash of it. If you lose the passphrase, nobody, including us, can recover the record from the server.

Sharing with a provider or caregiver

A share link contains a record you selected, encrypted on your phone with a passphrase you give the recipient separately. The server hosts the encrypted bundle for the time you choose (1, 7 or 30 days) and then deletes it. The recipient decrypts it in their browser. You can also export a PDF or FHIR file and send it however you like; that never touches our server at all.

Voice notes and the optional AI pass

Transcription. On iPhone, voice notes are transcribed on the device using Apple's on-device speech recognition; the audio is not sent anywhere. If on-device transcription isn't available, the app can send the audio to a backend you run yourself (with Whisper installed). Our hosted server does not transcribe audio and will refuse the request.

Suggested entries. When you tap "Suggest entries" on a note, the text of that note and the names of your child's conditions are sent to our server, which forwards them to Anthropic's Claude API to propose structured entries for you to accept or reject. This is the only feature that sends record content to a third party. It never runs in the background. We do not store the text; Anthropic's API handling of it is governed by their commercial terms. If you would rather this never happens, simply don't tap the button.

What we don't do

• No analytics or crash-reporting SDKs in the app.
• No advertising, no data brokers, no "partners".
• No accounts, so no email addresses, passwords, or profiles about you.
• No reading of your records, because we hold no keys.

Permissions the app asks for

Camera and microphone, only at the moment you record a photo, video, or voice note. Speech recognition (iPhone), only when you transcribe a voice note. Each is asked in context and can be revoked in your phone's settings.

Children

Spectrum is used by parents and caregivers on their own behalf to manage a child's care. It is not directed at children and has no child-facing features.

Health data laws

Spectrum is a consumer app, not a healthcare provider, so HIPAA generally does not apply to it; we design as if it did. Where the FTC Health Breach Notification Rule or state health-privacy laws apply, we follow them. Because we hold only ciphertext, a breach of our server would expose no readable health information.

Your choices and your data

Export everything at any time from the app (PDF or FHIR). Delete everything by deleting the app. Delete a synced slot by contacting us with its id — we can delete the blob but, by design, cannot read it. Questions: hello@assistive.io.

Changes

If we change what the app does with data, this page changes first, with a new date at the top. The engineering-level version of this posture lives in the project's public repository.