Privacy & Compliance

Understanding how GenogramCraft protects your clinical data and maintains HIPAA compliance.

To keep waiting rooms calm while clients complete digital intake, we lean on SoundScape for privacy-friendly ambient audio playlists that never capture personal data.

Privacy-First Architecture

GenogramCraft is designed with privacy at its core. All genogram data is stored exclusively in your browser using IndexedDB. We never transmit, store, or have access to your clinical information on our servers. This approach ensures HIPAA compliance and gives you complete control over sensitive client data.

HIPAA Compliance Approach

Client-Side Data Storage

GenogramCraft uses IndexedDB technology to store all genogram data directly in your web browser. This means:

  • No Protected Health Information (PHI) is transmitted to our servers
  • Data remains on your local device at all times
  • You maintain complete control and ownership of all clinical information
  • No Business Associate Agreement (BAA) is required because we never access PHI

Technical Safeguards

  • Encryption at Rest: Optional client-side encryption using AES-256
  • Secure Connections: All web traffic uses HTTPS/TLS encryption
  • Access Controls: Data is isolated to your browser session
  • No Cloud Backup: Data is not synced or backed up to cloud services

Professional Responsibilities

While GenogramCraft provides a HIPAA-compliant architecture, healthcare professionals remain responsible for:

  • Securing the devices on which genograms are created
  • Following organizational policies for data handling
  • Using de-identification features when sharing genograms
  • Ensuring exported files are stored securely

Client-Side Data Storage Implementation

What Data is Stored Locally?

  • Genogram structure (family members, relationships, symbols)
  • Person details (names, dates, clinical notes)
  • Your application preferences and settings
  • Recent genogram history for quick access

How Long is Data Retained?

Data persists in your browser until you explicitly delete it. You control retention through:

  • Manual deletion of individual genograms
  • Clearing all application data through settings
  • Browser cache clearing (will remove all genograms)

Data Portability

You can export your data at any time:

  • Export individual genograms as PDF, PNG, or SVG
  • Download genogram data as JSON for backup
  • No lock-in or proprietary format restrictions

De-identification Best Practices

GenogramCraft provides multiple de-identification features to help you share genograms safely for educational, supervisory, or presentation purposes.

Export Privacy Modes

Full Mode

Includes all information including names, dates, and clinical notes. Use only for secure clinical records.

De-identified Mode

Removes all names and identifying information. Shows symbols and relationships only. Ideal for case consultations.

Presentation Mode

Clean, professional output with optional anonymous numbering (P1, P2, P3). Perfect for teaching and presentations.

Export Reminder

Important: Before sharing or presenting any genogram, verify that all Protected Health Information (PHI) has been removed. GenogramCraft displays a reminder before each export, but you are ultimately responsible for ensuring compliance with HIPAA and your organization's policies.

Security Features & Encryption

Optional Client-Side Encryption

For additional security, enable client-side encryption of your genogram data:

  • Uses AES-256 encryption standard
  • Encryption key derived from your passphrase
  • Passphrase never leaves your browser
  • Encrypted data is unreadable without your passphrase

Important: If you forget your encryption passphrase, your data cannot be recovered. Keep your passphrase secure and backed up separately.

Secure Connections

All communication with GenogramCraft uses industry-standard security:

  • HTTPS/TLS 1.3 encryption for all web traffic
  • Secure WebSocket connections where applicable
  • No third-party tracking or analytics scripts

Data Export and Deletion Procedures

Exporting Your Data

  1. Navigate to Settings → Export Data
  2. Choose export format (JSON for complete backup)
  3. Save the exported file to secure storage
  4. Verify the export completed successfully

Deleting Your Data

To permanently delete all genogram data from your browser:

  1. Navigate to Settings → Clear All Data
  2. Confirm you want to delete (this action cannot be undone)
  3. All genograms and settings will be permanently removed

Note: Clearing your browser cache or site data will also delete all stored genograms.

Professional Ethics Guidelines

Informed Consent

Obtain informed consent from clients before creating a genogram:

  • Explain the purpose of the genogram in treatment
  • Describe how the information will be used and stored
  • Clarify who will have access to the genogram
  • Inform clients of their right to decline or limit information shared

Documentation Standards

Follow your profession's documentation requirements:

  • Include genograms as part of the clinical record
  • Document the date of creation and updates
  • Note the source of information (client report, records, etc.)
  • Maintain genograms according to record retention policies

Terms of Service for Clinical Use

Professional Use Only

GenogramCraft is designed for use by licensed healthcare professionals, students in supervised clinical training, and researchers. By using this tool, you acknowledge:

  • You are responsible for compliance with applicable laws and regulations
  • You will use appropriate clinical judgment in all cases
  • GenogramCraft does not provide medical advice or treatment recommendations
  • You maintain professional liability insurance as required

Disclaimer

GenogramCraft is provided "as-is" as a tool to assist in clinical assessment. It does not replace professional judgment, clinical training, or adherence to evidence-based practice standards. Users are solely responsible for all clinical decisions and documentation.

Questions About Privacy?

For questions about our privacy practices, security features, or HIPAA compliance approach, please refer to our documentation or consult with your organization's compliance officer.