Security

• Traffic to MeloCare is served over HTTPS.
• Patient-entered health information — condition, medications, supplements, notes, conversations — is held in the browser on the patient’s own device. It is not written to a MeloCare database. When a patient asks MeloCare a question, or photographs a visit summary or a medication label, that question and their saved care profile pass through our servers to our AI provider so an answer can be produced.
• Care profiles stay on the device they were typed into.
• The only things MeloCare stores on a server are the church profile an administrator supplies — church name and scripture translation — and the subscription billing record. Neither contains patient information.
• Church profiles can no longer be created or edited by the public. Changes are made by MeloCare until sign-in for church administrators ships.
• Backup files are encrypted in the patient’s browser with a passphrase only they hold, and never pass through MeloCare.

These are commitments, not descriptions of shipped controls. None of them should be relied on in procurement today.

• Accounts and sign-in for church administrators, with sessions and access removal.
• Per-church isolation enforced by an authenticated account model.
• Audit logging of administrative access to production data.
• A written retention and deletion policy, a breach-notification procedure, workforce training records, and a named privacy contact.
• Written data-processing agreements with every vendor underneath us that could touch health information, including the AI provider.

Until that list is finished, MeloCare is not sold as a HIPAA-ready service and no church should present it to families as one on the strength of this page.

MeloCare is instructed never to give a dose, never to call a combination safe or unsafe, and never to tell anyone to change treatment. MeloCare does not review a person’s specific combination of medications and supplements at all. Questions about interactions produce a printable list of what the person takes and the instruction to have a pharmacist review it.

A filter that checks every answer before a patient sees it is being built. Until it ships, these limits are instructions to the model, not an enforced control.

If you find a vulnerability or see an answer that crosses a line, tell us through the waitlist form and we will respond. We would rather hear it early.