Legal + privacy
Family coordination. Not an EHR.
CareOS BY MERIDIAN BCG · Effective 2026-10-05
DRAFT — pending counsel review. Not counsel-approved. Not legal advice. Does not claim HIPAA compliance. Not a substitute for your signed engagement contract.
Coordination, not clinical care
CareOS holds the work around care: open loops, owners, timing, and follow-up.
Not an EHR
Clinical records stay in clinical systems. CareOS does not replace them.
No clinic patient PHI
Do not place diagnoses, medications, lab results, or clinic paperwork in CareOS.
A person remains accountable
Software remembers. The Operator reviews, assigns, and follows up.
Overseer role
The Overseer is the household decision-maker (up to two Overseers per account). The Overseer applies, books, signs the engagement, and remains accountable for household care-logistics choices. The Overseer is not a clinician and does not replace licensed care.
Household legal instruments
After Meridian Business & Civic Group accepts the household, the Operator sends the household intake link for medical power of attorney, Living Will, and other health details (Google Form under Workspace BAA) — not Notion, not email, and not as PHI fields in CareOS. Intake form link coming soon — the Operator will send it to you directly. The September 20, 2026 “Overseer portal only” upload lock is superseded for public legal pages. Legal instrument files stay on the Operator-sent household intake form / Google Workspace under Meridian Business & Civic Group's signed BAA with Google — not in CareOS Notion application payloads, not email, and not Slack.
Google Workspace BAA
Meridian Business & Civic Group has a signed Business Associate Agreement (BAA) with Google for Google Workspace. Household medical intake and related health documents are handled under that Workspace BAA. This does not claim that CareOS or Meridian Business & Civic Group is HIPAA compliant.
Release of information (ROI)
Release-of-information (ROI) packets are coordinated through providers@lifeos.meridianbcg.com and scoped to a Provider–Patient link when one exists. Do not use a roi@ address. Clinical records stay with the provider; CareOS coordinates request logistics only.
Zoho Sign e-sign records
Engagements and related acknowledgments are e-signed with Zoho Sign. Signed Zoho Sign records are retained as engagement business records. Square is not used for engagement e-sign.
Slack
Slack is required: one private workspace per household, passed through at Slack's invoiced rates (Pro by default; Business+ only if needed). The household pays the Operator's seat and each Overseer/Helper seat; Emergency Contacts are free; Providers are not on Slack. Billed per active member. No health information on Slack. A signed no-PHI-on-Slack acknowledgment is required before any Slack invite.
Notion: Source of Truth & Data Policy
Notion is the system of record for non-health care logistics — open loops, owners, timing, follow-up, and household coordination on the Open Loops board.
Health information stays in Google Workspace under Meridian Business & Civic Group's signed BAA with Google. Health information is never synced to Notion or Slack.
What syncs to Notion: care-logistics board content (tasks, owners, status, non-clinical notes the household and Operator place on the board). What does not sync: diagnoses, medications, labs, clinic paperwork, medical power of attorney files, Living Will files, or other health documents.
The client owns their household logistics data in Notion. At offboarding, Meridian Business & Civic Group will provide an export of the household's Notion board content upon written request.
Retention: Meridian Business & Civic Group retains Notion logistics records for the engagement term and a reasonable post-engagement period needed for billing, dispute resolution, and ordinary business records, then deletes or archives per Meridian Business & Civic Group retention practice — unless law requires longer retention. See /terms and /privacy.
Legal hub: /legal. Terms: /terms. Cancellation: /cancellation.
Email & encryption: CareOS stakeholders are either Google Workspace guests or seated users on the household domain. Seated users follow a naming convention and a forward-to policy. Stakeholders sit in a security group (access) and a mailing group (collective updates without showing other recipients). Some aliases use restricted encryption policies. Mail is protected in transit to Google; when messages are forwarded to a personal inbox (including Yahoo), end-to-end options such as S/MIME may not be available. See the Privacy Policy and your Workspace onboard checklist.