Security and privacy
Children's records deserve the strictest handling.
HubiCare is built so that each organization sees only its own data, the people inside it see only what their role needs, and every sensitive view is written down.
How it works
Six things we can state plainly
Tenant isolation
Every table in the database enforces row-level security per organization, with tests that check each role against its own organization and another one.
Encryption
Everything travels over TLS with HSTS preloaded. Custody and court-order notes, medical conditions and immunization exemptions are also encrypted field by field in the database.
Two-step sign-in
Owners, directors and billing staff must use a second step (an authenticator app) to sign in. Sessions end after a period of inactivity.
Audit log
Every change, and every view of a child's record, is written to an append-only log that no role can edit or delete, with a tamper-evident chain.
Data stays per organization
The only link that opens without signing in is the licensing-inspector packet: one site, one date range, at most 7 days, can be cancelled, and every opening is logged. Families can ask for an export of their own data. No ads and no third-party analytics in the app.
Support access you can see
HubiCare's own staff see an organization's data only during a support session the owner can see and revoke, with a reason and a time limit, and it is logged.
Who sees what
Who can see a child's records
- Each center sees only its own records. Other centers cannot see them.
- Families see only their own children.
- Staff see only what their job needs.
- No one at HubiCare can look at a child's records unless the center's owner says yes. HubiCare can only ask, and must give a reason.
- The owner picks how long: 15 minutes up to 4 hours. The owner can stop it at any time.
- Every request and every visit is written in a log.
- Even with a yes, our support team cannot see health or custody details. They can only see if a child has an allergy or a custody note: yes or no.
No tracking
No tracking, no ads, no selling data
- We do not sell personal information. We do not use it for ads.
- We do not use advertising cookies. We do not follow people across other websites.
- Our cookies are only for sign-in, safety, your language and the door tablet.
From your browser, data goes only to our own site and our database host. The services we use to send email and texts are listed on our subprocessors page. Subprocessors page
Keeping records
How long we keep records
These rules are for Minnesota programs. The 6 years follows Minnesota child care assistance (CCAP) record rules.
| Record | How long |
|---|---|
| Attendance records | At least 6 years after the day of service |
| Child records, including health and consents | While the child is enrolled, then at least 6 years after the last day |
| Audit log (who changed what) | At least 7 years |
| Visitor sign-ins at the door tablet | At least 6 years |
| Visitor photos taken at the door tablet | 90 days, unless the site's director chooses 1 to 365 days |
| Copies of messages we sent (email, text, push) | 30 days |
| Phone check-in location | Never saved |
| Roster and family download files | Never stored by HubiCare |
| The owner's full data download | 7 days, then deleted |
Your data is yours
Take your data with you
- The center's owner can download all of the center's data at any time, at no cost.
- It comes as a ZIP file with plain-English notes about each file.
- To do this, the owner must be signed in with two-step sign-in and type a fresh code. Nobody else can, not even HubiCare support.
- The download file is deleted after 7 days.
- A director can also download one family's data, after checking who is asking. Court-order (custody) notes are left out; the director reviews them first.
Minnesota first
Minnesota rules built in; each site follows its own
HubiCare was built around Minnesota licensing (Rule 3, Rule 2, chapter 142H and CCAP). Rules are packaged per state and license type, so a site follows the rules for where and how it is licensed, and programs outside Minnesota use HubiCare without them.
AI
AI that never sees what it should not
AI features are off until HubiCare records its data-processing agreement with the model provider and your owner turns them on. Names are replaced with tokens before anything is sent, sensitive fields are never read, and only counts are logged, never content.
Privacy policy and terms
Our privacy policy, terms of service and data-processing terms are being finalized and will be published here.
What we do not claim yet
HubiCare does not claim certifications it has not completed. Ask us about our current controls when you request a quote.
We do not claim a certification, an outside security test or an uptime number. We will only say these when they are true.
See HubiCare for your program
Tell us about your program and we will reply with a quote and a time for a short walkthrough. Pricing depends on your program's size.
No self-service signup: every program is set up with a person from HubiCare.