Worth reading in full before handing over financial records, resident data or brand accounts. Every line below is written to be something one person can actually guarantee, which is why the last section names what I do not have.
The first question is not what a system does with your data. It is how much of your data it can see at all.
Each system gets the narrowest permissions that let it do its one job. Read-only wherever read-only is sufficient, and revoked on delivery.
Everywhere a system I build touches your data. Where a tool you already run does the storing, it keeps its own encryption and I do not move the data out of it.
Not a model of mine, not a model of anyone else’s. It does the job in front of it. Where a third-party service is involved, its training setting is turned off and named in the agreement.
The fix connects what you have. It does not relocate your records into something new that only I understand.
An automation that can act alone is a liability wearing a productivity costume. Every system I build stops and asks.
No system moves money, sends a client message or publishes to your brand without a person approving that specific action first.
Every system that can incur a cost refuses the request before it spends, not after. The ceiling is a number you set.
What the system did, when, on what input, and who approved it. Readable by you without asking me, and exportable.
Deleted on request, and automatically at the end of the engagement unless you ask otherwise. Nothing is kept as a portfolio copy.
01
Every engagement includes a written data-handling section naming the systems in scope, what may be processed, and by which tools. A page on a website is marketing; the agreement is the thing you can hold me to.
02
For senior living work, we agree in writing what may be processed and by which systems before any build begins. A business associate agreement is available on request. Nothing I build makes a clinical determination — it moves information to the people who do.
03
No SOC 2 report, no ISO certificate, no HIPAA "certification" — which does not exist as a thing to hold. A one-person practice that claimed those would be lying, and you should ask any consultant who claims them to send you the report. What you get instead is a named person, a written agreement, and access you can revoke in a click.
If your insurer, your IT provider or your owner group needs a specific commitment written differently, say so before the audit rather than after. It is a conversation, not a negotiation.
Fifteen minutes. Bring the ones your IT person or your owner group would ask — those are the useful part of the call, not an obstacle to it.
Justin.Moodie@kingsideconsulting.comPrefer to just pick a slot? Book directly on the calendar.