PUBLIC PREVIEW
Trust Center
A plain-language record of how everyday protects information today, what has been reviewed, and what remains before clinic use.
Current safeguards
- Anonymous patient program codes; no patient account required
- No advertising, analytics pixels, fingerprinting, or cross-site tracking
- Secure, HTTP-only sign-in cookies with short session lifetime
- Account export, per-program deletion, full account deletion, and optional retention
- Owner-only access and an account activity history
- Permission confirmation for uploaded exercise media
Service-provider register
| Provider | Purpose | Information involved | Clinic status |
|---|---|---|---|
| Therapist sign-in | Name, email, account identifier | Must be reviewed for paid clinic terms | |
| OpenAI Sites | Application hosting and deployment | Application requests and stored workspace data | No HIPAA or BAA representation is made |
| Cloudflare | Infrastructure, database, and media storage | Application requests, workspace records, uploaded media | Contract and BAA review required before ePHI |
This register describes the current setup. It is not a representation that any provider has signed a business associate agreement for everyday.
Incident-response plan
- Contain the issue and preserve relevant technical records.
- Identify affected systems, accounts, information, and dates.
- Reset or revoke exposed access and correct the underlying cause.
- Assess notification duties with qualified privacy and legal counsel.
- Notify affected parties and regulators when required, then document the decision.
- Review the incident and update safeguards before closing it.
A monitored security-reporting address, named response owner, notification templates, and tested response exercise are required before commercial launch.
Accessibility review
Clinic-launch gate
everyday must not receive protected health information or be sold as HIPAA compliant until qualified counsel and security reviewers approve the data flow, contracts, access controls, vendor agreements, incident procedures, and accessibility results. Multi-user clinic seats remain disabled during this preview.
Last updated September 7, 2026.