KeepBP is a personal blood pressure tracker with optional health-system connect. We do not sell PHI and we do not train models on identifiable readings.
This page describes current practice. Items marked Planned are on the roadmap and are not claimed as live.
What we store
- Account: email and/or username, password hash (bcrypt)
- Readings: systolic, diastolic, optional pulse, timestamps
- Session: signed HTTP-only cookie (
bp.sid) - Optional Epic tokens: when you connect MyChart, access tokens live in the server session until you disconnect
- Optional analytics: GA4 page views / product events with no BP values, emails, or passwords
- Live Per-user audit log (login, logout, FHIR connect/fetch, import, PDF export, account export/delete). No blood pressure values stored in audit rows.
What we do not store
- MyChart / portal passwords
- Your full EHR chart
- Payment card data (we do not take payments today)
Authentication
Live Email + password, bcrypt hashing, rate limits on signup/login, signup honeypot, and Cloudflare Turnstile on signup.
Planned Email verification, breach-password checks, passkeys (WebAuthn), optional TOTP MFA, stronger lockout policy.
Sessions & tokens
- Production cookies use
Secure+SameSite=Lax+HttpOnly - SMART tokens are server-side only; not readable from page JavaScript
- Planned Session rotation on login
Transport & at rest
- Live HTTPS for production traffic
- Data lives in SQLite on a Render persistent disk. KeepBP does not yet apply application-level field encryption at rest beyond provider disk protections — we say so plainly.
- Planned Stronger at-rest story (e.g. Postgres + provider encryption) as we scale
Access control
- Each account only sees its own readings
- Operator admin roster (
/admin) shows email, username, and created date only — no passwords or readings — locked by a server secret - Doctor PDFs are generated for the signed-in user to download or share; there are no public PHI report URLs today
Abuse controls
Live Rate limits on signup, login, import preview, and PDF generation; disposable-email checks; honeypot field.
Your rights
- You can log out anytime
- Live Self-serve data export (JSON) and account hard-delete from Your account (requires password + typing DELETE)
- Or email whirrett@pm.me for help
Compliance posture
KeepBP is built as a personal tracking app. We do not claim HIPAA certification or SOC 2 today. If a clinic partner needs a BAA or formal audit, we will discuss that explicitly — we will not pretend those badges exist.
See also Privacy, Terms, and Not medical advice.
Report a vulnerability
Email whirrett@pm.me. We aim to acknowledge security reports within 72 hours.