Parental consent that's actually verifiable.
Versioned signatures. Hashed payloads. Append-only audit. Row-level security on every table. This isn't a checkbox — it's the foundation of the product.
Six pillars, one promise
A defensible record of what was agreed to, when, and by whom — for every family.
Versioned consent
Every signature pins to a consent_version. When terms change, prior signatures keep their history intact while new ones reflect the current version.
SHA-256 payload hash
Each consent stores a SHA-256 hash of {version, canonical terms, selected toggles} so what was signed is cryptographically reproducible.
Append-only audit
Every insert and update on consent is mirrored to parental_consent_history. The audit log is immutable by design.
Live gating
When a parent flips a permission, server functions re-check the database on the next request. No stale caches.
Row-level security
Row-level security on every public table. Roles live in a dedicated user_roles table to prevent privilege escalation.
Role-based access
Parent, Tech, therapist, admin, and developer roles each see only what they're permitted to see.
How a signature flows
Parent signs
Typed signature, attestation of guardianship, and granular permission toggles.
We hash it
{version, canonical terms, toggles} are SHA-256 hashed and stored alongside the signed row.
History captures it
The signed snapshot is mirrored to the append-only history table.
Gating applies live
Server functions and the UI re-check consent on every request — flips take effect instantly.
Parents stay in control — always.
Parents can update consent and individual permission toggles at any time. Toggling a permission off blocks the very next request that requires it — there is no waiting period and no cache to expire.
- Voice recordings — toggleable any time
- Echoic clip sharing — toggleable any time
- Progress tracking — toggleable any time
- Therapist sharing — toggleable any time
- AI features — toggleable any time
Read the full posture
HIPAA-aligned design, privacy practices, and the formal disclaimers.