The app
Security and safeguards.
This page describes safeguards built into the Dorian Recovery app. What this website itself does with a visitor is on the website privacy notice.
Organization scoping
Each organization’s records are kept separate. The app scopes data to that organization so one organization’s records are not mixed into another’s.
Staff roles
People who use the app have a role: owner, admin, house manager, case manager, or staff. What someone can see or change depends on that role. House managers and staff are limited to the houses they are assigned to. Residents use a separate portal and do not get the staff record.
Consent
A disclosure in the product is tied to a consent record for that resident. A consent on file does not make every disclosure appropriate.
When staff share information with a court or a probation officer, that share is limited to what that resident’s consent covers. The consent has to be signed, already in effect, and name that recipient. It can expire or be revoked. The app blocks the disclosure when the consent is missing, unsigned, not yet in effect, expired, revoked, or written for a different recipient.
42 CFR Part 2 adds further limits. The notice that goes out with a Part 2 disclosure says those records are not to be used in a civil, criminal, administrative, or legislative proceeding against the person, unless that person’s consent allows it or a court order under Part 2 allows it.
Follow-up after discharge stays held unless there is a signed follow-up consent that is still in effect. With that consent, a due checkpoint is handed to the configured notification provider. The local default is the outbox, which does not send live email or SMS. An alumni portal check-in saves the answers. A request for staff contact creates a task and does not send email or SMS.
Encrypted uploads
Files an organization uploads are encrypted with AES-256-GCM before they are stored. This website does not hold those files.
Audit log
Views of a resident chart, changes, exports, disclosures, and sign-ins are written to an audit log. Those entries are append-only and hash-chained, so a later edit or a gap can be detected.
A second factor
Staff and residents can turn on an authenticator app (a time-based code, with recovery codes). An organization can require that second factor for staff. It is optional unless that organization requires it.
Hosting
This public marketing website (dorianrecovery.com) is hosted as a static site on Cloudflare Pages, with website inquiries delivered via Cloudflare Email Routing to [email protected]. These marketing pages do not run the Dorian Recovery application and do not collect or store resident health records.
An Amazon Web Services business associate agreement (BAA) was accepted on Daniel’s AWS account on October 1, 2026. That agreement covers the Dorian Recovery application environment on that AWS account rather than this public marketing website on Cloudflare Pages. This marketing website is not a HIPAA-covered service and does not hold resident records. The safeguards above describe the Dorian Recovery app, which is separate from this website.
This website
These pages do not ask you to create an account. The walkthrough video is on the demo page. The inquiry page emails a short note to Daniel. It is not meant for health information. How the pages handle a visit is in the website privacy notice.