Spreadsheets, care records and route events must not silently contradict each other. Assign ownership and limit access, exports and corrections to their purpose.
Show the planning constraint, not the record
A planner may need to know that two workers, an accessible vehicle or a fixed visit is required. The underlying diagnosis is usually unnecessary. Have care professionals translate sensitive content into a limited, explained planning constraint and keep the full record in its designated system.
Design access around responsibilities
Create roles for intake, planner, team lead, worker and administrator, limiting data to area and task. Test exceptions such as temporary collaboration or replacement. Review access periodically and automatically remove rights when a role or collaboration ends.
Secure the full data lifecycle
Screens are only one access point. Limit exports, notifications, support access, backups and logging, and avoid sensitive content in URLs or free-form errors. Set retention and deletion by purpose and document who may inspect audits. Align this with your privacy officer and legal obligations.
