> ## Documentation Index
> Fetch the complete documentation index at: https://docs.imaracare.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and privacy

> How ImaraCare protects resident data — encryption, roles, audit logs, and sessions.

ImaraCare is built for healthcare-adjacent data in group home settings.

## Encryption

* Data in transit uses TLS (HTTPS)
* Data at rest is encrypted in the cloud database and file storage

## Role-based access

* Every user has a role **per facility** (Staff, Manager, or Administrator)
* The database enforces that you only see rows for your active facility
* See [Roles and permissions](/getting-started/roles-and-permissions)

## Audit logging

Sensitive actions write to **activity logs** (Administrator access). Medication corrections and incident updates retain history rather than silent deletes.

## Sessions

* **45-minute inactivity timeout** signs you out automatically (HIPAA requirement for clinical systems)
* Administrators can terminate active sessions for a user at their facility
* Review your devices under **Profile settings → Security**

## Multi-factor authentication

**Manager** and **Administrator** roles must verify their identity with a one-time email code each workday. After signing in with email and password, ImaraCare sends a 6-digit code to your registered email address. Enter the code to proceed — no authenticator app or QR code is required.

* Codes expire after **10 minutes**
* Verification lapses after **8 hours** — you will be asked again on the next workday
* If a code does not arrive, use the **Resend code** option on the verification screen

## Your responsibilities

* Use strong unique passwords
* Do not share accounts
* Lock workstations in shared areas
* Report suspected unauthorized access to your Administrator and support immediately

## Legal documents

* [Privacy policy](https://imaracare.com/privacy-policy)
* [Terms of service](https://imaracare.com/terms-of-service)
* [DPA](https://imaracare.com/dpa) — Data Processing Agreement