1. Purpose and permitted use
This draft covers the Golden Days website and portals used by customers, authorized representatives, facility users, employees and administrators. Use them for legitimate Golden Days service, support and work activities within your assigned permissions.
Staff and facility users should access a record only when it is needed for their authorized role or an assigned task. Technical access alone does not make personal curiosity or an unrelated lookup appropriate.
2. Protect your account
- Use your own account. Do not share passwords, sign-in sessions, authenticator codes or recovery codes.
- Complete required multifactor authentication and keep recovery information secure.
- Lock shared devices when unattended and sign out when finished. Do not leave a customer's information visible to someone who is not authorized to see it.
- Report a lost device, suspicious login or unexpected account change promptly to the office.
Ask an administrator for the access you need. Do not use another person's credentials to work around a missing permission.
3. Handle information carefully
View, enter and share only information needed for the authorized task. Verify the customer, trip and recipient before saving, sending or uploading. Correct an error through the approved workflow or contact the office; do not conceal an error or alter records to misrepresent what happened.
Use approved Golden Days tools for work information. Staff and facility users must not move customer or employee information into personal email, public file-sharing services or unapproved AI tools. Customers may request their records and use them as permitted by applicable law.
Do not put medical details in public inquiry forms, troubleshooting descriptions or screenshots intended for general support. Tell the office where the issue occurred without copying sensitive record contents.
4. Upload documents to the right record
Upload a document only if you are authorized to provide it and your account has access to that upload feature. Follow the file-type and size limits shown on screen. Use the correct customer's trip and a clear description that avoids unnecessary sensitive information.
Do not upload malicious files, unrelated documents, another customer's records or content you do not have permission to share. If you attach a file to the wrong trip, report it promptly so the office can review the record and access.
An account linked to a customer or facility does not automatically receive every document permission. Uploading a document does not guarantee an immediate response or replace direct communication about an urgent need.
5. Uses that are not permitted
- Accessing records without a service or work-related reason, or using someone else's account.
- Attempting to bypass permissions, authentication, audit controls or maintenance restrictions.
- Bulk copying or exporting information outside your approved task, or sharing it with unauthorized people.
- Submitting false records, fraudulent requests, spam, threats or harassment.
- Uploading malware, disrupting the service or testing security controls without explicit authorization.
Good-faith reports of a security concern are welcome. Report what you observed without continuing to access another person's information or testing further without authorization.
6. Support access and activity records
Golden Days uses access controls and activity records to support troubleshooting, security and accountability. Records can include account identifiers, actions, affected records and times. Handle audit information as confidential work information.
When development mode is enabled, eligible staff may use the approved impersonation feature for a specific support or testing task. Admins may make permitted business changes; managers need separate, time-limited Super Admin approval for write access. Nobody may impersonate a Super Admin.
Staff must use a clear task reason, follow the access shown in the banner and return to their own account when finished. Changes made while impersonating another account are real changes and are attributed to the staff member. Use your own account for credential or permission changes.
7. Development, testing and maintenance
A development-mode banner identifies an operational mode; it does not authorize everyone to test or make a live record disposable. Use an approved test area and synthetic data for tests unless a specific, authorized support task requires a real record.
During maintenance, follow the posted warning and refrain from adding or changing appointments or other data. Do not attempt to bypass a blocked form. For time-sensitive service needs, call the office. After maintenance, check the saved status before retrying a request to avoid duplicates.
8. Report problems and request help
Call (410) 679-0942 to report suspicious access, a misdirected message, an incorrect upload or a problem with your permissions. You may use the public contact form for a general request without medical details, passwords or authenticator codes.
Golden Days may review an issue and restrict portal access when necessary to protect the service or information. Contact the office for assistance, correction or an available alternative. Portal access decisions do not by themselves cancel a service agreement or remove applicable rights to records or privacy complaints.
For a medical emergency, call 911.
9. Related documents and review status
Read this policy with the Terms & Conditions and the Privacy Notice page. It does not replace service agreements, health-information authorizations, employee policies or facility agreements.
This is version 2026-09-15-draft-1, prepared for review. It has no effective date, and opening it does not record acceptance. Final wording and any staff or customer acknowledgment process should be approved before adoption.