What each product is.

Any assistant that speaks the Model Context Protocol can connect. A family key reads that household’s inbox. A Soft key reads that agency’s roster. Mixing them returns HTTP 403 WRONG_SURFACE. GET on either MCP URL is liveness/descriptor; POST is the JSON-RPC transport.

{
  "mcpServers": {
    "lovedone-family": {
      "url": "https://api.lovedone.app/mcp/v1",
      "headers": { "Authorization": "Bearer sk-sand-…" }
    }
  }
}

What it is

Every email about Helen — discharge summaries, pharmacy refills, cardiology reminders, insurance EOBs, attorney correspondence — lands in one place. Every sibling sees it. Nobody is out of the loop because they weren't the one holding Mom's phone.

Each loved one gets a private, dedicated email address:

helen-smith-AB12@lovedone.app

Give that address to Helen's doctor, pharmacy, insurance company, attorney — anyone who sends emails about her care. The whole family sees what arrives, in real time.

How it works

Address format

The address format is locked: {first_name}-{last_name}-{4 alphanumeric}@lovedone.app. The 4-character code uses letters (A-Z, no I/O) and digits (2-9) — a mental model every American adult already has — so it's easy to dictate at a hospital intake desk: “helen, dash, smith, dash, A-B-1-2.”

Senior opt-in

Two flows so the senior can participate however makes sense for their situation:

• Option A — Add as second email. Helen gives providers this address alongside her personal email. They CC both. She keeps reading her own inbox; the family sees a copy. Best for cognitively healthy seniors who want family in the loop without changing anything.
• Option B — Primary with forwarding. Helen tells providers to send everything here. Sandwich auto-forwards each message to her personal Gmail too, so her experience doesn't change — but the family also sees what arrives. The forwarding is invisible to the senior and transparent to the family.

FAQ

Will providers actually accept this?
Yes — because you're asking them to do something they already do. Every EHR scheduling system, pharmacy management system, and patient intake form already has an “alternate contact email” field. You're just filling it with a better value. No new workflow, no new system.

What about HIPAA?
HIPAA's personal-representative doctrine (45 CFR §164.502(g)) gives a designated family member the right to specify a confidential-communications address that providers must use. You're not asking providers for cooperation — you're asking them to honor a right the patient already has. See HHS guidance.

Does the senior have to give up their existing email?
No. Providers can keep sending to Helen's personal email too.

Can I change the inbox address?
Addresses are generated once and preserved indefinitely — providers may have it in their systems for years. If you need a new address (e.g., a compromised address), you can rotate it from settings. The old address forwards for 90 days, then stops. Old messages are always preserved.

Can other family members see the same inbox?
Yes. That's the whole point. Every sibling you invite to your Sandwich workspace sees the same inbox. You can assign roles (owner, coordinator, viewer) and everyone gets a per-sibling read indicator so you always know who has seen what.

What if my mom and aunt have the same first name?
Addresses include both first and last name plus a 4-character code, so two Helens with different last names get cleanly distinct addresses — e.g. helen-smith-AB12@… and helen-jones-CD34@…. Distinct addresses, distinct inboxes, no confusion.

What happens to messages — do they get summarized?
Every inbound message gets an AI pass that generates a one-line summary and classifies it into a category (appointment, pharmacy, billing, discharge, etc.). The summary appears in the inbox list view so you can triage at a glance without opening every message.

What it is

Sandwich Pipe is the planned private-link layer between care-data producers and LovedOne. Agencies, EHRs, and home-health platforms will POST structured events; LovedOne lights up the right loved-one record. Pipe is not live yet. The planned endpoint is POST https://api.lovedone.app/sandwichpipe/v1/events. It is being built in Terahertz-Inc/sandwichpipe. api.joinsandwich.com is dead and being retired.

Why a pipe

• Neutral shape. One event schema — institution_id, subject_ref, event_type, payload — lets us onboard any partner without redesigning the app.
• Signed and replayable. Every request carries X-SandwichPipe-Signature: sha256=…, computed over the raw body with a per-partner secret. Replays are cheap; forgeries are not.
• Fire-and-forget on the partner side. Partners never block their own workflow waiting on Sandwich. If Sandwich Pipe is down, events are queued and retried with exponential backoff.

Event envelope

{
  "institution_id": "sandwichsoft-sunrise-home-care",
  "subject_ref":    "client_8c1f",
  "event_type":     "visit_ended",
  "occurred_at":    "2026-04-16T21:04:00Z",
  "payload": {
    "caregiver_id":      "caregiver_maria_r",
    "actual_end":        "2026-04-16T21:04:00Z",
    "duration_minutes":  92
  }
}

Signature

Compute HMAC-SHA256(raw_body, partner_secret) and send the hex digest prefixed with sha256=. Sandwich verifies in constant time and rejects anything older than 5 minutes (clock-skew tolerant).

const sig = "sha256=" + hmacSha256Hex(secret, rawBody);
headers["X-SandwichPipe-Signature"]   = sig;
headers["X-SandwichPipe-Institution"] = institutionId;
headers["X-SandwichPipe-Timestamp"]   = new Date().toISOString();

Event types (v1)

Becoming a partner

LovedOne Soft agencies get Sandwich Pipe for free — it's wired into clock-in and clock-out. Outside partners (EHRs, hospital discharge systems, other agency platforms) can email hello@joinsandwich.com for a sandbox secret and a signed integration agreement.

What it is

LovedOne Soft is the operating system for home-care agencies. Each agency is a tenant with its own portal — soft.lovedone.app/?slug=sunrise-home-care — and its own admin dashboard, caregiver roster, client list, visit schedule, and message thread.

Who uses it

• Agency admins manage clients, caregivers, and schedules from the web dashboard. They own the book of record.
• Caregivers open the agency URL on their phone, sign in, and use the mobile portal at /me — pick a shift, clock in, log a note, clock out.
• Families don't use LovedOne Soft directly. They use the LovedOne app, and data flows to them through Sandwich Pipe when family share is on.

Data model

Every record is namespaced to a tenant — no cross-tenant reads, ever.

tenants/{tenant_id}/
  staff/{uid}             # caregivers & admins
  clients/{client_id}     # +family_share_enabled, +secret_hash
  visits/{visit_id}       # scheduled + in-progress + completed
  notes/{note_id}         # observations, vitals, med confirmations
  media/{media_id}        # photos taken during a visit
  messages/{msg_id}       # threads per client

Caregiver portal

LovedOne Soft's /me route is a phone-first webapp. Caregivers see their open shifts, pick one, clock in with a single tap, write a note, attach a photo, and clock out. Each action emits a Sandwich Pipe event if the client has family share on — no extra work for the caregiver.

Family share toggle

// admin flips family share for a client
await enrollFamilyShare(tenantId, clientId);
// → generates secret, stores sha256 hash on client row,
// → sends secret one-time to admin via secure download

// every clock-out after this call
emitFamilyShareEvent({
  tenantId, clientId,
  eventType: "visit_ended",
  payload: { durationMinutes, noteExcerpt }
});

Why it matters

• Families stop calling the agency for updates. They already have them in LovedOne.
• Agencies get a differentiator without writing a family app. Sandwich Pipe is the family app.
• Sandwich gets first-party, signed, structured care data — the foundation that makes the MCP tools actually useful.