Distribution strategy · not charity
Not out of generosity. At $12 per member per month a four-bed home is worth $48, no sales motion is profitable at that price, and the families using it are the people who decide where the paying customers send their parents.
01 — The arithmetic
Helios prices at $12 per member per month. Run that against the operators at the bottom of the market and the conclusion arrives before any strategy does.
One demo, one follow-up and one onboarding session costs more than that customer will ever pay. The choice was never free versus paid. It is free versus never serving them at all.
This is the reasoning behind every developer free tier worth copying. Vercel does not host hobby projects out of kindness. It hosts them because a hobbyist costs cents, cannot be sold to profitably, and becomes the engineer who picks the vendor at work three years later. The unit economics make the giveaway the only rational channel for that segment.
02 — What this category charges
Almost nobody in senior care software publishes pricing. Of roughly twenty vendors checked on 27 July 2026, the large ones are all quote-only. Their real numbers survive in county council agendas, because public bodies must publish what they sign.
| Contract | Beds | What was paid | Per bed / month |
|---|---|---|---|
| PointClickCare — Marianna Health & Rehab, FL | 180 | $1,225.92/mo + $1,000 setup | $6.81 |
| PointClickCare — Broome County, NY | 300 | $113,100.84/yr, rising 5% in year two | $31.42 |
| PointClickCare — Wayne County, NY | 192 | $86,561/yr, CPI-indexed each February | $37.57 |
From published government contract documents. The spread is module scope: Marianna bought a base tier, the New York counties bought fuller suites. Note also that the aggregator sites quoting "$0.85–0.95 per bed per day" for PointClickCare are wrong by roughly 3x against the real itemised quote.
At the other end, a handful of micro-vendors publish plainly and price for tiny homes:
| Vendor | Built for | Price | Family visibility |
|---|---|---|---|
| ALChartsPlus | "Adult family homes & CBRFs", 0–4 residents | $55/mo, $50 one-time setup | None |
| Marpass | 2–30 residents, 3-resident minimum | $79/mo — waitlist, not yet launched | None |
| Synkwise | WA adult family homes, built by ex-operators | $119–149/mo flat, 3-resident minimum | A permissions role only |
| AL CloudCare | Assisted living | $10/bed/mo, $120/mo floor | Portals on the top tier |
| AL Advantage | Acquired. aladvantage.com now redirects to Eldermark, which publishes no pricing and sells enterprise. | ||
| CareTree | Dead. The pricing page redirects to a domain-for-sale listing. | ||
Vendor sites, fetched 2026-07-27. The important correction to the obvious assumption: small operators are servable today, and four companies do it. Not one of them gives families a window into the resident's day.
The minimums are the mechanism. AL CloudCare lists $10 per bed but enforces a $120 monthly floor, so a six-bed home pays $120 rather than $60 — an effective $20 per bed, double the list rate. Across the category, cost per bed falls roughly five to ten times as you go from six beds to a hundred. Small operators pay the highest per-resident price for the least software.
03 — The gap
The market splits cleanly and the two halves do not touch. Products priced for a six-bed home are compliance tools — eMAR, care plans, survey readiness. They are sold on staying licensed, not on keeping a daughter informed. Products with a real family portal — LifeLoop at 4,700 communities, Go Icon at 2,000+, Welbi, BlueStep — are enterprise, quote-only, and shaped for a building with an activities director.
Three pieces of evidence say this gap is widening rather than closing:
Signal 01
The two best-known small-operator options are gone. AL Advantage was absorbed into Eldermark, an enterprise vendor with no public pricing. CareTree's domain is for sale. What remains are four micro-companies, two of them Washington-specific and one still on a waitlist.
Signal 02
6Beds Inc., which represents California's small board-and-care operators, is shipping its own app in August 2026. When a trade association starts writing software for its members, it is stating plainly that the commercial market did not serve them.
Signal 03
Reported EHR adoption in 4-to-50-bed communities moved only from 26% to 35% between 2018 and 2022, against 64% to 80% for larger ones. Washington's compliance consultants still advise keeping paper resident binders for inspection.
The adoption figure is secondhand — the publisher blocks automated access — and should be confirmed before it is quoted externally. It is the single load-bearing number in this section.
And the one vendor that does reach group homes has no family product. Residex — independently owned, private-equity backed, formerly RTasks — explicitly lists "Group Homes" and "Specialized Living" among the settings it serves, which is the segment Yardi, PointClickCare and MatrixCare all abandon. Nothing in its product material mentions a family portal or a family app. The company positioned closest to these operators is the one least likely to give their families a window.
04 — The demand
Every argument so far has been about supply. The reason it matters is that the demand side is documented in federal complaint data, in peer-reviewed measurement, and — most tellingly — in a competitor's own published research.
Federal law requires a home to tell a family only when something goes wrong. There is no duty to say anything about an ordinary day — and so nothing in the record describes one.
An assisted living administrator, explaining it plainly on a public forum: "we can't give you a full play by play of their day because we don't document it in their chart. We only keep record of certain things."
That single fact explains every empty feed in this category. The incumbent family apps are not badly designed so much as badly supplied: they are windows onto a record that was never written. Staff cannot post the day because nothing in their workflow captures the day.
Which is precisely what Helios already does. A two-minute structured check-in is not a feature bolted beside a family portal — it is the act of creating the record that does not currently exist anywhere. The family view is a by-product of a clinical instrument that has to be filled in anyway. That is the difference between a feed with something in it and a feed without.
Federal complaint data · 2025
Across roughly 202,000 long-term care ombudsman complaints, "access to information and records" is the only major category where family members outnumber residents as complainants — 1,542 against 1,446. It is also substantiated 82% of the time, the second-highest verification rate of any category. When a family says nobody will tell them anything, investigators agree four times out of five.
Peer-reviewed · 2023
A study of residents linked to their family caregivers measured communication with care staff directly. Availability scored 5.8 on a 1-to-12 scale; helpfulness 1.7 out of 4. The authors' own word for it is "suboptimal." Greater perceived availability correlated with fewer depressive symptoms in the resident.
A competitor's own report · 2025
Go Icon surveyed its own market: 75% of corporate leaders believe their community tracks family engagement; only 30% of activities directors say it actually happens, and 30% of communities do not track it at all. 60% of regional directors called their own communication strategy ineffective. This is the incumbent describing the gap in its own words.
What families actually want is to see, not to talk. The clearest statement of it comes from a caregiver in a 2022 study, describing video calls with her 91-year-old father: "I said to the staff, show me his back, show me his feet, show me all the things that I was doing for him before we weren't allowed in." A daughter who installed a camera and found her mother left unchanged and unfed put the other half of it: "It was traumatic to learn that we were right."
That instinct is now law across a long list of states, on a ratchet running two decades — Texas in 2001, Oklahoma 2013, Kansas 2018, Minnesota 2019, Missouri 2020, Ohio 2022, Virginia's latest trigger in 2025. The industry opposes these bills consistently; they pass anyway, because individual families keep turning up with a story. When people legislate their way to a view of their mother's room, the market has failed to sell them one.
And every one of those statutes assumes the family is paying. Each allocates the cost to the resident — the camera, the installation, sometimes the electricity. Legislatures did not need to create the demand. They only had to remove the facility's veto.
Virginia went further and accidentally priced the product. Its statute caps what a facility may charge for a managed monitoring service at $150 setup, a $250 deposit, and $10 a month. Legislatures cap prices when they expect somebody to charge them — so a recurring monthly fee to families for visibility is already contemplated in law as a normal transaction, and $10 is the ceiling a legislature thought fair rather than a market-clearing price.
Set that beside what these families already spend: $74,400 a year for assisted living, $115,000 to $130,000 for a nursing home, and $35 an hour for a companion to sit in the room. Eight hours of sitter a week is roughly $14,500 a year on top of the bill. The gap between paying $35 an hour for a person to be present and $10 a month for a camera to be present is the entire opportunity.
An operator put the permanence of it plainly: "The pandemic changed what families expect from long-term care. They want access, they want transparency, and they are not going to settle for less." And in Maryland's annual family survey, the domain covering staff and communication correlates with overall satisfaction at 0.80 — higher than the care itself. Only 72% of families would recommend their home.
05 — The weakness worth attacking
Family access is marketed as core almost everywhere. Then you look for the app. Across eleven major platforms surveyed, eight have no family app at all, and the three that do share twenty-three lifetime ratings between them.
| Family-facing app | Rating | Ratings | Last shipped |
|---|---|---|---|
| Yardi Senior Living Portal | 1.8 | 12 | May 2026 |
| AlayaCare Family Portal | 2.2 | 9 | Mar 2026 |
| MatrixCare Engage | 5.0 | 2 | Jul 2026 |
| Eldermark engage | 2.4 | 5 | Jan 2025 |
| Sagely: Family 2.0 | 2.5 | 15 | Mar 2023 — frozen |
| Go Icon Family | 3.0 | 23 | Jul 2026 |
| PointClickCare, WellSky, AxisCare, Aaniie, CareSmartz360, Alora, KanTime | No family app exists | ||
| AxisCare Mobile — for caregivers, not families | 4.8 | 27,306 | current |
| WellSky Personal Care — for caregivers | 3.9 | 8,455 | current |
iOS listings verified 2026-07-27. Complaints are unglamorous: the pay button cut off below the screen, correct credentials rejected, blank screens, and one app that demands a password meeting five separate requirements every single time it opens.
Read the last two rows against the rest. These companies can ship mobile software — their caregiver apps have twenty-seven thousand and eight thousand ratings. They simply have not shipped it to families. Adult children are phone-native, and a web portal you reach by remembering a URL and a password is a categorically different product from a notification that arrives.
Two more absences worth naming. One vendor in eleven offers family-visible photos. And the market leader explicitly excludes narrative care notes from what families see — families get structured clinical fields, not "how was Mum's day." One family member reviewing a competitor's app put the ceiling precisely: "it's barely better than Google sharing a calendar with my carers."
05 — What the free tier buys
The trap is measuring a free tier by how many free users start paying. Judged that way this one fails, because a six-bed home does not grow into a ninety-bed community. It buys three other things.
01 · Demand generation
Helios already has a patient_proxy role, so the family surface exists. Every free operator creates two to five relatives receiving a daily "she ate lunch, walked the hall, slept well." Those people have another parent in a facility offering nothing like it — and they choose that facility.
02 · Clinical validation
Eleven thresholds — three pounds overnight, SpO2 under 90 — are asserted from literature today. Usage at volume, with consent, is how they become validated against outcomes. A calibrated rule engine is a categorically stronger pitch to a health plan than a plausible one.
03 · Proof, early
Helios is pre-commercial with no users, and its enterprise path starts with design partners on de-identified demo data. Free operators produce real screenshots, real testimonials and real usage numbers months before the first business associate agreement is countersigned.
06 — The objections
A one-sided version of this argument is not worth reading. Four things could sink it.
Quiltt ships a free-forever tier including a mobile app for residents, families and staff, unlimited users, no card, no contract. That is the most serious competitive fact here and deserves a straight answer.
Worse, the market leader gives its family portal away entirely. PointClickCare states plainly that Connected Care Center is "available to communities using PointClickCare's Senior Living EHR at no additional cost." You cannot win this category on the words "we have a family portal."
The answer, and it is the strongest fact in this memo: look at what those free products actually are. PointClickCare's is web only — there is no app — it is invitation-gated by staff, it has no photos, and it explicitly excludes narrative care notes, offering structured clinical fields instead. Quiltt's free tier gives families a calendar and a login while gating photos behind $499 a month. Both are portals a daughter must remember to visit, not something that arrives on her phone.
The proof that this is insufficient is that a market has formed on top of the free product. Family CareSpace and InTouchLink sell paid family apps through PointClickCare's own marketplace — customers paying for family visibility that they already receive for free. When people buy something they have been given, the given thing is not the thing they wanted.
This is the objection an industry insider raised, and it is the sharpest one: "Your biggest obstacle will not be family adoption; it will be facility adoption. Even if the app is free, getting care homes to consistently use another platform will be extremely difficult." A facility has no incentive to buy a tool whose value to the family is verification. It is why every product in this category is sold as wellness, engagement and efficiency, and never as accountability.
The evidence backs him. Across nine companies checked — Papa, Sensi.AI, LifeLoop, SafelyYou, CarePredict, Nobi, Butlr, K4Connect, Cubigo — not one charges families directly. The buyer is always the operator, the agency, or the health plan. The family is permanently the user and never the customer, which is exactly why the family tier is where investment goes to die.
The answer is the segment itself. In a four-bed home the person doing the logging is the owner, and is also the person the daughter rings on a Sunday. There is no principal and no agent, so there is nothing to be caught doing. The adversarial dynamic that kills this product at ninety beds simply does not exist at four, where a daily note is the operator's own marketing — the thing that keeps a family recommending them and their beds full. This is not a smaller version of the enterprise sale. It is a different sale, and the only one where the incentives point the same way.
This one is settled, and worth stating flatly because the hope is so tempting. The federal definition of a business associate turns entirely on function — whether you create, receive, maintain or transmit protected health information on a covered provider's behalf. There is no payment, price or contract term anywhere in it. A free product that stores resident notes is a business associate on identical terms to a $500-a-month one, and the government's own cloud guidance says the obligations apply "regardless of whether it has executed a BAA."
The answer: the escape route is real but narrow. A home is a covered entity only if it transmits health information electronically for a billing-type transaction, so a purely private-pay home may sit outside HIPAA — legitimately, not as a loophole. But it flips the instant one Medicaid-waiver resident arrives or one electronic eligibility check runs, retroactively, for data already held. The right move is to sign the agreement anyway: it costs nothing at AWS, Google Cloud or Azure, and you cannot become a business associate by accident if you have already agreed to behave like one.
Practice Fusion gave away a free electronic health record, reached enormous scale, monetised it through sponsored clinical alerts, and paid a $145 million settlement. Free distribution was not the crime; the monetisation design was.
The 2026 version is sharper and lands directly on free tiers. The FTC's Health Breach Notification Rule was amended in 2024 so that a "breach of security" now expressly includes an unauthorised disclosure, not merely an intrusion. An analytics SDK or advertising pixel that leaks resident data is a reportable federal breach with no hacker involved — at roughly $53,000 per violation, per day. And a free tier is precisely the product somebody instruments for growth analytics.
The answer: two rules, both absolute. Never take money from a third party in exchange for influencing what a caregiver sees or does. And keep every analytics, attribution and advertising SDK away from anything touching a resident. Charge instead for organisational scale — multi-site, FHIR export, population reporting, SLAs, admin controls. That is the entire difference between the Vercel analogy and the Practice Fusion one.
The rule allowing disclosure to family involved in someone's care is scoped to information "directly relevant to such person's involvement," and it is built around a contemporaneous act of professional judgement. An automated daily feed is not scoped by a person — it is scoped by a cron job, and you cannot exercise professional judgement at 3am via webhook. Photographs make it worse: a full-face image is itself an identifier, so photos cannot be de-identified by stripping names.
This is not theoretical. Cadia Healthcare paid $182,000 in 2025 for using residents' photos and health information without proper authorisations across five facilities. Holy Redeemer paid $35,581 for disclosing a full record when the authorisation covered a single test — which is the exact failure mode of an over-broad family feed.
The answer, and it is cheap: build a signed authorisation into admission that names each recipient, states what they receive, carries an expiry, and can be revoked in-app with access dying instantly. That is a few days of engineering, and it does more than paper over the problem — the minimum-necessary standard does not apply to disclosures made under an authorisation, so it removes the scope question rather than arguing it. For residents with dementia it is mandatory rather than optional: "next of kin" confers no legal authority, and the operator needs a way to suppress a viewer without filing a support ticket, because family members are also the most common elder abusers.
07 — What compliance actually costs
"HIPAA" is usually where a plan like this dies, on the assumption that the number is unknowable and enormous. It is neither.
| Item | Cost | Note |
|---|---|---|
| Business associate agreement with AWS, Google Cloud or Azure | $0 | Self-service. Google states explicitly it does not charge more for HIPAA-eligible services. |
| Risk analysis | $2,000–$20,000 | The highest-return dollar in the whole budget. See below. |
| Policies and procedures | $2,000–$5,000 | Six-year retention obligation attaches. |
| Healthcare privacy legal work | $3,000–$10,000 | BAA template, terms, and the authorisation form above. |
| Cyber liability insurance | $1,500–$8,000/yr | Health data sits in the upper half of the range. |
| Penetration test | $4,000–$8,000 | Typical for a small web app. |
| Compliance automation (Vanta, Drata, Secureframe) | $12,000–$28,000/yr | The largest line item, and the most deferrable. Nothing in HIPAA requires it. |
| SOC 2 Type II | — | Not a HIPAA requirement. It is a procurement requirement. A four-bed home will never ask. |
First year, realistically: $10,000–$29,000 lean (no compliance platform, no SOC 2) or $26,000–$65,000 with tooling and a pen test. Verified against provider documentation and current market pricing, July 2026.
Two facts that should change how this feels. First, the single most common trigger for federal enforcement is failure to have done a risk analysis — that is what converts an ordinary ransomware incident into a penalty. It costs $2,000 to $20,000 and it is the best money in this budget. Second, regulators scale to ability to pay: one small software vendor whose breach affected roughly fifteen million people settled for $10,000 because of its financial position. Real exposure for a small vendor acting in good faith looks like $5,000 to $250,000, not the multi-million cap. The severe tier is reserved for willful neglect, uncorrected — which is a description of a company that ignored problems it knew about.
One engineering decision outranks all of the above: encrypt to the federal safe-harbour standard. Properly encrypted data that leaks is not "unsecured," and a breach of it is generally not notifiable at all. It converts most incidents into non-events, and it is the cheapest insurance available.
Worth knowing for planning: the proposed rule that would have made encryption and multi-factor authentication mandatory rather than merely expected has not been finalised, and the government's own agenda now projects final action in July 2027. Build to it regardless — it is cheap now and every security review will ask.
08 — The shape
Copy the developer-tools pattern exactly: free covers the individual doing the work, paid begins where the organisation does. The line is not feature richness. It is scale and integration.
Free forever
Up to six residents, one or two caregivers. The daily check-in, the eleven-rule alert engine, and family access on a phone, with photos and the narrative of the day — the three things the free incumbents each leave out. Community support. No card, no contract, no demo call, no sales human, ever.
Paid
Multiple sites and staff roles, FHIR export into an EHR, SDOH screening and population reporting, admin controls and audit exports, a signed BAA with support terms, an SLA. Everything an operator needs the moment they answer to somebody else.
That line falls almost exactly where Helios's architecture already splits. Multi-tenant billing, FHIR export and SDOH reporting are organisational features; the check-in and the alert engine are individual ones. The product is already built along the seam the pricing needs.
09 — Honest gaps
Some of the market is now measured. California alone licenses roughly 7,800 residential care facilities for the elderly, and about 74% of them serve six residents or fewer — call it 5,800 small homes in one state. Nationally there are around 41,465 assisted living communities averaging 33 beds. But three things remain unsettled, and each is cheap to answer.
One conflict worth recording: two independent research passes disagreed on whether Caremerge still operates or was absorbed into Go Icon in June 2022. The evidence favours absorption — dated trade coverage, plus the detail that Go Icon's Android package is still named com.caremerge.family — but caremerge.com remains live with no redirect and no notice. Treat it as unsettled rather than resolved.