Helios Strategy memo 27 July 2026

Distribution strategy · not charity

The smallest homes are worth $48 a month. Serve them anyway.

No sales motion on earth is profitable at that price, so the only way to reach twenty thousand of them is to let them sign up alone. The families they serve are the people who decide where the paying customers send their parents.

01 — The arithmetic

You cannot afford to sell to a four-bed home.

Helios prices at $12 per member per month. Run that against the operators at the bottom of the market and the conclusion arrives before any strategy does.

A four-bed home$48 / month
Annual contract value$576 / year
Enterprise sales cycle6–18 months

One demo, one follow-up and one onboarding session costs more than that customer will ever pay. The choice was never free versus paid. It is free versus never serving them at all.

This is the reasoning behind every developer free tier worth copying. Vercel does not host hobby projects out of kindness. It hosts them because a hobbyist costs cents, cannot be sold to profitably, and becomes the engineer who picks the vendor at work three years later. The unit economics make the giveaway the only rational channel for that segment.

02 — What this category charges

Verified prices, most of them pulled out of government contracts.

Almost nobody in senior care software publishes pricing. Of roughly twenty vendors checked on 27 July 2026, the large ones are all quote-only. Their real numbers survive in county council agendas, because public bodies must publish what they sign.

ContractBedsWhat was paidPer bed / month
PointClickCare — Marianna Health & Rehab, FL180$1,225.92/mo + $1,000 setup$6.81
PointClickCare — Broome County, NY300$113,100.84/yr, rising 5% in year two$31.42
PointClickCare — Wayne County, NY192$86,561/yr, CPI-indexed each February$37.57

From published government contract documents. The spread is module scope: Marianna bought a base tier, the New York counties bought fuller suites. Note also that the aggregator sites quoting "$0.85–0.95 per bed per day" for PointClickCare are wrong by roughly 3x against the real itemised quote.

At the other end, a handful of micro-vendors publish plainly and price for tiny homes:

VendorBuilt forPriceFamily visibility
ALChartsPlus"Adult family homes & CBRFs", 0–4 residents$55/mo, $50 one-time setupNone
Marpass2–30 residents, 3-resident minimum$79/mo — waitlist, not yet launchedNone
SynkwiseWA adult family homes, built by ex-operators$119–149/mo flat, 3-resident minimumA permissions role only
AL CloudCareAssisted living$10/bed/mo, $120/mo floorPortals on the top tier
AL AdvantageAcquired. aladvantage.com now redirects to Eldermark, which publishes no pricing and sells enterprise.
CareTreeDead. The pricing page redirects to a domain-for-sale listing.

Vendor sites, fetched 2026-07-27. The important correction to the obvious assumption: small operators are servable today, and four companies do it. Not one of them gives families a window into the resident's day.

The minimums are the mechanism. AL CloudCare lists $10 per bed but enforces a $120 monthly floor, so a six-bed home pays $120 rather than $60 — an effective $20 per bed, double the list rate. Across the category, cost per bed falls roughly five to ten times as you go from six beds to a hundred. Small operators pay the highest per-resident price for the least software.

03 — The gap

Family visibility exists. It is just never sold to small homes.

The market splits cleanly and the two halves do not touch. Products priced for a six-bed home are compliance tools — eMAR, care plans, survey readiness. They are sold on staying licensed, not on keeping a daughter informed. Products with a real family portal — LifeLoop at 4,700 communities, Go Icon at 2,000+, Welbi, BlueStep — are enterprise, quote-only, and shaped for a building with an activities director.

Three pieces of evidence say this gap is widening rather than closing:

Signal 01

Incumbents are retreating upmarket

The two best-known small-operator options are gone. AL Advantage was absorbed into Eldermark, an enterprise vendor with no public pricing. CareTree's domain is for sale. What remains are four micro-companies, two of them Washington-specific and one still on a waitlist.

Signal 02

An advocacy group is building its own

6Beds Inc., which represents California's small board-and-care operators, is shipping its own app in August 2026. When a trade association starts writing software for its members, it is stating plainly that the commercial market did not serve them.

Signal 03

Most of them are still on paper

Federal surveys put electronic record adoption in 4-to-25-bed homes at 12 to 14%, against 78 to 84% for nursing homes and home health. This segment is roughly two decades behind. And there is no mandate coming: a fifty-state regulatory review contains not one occurrence of "eMAR" or "electronic record."

Bed-size-stratified federal data across four survey waves. Note the segment is the numerical majority of providers and only 6.8% of beds — which is exactly why enterprise product design ignores it.

The pain is measurable, and it is paperwork rather than care. Washington publishes its most-cited home violations every quarter. In a single quarter: medication system 201, personnel records 176, resident record content 123, care plan 107, care plan signatures 88, review timing 68, medication log 65. The large majority of citations are that the paperwork was not complete, current, signed or on time. That is a regulator, quarterly, telling you precisely what a two-minute structured daily record would prevent — and it is an argument aimed at the operator's own licence rather than at their goodwill.

And the one vendor that does reach group homes has no family product. Residex — independently owned, private-equity backed, formerly RTasks — explicitly lists "Group Homes" and "Specialized Living" among the settings it serves, which is the segment Yardi, PointClickCare and MatrixCare all abandon. Nothing in its product material mentions a family portal or a family app. The company positioned closest to these operators is the one least likely to give their families a window.

04 — The demand

This is measured, not assumed.

Every argument so far has been about supply. The reason it matters is that the demand side is documented in federal complaint data, in peer-reviewed measurement, and — most tellingly — in a competitor's own published research.

Federal law requires a home to tell a family only when something goes wrong. There is no duty to say anything about an ordinary day — and so nothing in the record describes one.

An assisted living administrator, explaining it plainly on a public forum: "we can't give you a full play by play of their day because we don't document it in their chart. We only keep record of certain things."

That single fact explains every empty feed in this category. The incumbent family apps are not badly designed so much as badly supplied: they are windows onto a record that was never written. Staff cannot post the day because nothing in their workflow captures the day.

Which is precisely what Helios already does. A two-minute structured check-in is not a feature bolted beside a family portal — it is the act of creating the record that does not currently exist anywhere. The family view is a by-product of a clinical instrument that has to be filled in anyway. That is the difference between a feed with something in it and a feed without.

Federal complaint data · 2025

The one grievance families own

Across roughly 202,000 long-term care ombudsman complaints, "access to information and records" is the only major category where family members outnumber residents as complainants — 1,542 against 1,446. It is also substantiated 82% of the time, the second-highest verification rate of any category. When a family says nobody will tell them anything, investigators agree four times out of five.

Peer-reviewed · 2023

Rated below the midpoint

A study of residents linked to their family caregivers measured communication with care staff directly. Availability scored 5.8 on a 1-to-12 scale; helpfulness 1.7 out of 4. The authors' own word for it is "suboptimal." Greater perceived availability correlated with fewer depressive symptoms in the resident.

A competitor's own report · 2025

The industry says so itself

Go Icon surveyed its own market: 75% of corporate leaders believe their community tracks family engagement; only 30% of activities directors say it actually happens, and 30% of communities do not track it at all. 60% of regional directors called their own communication strategy ineffective. This is the incumbent describing the gap in its own words.

What families actually want is to see, not to talk. The clearest statement of it comes from a caregiver in a 2022 study, describing video calls with her 91-year-old father: "I said to the staff, show me his back, show me his feet, show me all the things that I was doing for him before we weren't allowed in." A daughter who installed a camera and found her mother left unchanged and unfed put the other half of it: "It was traumatic to learn that we were right."

That instinct is now law across a long list of states, on a ratchet running two decades — Texas in 2001, Oklahoma 2013, Kansas 2018, Minnesota 2019, Missouri 2020, Ohio 2022, Virginia's latest trigger in 2025. The industry opposes these bills consistently; they pass anyway, because individual families keep turning up with a story. When people legislate their way to a view of their mother's room, the market has failed to sell them one.

And every one of those statutes assumes the family is paying. Each allocates the cost to the resident — the camera, the installation, sometimes the electricity. Legislatures did not need to create the demand. They only had to remove the facility's veto.

Virginia went further and accidentally priced the product. Its statute caps what a facility may charge for a managed monitoring service at $150 setup, a $250 deposit, and $10 a month. Legislatures cap prices when they expect somebody to charge them — so a recurring monthly fee to families for visibility is already contemplated in law as a normal transaction, and $10 is the ceiling a legislature thought fair rather than a market-clearing price.

Set that beside what these families already spend: $74,400 a year for assisted living, $115,000 to $130,000 for a nursing home, and $35 an hour for a companion to sit in the room. Eight hours of sitter a week is roughly $14,500 a year on top of the bill. The gap between paying $35 an hour for a person to be present and $10 a month for a camera to be present is the entire opportunity.

An operator put the permanence of it plainly: "The pandemic changed what families expect from long-term care. They want access, they want transparency, and they are not going to settle for less." And in Maryland's annual family survey, the domain covering staff and communication correlates with overall satisfaction at 0.80 — higher than the care itself. Only 72% of families would recommend their home.

05 — The weakness worth attacking

Nobody has shipped a family app anyone uses.

Family access is marketed as core almost everywhere. Then you look for the app. Across eleven major platforms surveyed, eight have no family app at all, and the three that do share twenty-three lifetime ratings between them.

Family-facing appRatingRatingsLast shipped
Yardi Senior Living Portal1.812May 2026
AlayaCare Family Portal2.29Mar 2026
MatrixCare Engage5.02Jul 2026
Eldermark engage2.45Jan 2025
Sagely: Family 2.02.515Mar 2023 — frozen
Go Icon Family3.023Jul 2026
PointClickCare, WellSky, AxisCare, Aaniie, CareSmartz360, Alora, KanTimeNo family app exists
AxisCare Mobile — for caregivers, not families4.827,306current
WellSky Personal Care — for caregivers3.98,455current

iOS listings verified 2026-07-27. Complaints are unglamorous: the pay button cut off below the screen, correct credentials rejected, blank screens, and one app that demands a password meeting five separate requirements every single time it opens.

Read the last two rows against the rest. These companies can ship mobile software — their caregiver apps have twenty-seven thousand and eight thousand ratings. They simply have not shipped it to families. Adult children are phone-native, and a web portal you reach by remembering a URL and a password is a categorically different product from a notification that arrives.

Two more absences worth naming. One vendor in eleven offers family-visible photos. And the market leader explicitly excludes narrative care notes from what families see — families get structured clinical fields, not "how was Mum's day." One family member reviewing a competitor's app put the ceiling precisely: "it's barely better than Google sharing a calendar with my carers."

05 — What the free tier buys

Three returns, none of them called conversion.

The trap is measuring a free tier by how many free users start paying. Judged that way this one fails, because a six-bed home does not grow into a ninety-bed community. It buys three other things.

01 · Demand generation

Families are the channel

Helios already has a patient_proxy role, so the family surface exists. Every free operator creates two to five relatives receiving a daily "she ate lunch, walked the hall, slept well." Those people have another parent in a facility offering nothing like it — and they choose that facility.

02 · Clinical validation

The rules need real data

Eleven thresholds — three pounds overnight, SpO2 under 90 — are asserted from literature today. Usage at volume, with consent, is how they become validated against outcomes. A calibrated rule engine is a categorically stronger pitch to a health plan than a plausible one.

03 · Proof, early

References before revenue

Helios is pre-commercial with no users, and its enterprise path starts with design partners on de-identified demo data. Free operators produce real screenshots, real testimonials and real usage numbers months before the first business associate agreement is countersigned.

06 — The objections

What has to be true for this to work.

A one-sided version of this argument is not worth reading. Four things could sink it.

Objection 01 Someone already gives away a family app

Quiltt ships a free-forever tier including a mobile app for residents, families and staff, unlimited users, no card, no contract. That is the most serious competitive fact here and deserves a straight answer.

Worse, the market leader gives its family portal away entirely. PointClickCare states plainly that Connected Care Center is "available to communities using PointClickCare's Senior Living EHR at no additional cost." You cannot win this category on the words "we have a family portal."

The answer, and it is the strongest fact in this memo: look at what those free products actually are. PointClickCare's is web only — there is no app — it is invitation-gated by staff, it has no photos, and it explicitly excludes narrative care notes, offering structured clinical fields instead. Quiltt's free tier gives families a calendar and a login while gating photos behind $499 a month. Both are portals a daughter must remember to visit, not something that arrives on her phone.

The proof that this is insufficient is that a market has formed on top of the free product. Family CareSpace and InTouchLink sell paid family apps through PointClickCare's own marketplace — customers paying for family visibility that they already receive for free. When people buy something they have been given, the given thing is not the thing they wanted.

Objection 02 The operator will not buy surveillance of themselves

This is the objection an industry insider raised, and it is the sharpest one: "Your biggest obstacle will not be family adoption; it will be facility adoption. Even if the app is free, getting care homes to consistently use another platform will be extremely difficult." A facility has no incentive to buy a tool whose value to the family is verification. It is why every product in this category is sold as wellness, engagement and efficiency, and never as accountability.

The evidence backs him. Across nine companies checked — Papa, Sensi.AI, LifeLoop, SafelyYou, CarePredict, Nobi, Butlr, K4Connect, Cubigo — not one charges families directly. The buyer is always the operator, the agency, or the health plan. The family is permanently the user and never the customer, which is exactly why the family tier is where investment goes to die.

The answer is the segment itself. In a four-bed home the person doing the logging is the owner, and is also the person the daughter rings on a Sunday. There is no principal and no agent, so there is nothing to be caught doing. The adversarial dynamic that kills this product at ninety beds simply does not exist at four, where a daily note is the operator's own marketing — the thing that keeps a family recommending them and their beds full. This is not a smaller version of the enterprise sale. It is a different sale, and the only one where the incentives point the same way.

Objection 03 A free tier does not reduce the legal obligation by one line

This one is settled, and worth stating flatly because the hope is so tempting. The federal definition of a business associate turns entirely on function — whether you create, receive, maintain or transmit protected health information on a covered provider's behalf. There is no payment, price or contract term anywhere in it. A free product that stores resident notes is a business associate on identical terms to a $500-a-month one, and the government's own cloud guidance says the obligations apply "regardless of whether it has executed a BAA."

The answer: the escape route is real but narrow. A home is a covered entity only if it transmits health information electronically for a billing-type transaction, so a purely private-pay home may sit outside HIPAA — legitimately, not as a loophole. But it flips the instant one Medicaid-waiver resident arrives or one electronic eligibility check runs, retroactively, for data already held. The right move is to sign the agreement anyway: it costs nothing at AWS, Google Cloud or Azure, and you cannot become a business associate by accident if you have already agreed to behave like one.

Objection 04 Free in healthcare has a body count — and a modern version

Practice Fusion gave away a free electronic health record, reached enormous scale, monetised it through sponsored clinical alerts, and paid a $145 million settlement. Free distribution was not the crime; the monetisation design was.

The 2026 version is sharper and lands directly on free tiers. The FTC's Health Breach Notification Rule was amended in 2024 so that a "breach of security" now expressly includes an unauthorised disclosure, not merely an intrusion. An analytics SDK or advertising pixel that leaks resident data is a reportable federal breach with no hacker involved — at roughly $53,000 per violation, per day. And a free tier is precisely the product somebody instruments for growth analytics.

The answer: two rules, both absolute. Never take money from a third party in exchange for influencing what a caregiver sees or does. And keep every analytics, attribution and advertising SDK away from anything touching a resident. Charge instead for organisational scale — multi-site, FHIR export, population reporting, SLAs, admin controls. That is the entire difference between the Vercel analogy and the Practice Fusion one.

Objection 05 A standing family feed is not a permitted disclosure

The rule allowing disclosure to family involved in someone's care is scoped to information "directly relevant to such person's involvement," and it is built around a contemporaneous act of professional judgement. An automated daily feed is not scoped by a person — it is scoped by a cron job, and you cannot exercise professional judgement at 3am via webhook. Photographs make it worse: a full-face image is itself an identifier, so photos cannot be de-identified by stripping names.

This is not theoretical. Cadia Healthcare paid $182,000 in 2025 for using residents' photos and health information without proper authorisations across five facilities. Holy Redeemer paid $35,581 for disclosing a full record when the authorisation covered a single test — which is the exact failure mode of an over-broad family feed.

The answer, and it is cheap: build a signed authorisation into admission that names each recipient, states what they receive, carries an expiry, and can be revoked in-app with access dying instantly. That is a few days of engineering, and it does more than paper over the problem — the minimum-necessary standard does not apply to disclosures made under an authorisation, so it removes the scope question rather than arguing it. For residents with dementia it is mandatory rather than optional: "next of kin" confers no legal authority, and the operator needs a way to suppress a viewer without filing a support ticket, because family members are also the most common elder abusers.

07 — What compliance actually costs

Smaller than the fear, and the cheapest item matters most.

"HIPAA" is usually where a plan like this dies, on the assumption that the number is unknowable and enormous. It is neither.

ItemCostNote
Business associate agreement with AWS, Google Cloud or Azure$0Self-service. Google states explicitly it does not charge more for HIPAA-eligible services.
Risk analysis$2,000–$20,000The highest-return dollar in the whole budget. See below.
Policies and procedures$2,000–$5,000Six-year retention obligation attaches.
Healthcare privacy legal work$3,000–$10,000BAA template, terms, and the authorisation form above.
Cyber liability insurance$1,500–$8,000/yrHealth data sits in the upper half of the range.
Penetration test$4,000–$8,000Typical for a small web app.
Compliance automation (Vanta, Drata, Secureframe)$12,000–$28,000/yrThe largest line item, and the most deferrable. Nothing in HIPAA requires it.
SOC 2 Type IINot a HIPAA requirement. It is a procurement requirement. A four-bed home will never ask.

First year, realistically: $10,000–$29,000 lean (no compliance platform, no SOC 2) or $26,000–$65,000 with tooling and a pen test. Verified against provider documentation and current market pricing, July 2026.

Two facts that should change how this feels. First, the single most common trigger for federal enforcement is failure to have done a risk analysis — that is what converts an ordinary ransomware incident into a penalty. It costs $2,000 to $20,000 and it is the best money in this budget. Second, regulators scale to ability to pay: one small software vendor whose breach affected roughly fifteen million people settled for $10,000 because of its financial position. Real exposure for a small vendor acting in good faith looks like $5,000 to $250,000, not the multi-million cap. The severe tier is reserved for willful neglect, uncorrected — which is a description of a company that ignored problems it knew about.

One engineering decision outranks all of the above: encrypt to the federal safe-harbour standard. Properly encrypted data that leaks is not "unsecured," and a breach of it is generally not notifiable at all. It converts most incidents into non-events, and it is the cheapest insurance available.

Worth knowing for planning: the proposed rule that would have made encryption and multi-factor authentication mandatory rather than merely expected has not been finalised, and the government's own agenda now projects final action in July 2027. Build to it regardless — it is cheap now and every security review will ask.

08 — The shape

What free includes, and where it stops.

Copy the developer-tools pattern exactly: free covers the individual doing the work, paid begins where the organisation does. The line is not feature richness. It is scale and integration.

The entry tier · $49–79 a month

The one-person home

Up to six residents, one or two caregivers. The daily check-in, the eleven-rule alert engine, and family access on a phone with photos and the narrative of the day. The business associate agreement is included automatically at signup, not withheld until enterprise. No card-free trial games, no contract, no demo call, no sales human, ever.

Paid

Where an organisation begins

Multiple sites and staff roles, FHIR export into an EHR, SDOH screening and population reporting, admin controls and audit exports, an SLA. Everything an operator needs the moment they answer to somebody else.

This is a change from where the memo started, and the research is why. Of eighteen major software vendors checked, not one will sign a business associate agreement on a free plan — not Slack, Notion, Airtable, Box, Dropbox or Zoom. Box states that its free accounts have "the same security and privacy controls" as enterprise; it simply will not sign the paper. The gate is liability, not capability, and refusing unlimited breach exposure against zero revenue is rational rather than greedy.

The shape that actually works in healthcare is not free. It is cheap, self-serve, and BAA-inclusive: Spruce Health at $24 a user, SimplePractice at $49 with the agreement attaching automatically at account creation and roughly a hundred thousand solo practitioners acquired without a salesperson. A free tier that legally cannot be used for the actual job is not distribution — it is a demo, and it never converts anyone.

And the segment has already priced itself. Washington's own training curriculum for new home operators budgets roughly $1,050 a month of non-payroll overhead against a $27,250 total startup cost, and instructs owners not to count their own wages as an expense at all. The vendors purpose-built for these homes landed at $49 to $149 a month; anything at $295 is above the line, and any four-figure onboarding fee is disqualifying against a business that started for $27,000.

So the entry tier should sit at $49 to $79 — inside the overhead line, above the liability breakeven, and with the compliance paperwork included rather than dangled. It achieves everything the free tier was meant to achieve (no sales motion, no procurement, no gatekeeper) without the asymmetry of carrying federal breach exposure for customers paying nothing.

The rest of the line falls exactly where Helios's architecture already splits: multi-tenant billing, FHIR export and SDOH reporting are organisational features; the check-in and the alert engine are individual ones. The product is already built along the seam the pricing needs.

09 — Honest gaps

What this memo does not know.

The market is now measured, and it is bigger than the federal survey says. Washington licenses 6,129 adult family homes (97% with six beds or fewer). California licenses 7,939 residential care facilities for the elderly, 78% of them 4-to-6 beds, plus a further 6,000-plus adult residential facilities. Oregon adds 1,556. Five states alone hold 14,692 sub-eleven-bed homes — against a national federal estimate of 13,000, which tells you the federal number is not usable. A defensible working estimate is roughly 20,000 licensed homes under ten beds nationally, concentrated in the West.

Two caveats before that goes in a deck. Homes with one to three beds are excluded from the federal sampling frame entirely, so the true floor is unknown. And Pennsylvania is the corrective: only 11% of its personal care homes are under eleven beds. This is a West Coast market, not a national one.

  • What these operators actually use today. Every signal points to paper, whiteboards and group texts, and the state's own curriculum still teaches a paper medication log with an electronic copy as the backup — but no survey has ever measured it. The inference is strong and unmeasured, and it is the biggest evidence gap here.
  • How much families would pay directly, and to whom. That some will pay is now evidenced — third-party family apps sell through PointClickCare's marketplace on top of its free portal. What is unknown is the price, the volume, and whether the family or the operator should hold the account. That decision changes the regulatory posture of the whole company and is worth a fortnight of interviews before a line of code.
  • State-level rules, which stack on top of everything above. Adult family home licensing regulations govern resident records and photography independently of federal law and vary by state, and Washington's consumer health data act carries a private right of action. Both must be checked per launch state — the federal analysis here does not cover them.

One conflict worth recording: two independent research passes disagreed on whether Caremerge still operates or was absorbed into Go Icon in June 2022. The evidence favours absorption — dated trade coverage, plus the detail that Go Icon's Android package is still named com.caremerge.family — but caremerge.com remains live with no redirect and no notice. Treat it as unsettled rather than resolved.