Privacy Policy

1. Introduction & Scope

Sanolume (“Sanolume,” “we,” “our,” or “us”) is a healthcare technology company that builds digital tools for nurses, physicians, and healthcare organizations. This Privacy Policy describes how we collect, use, store, share, and protect information when you:

• Visit our website at sanolume.com and its subdomains (collectively, the “Website”);
• Use our mobile applications, including Physician Orders (the “App”);
• Use Sanolume Sign, our electronic signature platform (the “E-Signature Service”);
• Interact with us through email, contact forms, or other communications.

Together, the Website, App, and E-Signature Service are referred to as the “Services.” This Policy applies to all users of our Services, including healthcare professionals, organization administrators, signers of electronic documents, and website visitors.

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use our Services.

Important: To the extent that we process Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act (“HIPAA”), such processing is governed by our Business Associate Agreement with your organization, which takes precedence over this Privacy Policy in the event of a conflict. See Section 6 for details.

2. Definitions

“Personal Information”

Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular individual or household.

“Protected Health Information” or “PHI”

Individually identifiable health information that is created, received, maintained, or transmitted in connection with health care services, as defined by HIPAA (45 C.F.R. § 160.103).

“Covered Entity”

A health plan, health care clearinghouse, or health care provider that transmits health information electronically, as defined by HIPAA.

“Business Associate”

A person or entity that performs functions or activities on behalf of, or provides certain services to, a Covered Entity that involve the use or disclosure of PHI.

“Data Controller” / “Data Processor”

Terms used under the General Data Protection Regulation (GDPR). Sanolume acts as a Data Processor when processing data on behalf of healthcare organizations and as a Data Controller for its own business data (e.g., account information, website interactions).

3. Information We Collect

We collect information in several categories depending on how you interact with our Services.

3.1 Account & Identity Information

When you create a Sanolume account, we collect:

• Full name (first and last)
• Email address
• Password (stored as a cryptographic hash; we never store plaintext passwords)
• Professional discipline (e.g., Registered Nurse, Nurse Practitioner, Physician, Social Worker, Chaplain)
• Professional credentials (e.g., RN, BSN, NP, MD)
• Organization affiliation and role (if applicable)

3.2 Clinical & Patient Data (PHI)

When you use the App in a clinical capacity, you may input data that constitutes PHI, including:

• Patient names and medical record numbers
• Physician orders, including medication names, dosages, routes, and frequencies
• Dates of service and order dates
• Physician and provider names, credentials, license numbers, and contact information
• Nurse signatures and digital signature images
• Notes and clinical observations attached to orders or documents
• Generated PDF documents containing the above information

Important: You are responsible for the accuracy and appropriateness of all clinical data you enter. Sanolume does not independently verify clinical information. See our Terms of Service for healthcare disclaimers.

3.3 E-Signature Data

When you send or sign documents through Sanolume Sign, we collect:

• Signer name and email address
• Digital signature image (captured as a PNG, maximum 500 KB)
• Typed name (if the signer chooses typed signature)
• Document hash (SHA-256) for integrity verification
• IP address at the time of signing (for audit trail purposes)
• Timestamp of signature completion
• Browser user agent (for audit trail purposes)
• The signed PDF document

3.4 Organization & Billing Data

If you register or manage an organization account, we collect:

• Organization name and type
• Organization branding assets (logo, address, phone, fax)
• Billing contact information
• Payment transaction identifiers (we do not store credit card numbers, bank account numbers, or other raw payment credentials — see Section 9 for payment processor details)
• Subscription tier, status, and renewal dates
• Team member seat assignments and invitation records

3.5 Contact & Inquiry Data

When you contact us through our Website or email, we collect:

• Name and email address
• Company name (optional)
• Message content
• IP address (for spam prevention and rate limiting)

3.6 Device & Technical Data

When you use our Services, we may automatically collect:

• Device type, operating system, and version
• Push notification tokens (Firebase Cloud Messaging identifiers, limited to 5 per user account)
• Session identifiers and timestamps (login time, last activity, session expiry)
• IP address
• Web server access logs (standard HTTP request logs managed by our hosting provider)

What we do not collect: We do not use invasive analytics services (such as Google Analytics, Firebase Analytics, Mixpanel, or Amplitude), crash reporting services (such as Sentry or Crashlytics), or advertising trackers. We do not build behavioral profiles of our users. We do not collect location data, contacts, photos, or other device data beyond what is described above. Our Website uses Umami, a privacy-focused, cookie-free analytics tool that collects only anonymous, aggregated pageview data (see Section 12).

3.7 Audit & Compliance Data

For regulatory compliance and data integrity, we automatically generate and retain:

• Audit log entries for significant actions (create, update, delete, export, sign, deliver) including the user who performed the action, timestamp, and a snapshot of the affected record
• Infrastructure access logs via AWS CloudTrail
• Application logs via AWS CloudWatch (with email addresses masked to protect PII)

4. How We Collect Information

4.1 Directly From You

We collect information that you voluntarily provide when you create an account, enter clinical data, submit a contact form, sign documents, or communicate with us.

4.2 Automatically

We collect certain technical information automatically when you use our Services, including IP addresses, session data, and web server logs. This collection is limited to what is necessary for security, performance, and service delivery. We do not deploy tracking pixels, advertising cookies, or behavioral analytics. On our Website, we use Umami, a privacy-focused analytics tool, to collect anonymous, aggregated usage data such as page paths, referrer URLs, browser type, device type, and country. Umami does not use cookies, does not collect personal data, and cannot identify individual visitors. Visitor counts are derived from a non-reversible hash that rotates daily.

4.3 From Third Parties

We may receive information from third parties in limited circumstances:

• Payment processors: Stripe, Google Play, and the Apple App Store provide us with transaction confirmations, subscription status, and billing event data (but not raw payment credentials).
• Your organization: If you are invited to join an organization on Sanolume, your administrator may provide your email address for the invitation.
• Authentication provider: AWS Cognito provides us with email verification status.

We do not purchase, rent, or otherwise obtain Personal Information from data brokers or marketing lists.

5. How We Use Your Information

We use the information we collect for the following purposes:

5.1 Service Delivery

• Provide, operate, and maintain our Services
• Generate, store, and transmit physician order documents
• Facilitate electronic signature workflows, including sending signature request emails and delivering signed documents
• Synchronize your data securely between your device and our cloud infrastructure
• Process subscription payments and manage billing
• Send push notifications about document status (without including any PHI in notification payloads)

5.2 Account Management

• Create and manage your user account
• Authenticate your identity and authorize access
• Manage organization memberships, team seats, and invitations
• Enforce access controls and data isolation between organizations

5.3 Communication

• Respond to your inquiries, support requests, and feedback
• Send transactional emails (account verification, password reset, signature requests, completion notifications)
• Notify you of material changes to our Services, policies, or terms

We do not send marketing emails, promotional materials, or newsletters. All communications are transactional or service-related.

5.4 Security & Compliance

• Detect, prevent, and respond to security threats, fraud, or abuse
• Enforce our Terms of Service and Acceptable Use Policy
• Maintain audit trails as required by HIPAA and other applicable regulations
• Comply with legal obligations, law enforcement requests, and judicial proceedings

5.5 Service Improvement

• Diagnose and fix technical issues
• Improve the performance, reliability, and usability of our Services

We do not use your Personal Information or PHI for advertising, profiling, automated decision-making, or sale to third parties. We do not use PHI for any purpose other than the services specified in our Business Associate Agreement.

6. HIPAA & Protected Health Information

6.1 Our Role Under HIPAA

Sanolume acts as a Business Associate under HIPAA when we process PHI on behalf of healthcare organizations (Covered Entities). In this capacity, we are bound by the requirements of the HIPAA Privacy Rule (45 C.F.R. Part 164, Subparts A and E) and the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C), as made applicable to Business Associates by the HITECH Act (42 U.S.C. §§ 17931–17940).

6.2 Business Associate Agreement

Before we process PHI for any Covered Entity, we execute a Business Associate Agreement (BAA) that specifies the permitted uses and disclosures of PHI, our security obligations, breach notification procedures, and the rights and responsibilities of each party. The BAA governs our handling of PHI and takes precedence over this Privacy Policy in the event of any conflict.

6.3 Administrative Safeguards

• Designated privacy and security officer
• Workforce access limited to the minimum necessary for job functions
• Security awareness and training for all personnel with access to PHI
• Incident response and breach notification procedures
• Regular risk assessments and policy reviews

6.4 Physical Safeguards

• All PHI is stored in AWS data centers that maintain physical security controls, including 24/7 monitoring, biometric access controls, and environmental protections
• AWS data centers are SOC 1/2/3, ISO 27001, and HIPAA-compliant
• No PHI is stored on Sanolume-owned physical servers or facilities

6.5 Technical Safeguards

• Encryption at rest: On-device data encrypted with SQLCipher (AES-256) with keys stored in the Android Keystore using AES-256-GCM; cloud data encrypted with AWS KMS-managed keys
• Encryption in transit: All data transmitted over HTTPS/TLS 1.2 or higher
• Access controls: Role-based access, multi-tenant data isolation (data filtered by user ID and organization ID), session timeouts (30-minute inactivity standard, 24-hour inactivity for persistent sessions)
• Authentication: AWS Cognito with optional biometric authentication and configurable multi-factor authentication (MFA)
• Audit logging: Comprehensive audit trail of all significant actions, with entity snapshots, retained for a minimum of six (6) years
• PII masking: Email addresses and other PII are masked in application logs
• Push notifications: No PHI is included in push notification payloads — notifications use generic text (e.g., “A document has been signed and is ready for review”)

6.6 Breach Notification

In the event of a breach of unsecured PHI, we will:

• Immediately investigate and contain the incident
• Notify the affected Covered Entity without unreasonable delay and no later than sixty (60) days after discovery, as required by 45 C.F.R. § 164.410
• Provide the Covered Entity with sufficient information to fulfill its notification obligations to affected individuals and to the U.S. Department of Health and Human Services (HHS)
• Cooperate fully with the Covered Entity’s breach response efforts
• Document the breach and corrective actions taken

6.7 AWS Business Associate Agreement

We have executed a Business Associate Agreement with Amazon Web Services (AWS) via AWS Artifact. This BAA covers all HIPAA-eligible AWS services that we use, including but not limited to Amazon DynamoDB, Amazon S3, AWS Lambda, Amazon API Gateway, Amazon Cognito, Amazon SES, AWS KMS, Amazon CloudWatch, and AWS CloudTrail.

7. Legal Bases for Processing

We process your information on the following legal bases:

• Performance of a contract: Processing necessary to fulfill our obligations under our Terms of Service, subscription agreements, and Business Associate Agreements.
• Legitimate interests: Processing necessary for our legitimate business interests, including service improvement, fraud prevention, and security, where those interests are not overridden by your rights and freedoms.
• Compliance with legal obligations: Processing necessary to comply with HIPAA, the HITECH Act, tax laws, and other applicable legal requirements.
• Consent: Where required by applicable law, we obtain your consent before processing your information. You may withdraw consent at any time, though withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

8. Information Sharing & Disclosure

We do not sell, rent, lease, or trade your Personal Information or PHI. We share information only in the following limited circumstances:

8.1 With Your Organization

If you use Sanolume as part of an organization (employer, agency, or practice), your organization’s administrator may have access to your account information, subscription status, and — depending on the organization’s data-sharing model — clinical data that you create within the organization’s context.

8.2 With Service Providers (Sub-Processors)

We use trusted third-party service providers to help operate our Services. These providers are contractually obligated to protect your data, use it only for the purposes we specify, and comply with applicable data protection laws. See Section 9 for a complete list.

8.3 With E-Signature Recipients

When you send a document for electronic signature, the signer will receive the document name and your name and email address. The signed document may be delivered to you and to any other designated completion recipients.

8.4 For Legal Compliance

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, including:

• To comply with a subpoena, court order, or other legal process
• To respond to a request from a law enforcement agency or regulatory authority
• To protect the rights, property, or safety of Sanolume, our users, or the public
• To enforce our Terms of Service

Where permitted by law, we will attempt to notify you before disclosing your information in response to a legal request.

8.5 Business Transfers

If Sanolume is involved in a merger, acquisition, reorganization, asset sale, or bankruptcy proceeding, your information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our Website before your information becomes subject to a different privacy policy.

8.6 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

9. Sub-Processors & Third-Party Services

The following third-party service providers process data on our behalf. Each operates under contractual obligations to protect your data.

We maintain an up-to-date list of sub-processors, and we will notify customers of any changes to this list before engaging a new sub-processor. We do not use any advertising or cross-site tracking services. Our only analytics sub-processor is Umami, a privacy-focused tool that collects anonymous, aggregated pageview data without cookies or personal information.

10. Data Security

We implement comprehensive administrative, technical, and physical security measures to protect your information. While no system can guarantee absolute security, we employ industry-leading practices, including:

• Encryption at rest: AES-256 encryption via SQLCipher (mobile device), AWS KMS (cloud databases and object storage)
• Encryption in transit: TLS 1.2+ for all data transmission; HTTPS enforced on all endpoints
• Key management: Encryption keys managed by AWS Key Management Service (KMS); mobile encryption keys stored in the hardware-backed Android Keystore
• Access controls: Principle of least privilege; IAM policies scoped to individual Lambda functions; multi-tenant data isolation at the query level
• Authentication: Secure password hashing, optional biometric authentication, configurable multi-factor authentication (MFA)
• Session management: Configurable session timeouts (default: 8-hour duration with 30-minute inactivity timeout; extended sessions: 30-day duration with 24-hour inactivity timeout)
• Network security: AWS WAF (Web Application Firewall) rate limiting on API endpoints; DDoS protection via AWS Shield
• Security headers: Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options (DENY), X-XSS-Protection on all web responses
• Monitoring: AWS CloudTrail for infrastructure audit logging; CloudWatch for application monitoring; automated alerts for anomalous activity
• Soft deletion: Data is logically deleted (marked with a deletion timestamp) rather than immediately purged, preventing accidental data loss while maintaining audit integrity

11. Data Retention & Deletion

We retain your information only for as long as necessary to fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are as follows:

Deletion requests: You may request deletion of your Personal Information at any time by contacting us (see Section 21). We will process your request within thirty (30) days, subject to our legal retention obligations. Note that certain data (such as audit log entries that reference your actions) may be retained in anonymized or pseudonymized form as required by HIPAA.

Organization data: If you are part of an organization, your administrator controls the retention of clinical data created within the organization. Contact your administrator for organization-specific retention policies.

12. Cookies & Tracking Technologies

Our Website does not use cookies for analytics, advertising, or behavioral tracking.

Our Website uses Umami, a privacy-focused analytics tool, to understand general usage patterns (e.g., which pages are visited and how often). Umami:

• Does not set any cookies
• Does not collect or store personal data or IP addresses
• Does not track users across sites or sessions
• Derives unique-visitor counts from a non-reversible, daily-rotating hash that cannot be used to identify individuals
• Collects only: page path, referrer URL, browser type, device type, screen size, and country

Our Website may also use the following strictly necessary technologies:

• Session cookies: Temporary cookies that enable core website functionality (e.g., maintaining login state if you access authenticated areas). These expire when you close your browser.
• Security tokens: CSRF protection tokens and similar security mechanisms required for form submissions.

We do not use:

• Invasive analytics platforms (Google Analytics, Mixpanel, etc.)
• Advertising or retargeting cookies
• Social media tracking pixels
• Fingerprinting or cross-site tracking technologies
• Local storage or session storage for tracking purposes

13. Children’s Privacy

Our Services are designed for use by licensed healthcare professionals and are not directed to individuals under the age of 18. We do not knowingly collect Personal Information from children under 18. If you are a parent or guardian and believe that your child has provided us with Personal Information, please contact us immediately at privacy@sanolume.com. Upon verification, we will promptly delete such information from our systems.

Note: Patient records entered by healthcare professionals may include information about minor patients. Such information constitutes PHI and is governed by HIPAA, not the Children’s Online Privacy Protection Act (COPPA), as it is entered by the healthcare professional — not by the minor.

14. International Data Transfers

Our Services and infrastructure are hosted in the United States. If you access our Services from outside the United States, your information will be transferred to, stored, and processed in the United States. By using our Services, you consent to this transfer.

For users subject to the GDPR or other international data protection laws, we will ensure that appropriate safeguards are in place for any transfer of Personal Information outside the European Economic Area (EEA), United Kingdom, or Switzerland, including Standard Contractual Clauses (SCCs) approved by the European Commission where required.

15. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your Personal Information:

• Right to access: Request a copy of the Personal Information we hold about you.
• Right to correction: Request correction of inaccurate or incomplete Personal Information.
• Right to deletion: Request deletion of your Personal Information, subject to our legal retention obligations.
• Right to data portability: Request a copy of your data in a structured, commonly used, machine-readable format.
• Right to restrict processing: Request that we limit the processing of your Personal Information under certain circumstances.
• Right to object: Object to the processing of your Personal Information based on our legitimate interests.
• Right to withdraw consent: Withdraw any previously given consent at any time.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, please contact us at privacy@sanolume.com. We will respond to your request within thirty (30) days (or sooner as required by applicable law). We may need to verify your identity before processing your request.

PHI access requests: If your request pertains to PHI, it may be subject to the HIPAA access provisions (45 C.F.R. § 164.524). Please contact your healthcare organization (the Covered Entity) directly, as they control access to PHI. We will assist the Covered Entity in fulfilling your request.

16. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), provides you with additional rights regarding your Personal Information.

16.1 Categories of Personal Information Collected

In the preceding twelve (12) months, we have collected the following categories of Personal Information as defined by the CCPA:

• Identifiers: Name, email address, IP address, account identifiers
• Professional information: Discipline, credentials, license numbers, organizational affiliation
• Internet or electronic network activity: Web server logs, session data, device tokens
• Commercial information: Subscription tier, payment transaction records

Note: PHI that is collected and maintained in compliance with HIPAA is exempt from the CCPA (Cal. Civ. Code § 1798.145(c)(1)(A)).

16.2 Your CCPA Rights

• Right to know: You may request disclosure of the categories and specific pieces of Personal Information we have collected about you, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: You may request deletion of your Personal Information, subject to certain exemptions (e.g., legal compliance, ongoing service obligations).
• Right to correct: You may request correction of inaccurate Personal Information.
• Right to opt out of sale/sharing: We do not sell or share (as defined by the CCPA) your Personal Information and have not done so in the preceding twelve (12) months.
• Right to limit use of sensitive Personal Information: You may request that we limit our use of sensitive Personal Information to purposes necessary to provide our Services.
• Right to non-discrimination: We will not deny services, charge different prices, or provide a different level of service based on your exercise of CCPA rights.

16.3 How to Exercise Your Rights

You may submit a verifiable consumer request by emailing privacy@sanolume.com or by using our contact form. You may also designate an authorized agent to submit requests on your behalf, provided the agent submits proof of authorization. We will respond within forty-five (45) days, with the possibility of a forty-five (45) day extension if necessary, with notice to you.

16.4 Disclosure of Personal Information for Business Purposes

We disclose Personal Information to our service providers (listed in Section 9) solely for business purposes. We do not disclose Personal Information in exchange for monetary or other valuable consideration.

16.5 Financial Incentives

We do not offer any financial incentives or price differences in exchange for the collection, retention, or sale of Personal Information.

17. Other U.S. State Privacy Rights

Several other U.S. states have enacted comprehensive privacy laws, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and others. If you are a resident of one of these states, you may have similar rights to those described in Sections 15 and 16, including the right to access, correct, delete, and obtain a portable copy of your data, and in some states, the right to opt out of targeted advertising, profiling, and sale of personal data.

We do not engage in targeted advertising, profiling for decisions that produce legal or similarly significant effects, or sale of personal data. To exercise your rights under any applicable state privacy law, please contact us at privacy@sanolume.com. If we deny your request, you may have the right to appeal our decision, and we will provide instructions for doing so.

18. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent local legislation provide you with additional rights regarding your personal data.

• All rights listed in Section 15 apply.
• Right to lodge a complaint: You have the right to lodge a complaint with your local supervisory authority (Data Protection Authority).
• Data Protection Officer: You may contact our designated privacy contact at privacy@sanolume.com for any GDPR-related inquiries.
• Data transfers: See Section 14 regarding international data transfers and safeguards.

Legal bases: See Section 7 for the legal bases under which we process your personal data.

19. Do Not Track Signals

Some web browsers transmit “Do Not Track” (DNT) signals. Because there is no universally accepted standard for how to respond to DNT signals, we do not currently respond to them. However, as described in Section 12, we do not engage in cross-site tracking or behavioral profiling, and our only analytics tool (Umami) is cookie-free and collects no personal data, so our data practices are consistent with the intent of DNT signals regardless.

20. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes:

• We will update the “Last updated” date at the top of this page.
• For material changes (e.g., new categories of data collected, new third-party sharing, changes to HIPAA practices), we will notify you by email and/or by a prominent notice on our Website at least thirty (30) days before the changes take effect.
• For non-material changes (e.g., clarifications, formatting), we will update this page without separate notice.

Your continued use of our Services after the effective date of any changes constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Policy, you must stop using our Services and may request deletion of your data.

21. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within thirty (30) days. For requests related to HIPAA or PHI, please also contact your healthcare organization’s privacy officer.