Privacy Policy

I am Sandra Golaszewski, DNP, APRN, CNM, the sole owner and operator of AVENORA HEALTH PLLC dba Birth Science Unpacked (referred to below as "Birth Science Unpacked" or "BSU"). I operate the Birth Log web application at https://birthlog.birthscienceunpacked.com (the "Service").

This Privacy Policy explains what information I collect through the Service, how I use it, and your rights regarding that information. I am a solo operator; when this policy says "I" it means me personally, and when it says "BSU" it refers to my business.

The Service is a free clinical documentation tool for certified nurse-midwives (CNMs) and other advanced practice providers. Users create their own accounts and enter clinical practice records for their personal use.

By using the Service, you agree to the collection and use of information in accordance with this Policy.

1. Information I Collect

1.1 Information You Provide Directly

When you sign up for and use the Service, I collect:

• Account information: your email address and, depending on your sign-in method, your name and profile image as provided by your authentication provider (Google, Microsoft, or Apple).
• Authentication credentials: for email/password sign-in, your password is stored using industry-standard hashing. I do not store passwords in plaintext. For third-party sign-in (Google, Microsoft, Apple), I receive an authentication token from the provider; I do not receive or store your third-party account password.
• Clinical documentation you enter: records you create in the Delivery Log, Credentialing File, First Assist Log, and Provider & Credentialing Summary. This may include your professional credentials (license numbers, AMCB certification number, expiration dates), practice metrics, and de-identified case records.
• Communications: if you email me at support@birthscienceunpacked.com or otherwise contact me, I receive and may retain the contents of those communications.

1.2 Information Collected Automatically

When you access the Service, my hosting and infrastructure providers may automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages or screens viewed within the Service
• Date and time of access
• Session identifiers

This information is used for security, fraud prevention, system performance, and basic service operation.

1.3 Information I Do Not Collect and What You Must Not Enter

The Service is a personal documentation tool for licensed clinicians. It is not a medical record, electronic health record, or patient management system.

You must not enter patient names, medical record numbers (MRNs), dates of birth, or any other Protected Health Information (PHI) into the Service. Patient identifier fields are labeled for initials or coded IDs only. The de-identification notice appears on the login screen and within the app to reinforce this requirement.

If you enter identifiable patient information into any field, you remain solely responsible for compliance with HIPAA, state privacy laws, and any applicable institutional policies. I accept no liability for user-entered content that violates these obligations.

2. How I Use Your Information

I use the information I collect to:

• Create and maintain your user account
• Authenticate you and secure your access to the Service
• Store and display the clinical records you create for your personal use
• Send transactional emails (verification codes, password resets, account confirmation notices, account deletion confirmations)
• Respond to your support requests
• Detect, prevent, and address security issues, fraud, and technical problems
• Comply with legal obligations
• Improve and develop the Service

I do not sell your personal information. I do not share your personal information with third parties for their marketing purposes. I do not use your clinical records for training machine learning models.

3. Data Isolation and Access

The Service uses Row Level Security to enforce strict data isolation between accounts. Each user can only view, edit, or export their own clinical records. Other users of the Service cannot access, view, or query your data.

As the sole operator, I have technical ability to access user data stored on the Service's infrastructure, but I do not routinely do so. I access user data only when responding to a specific support request from that user, or when required by legal obligation. I do not review, analyze, or share individual user clinical records.

4. Third-Party Service Providers

I rely on the following service providers, each of which has access to limited information necessary to perform their functions:

• Base44 provides hosting and application infrastructure for the Service. Application data, including account information and clinical records you enter, is stored on Base44's infrastructure.
• Google, Microsoft, and Apple provide optional third-party sign-in. When you use these methods, the provider authenticates you and shares limited profile information (email, name) with the Service. Their handling of your data is governed by their own privacy policies.
• Postmark processes transactional emails sent from the Service, including account verification, password resets, and account deletion confirmations.
• Cloudflare provides DNS, security, and content delivery infrastructure for the website.
• Google Workspace is used to send and receive email correspondence at my birthscienceunpacked.com domain addresses.

These providers are contractually obligated to handle information securely and only for the purposes for which I engage them.

5. Data Retention

I retain your account information and clinical records for as long as your account is active. You control your data through the Service and can export it at any time using the CSV export functions in each log.

You may delete your account at any time through the account settings within the Service. Upon confirmed deletion request:

• Your clinical records (deliveries, credentials, first-assist cases, and profile) are permanently and immediately deleted, with no recovery period.
• Your login credentials are deactivated. You cannot sign into the account again through any sign-in method.
• Due to platform limitations, an anonymized user shell may remain in the database. This record contains no personally identifiable clinical content and cannot be used to log in.

A confirmation email is sent to your registered email address before deletion is executed. A final email is sent after deletion to confirm the action.

You may also request deletion by emailing support@birthscienceunpacked.com. Upon verified request, I will process your deletion within a reasonable timeframe, subject to legal retention requirements.

6. Data Security

I implement reasonable technical and organizational measures designed to protect your information against unauthorized access, alteration, disclosure, or destruction. These include:

• HTTPS encryption in transit
• Row Level Security enforcing per-user data isolation at the database level
• Password hashing (never plaintext storage)
• HTTP security headers including X-Frame-Options (clickjacking protection) and Permissions-Policy
• Reliance on Base44's managed infrastructure with SOC 2 certification
• Multi-provider authentication supporting strong sign-in methods including Google, Microsoft, and Apple

No method of electronic storage or transmission over the internet is 100% secure. I cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have rights regarding your personal information, including:

• Access: request a copy of the personal information I hold about you.
• Correction: request correction of inaccurate information.
• Deletion: delete your account and associated information at any time through the Service, or request deletion by email.
• Portability: export your clinical records in CSV format at any time using the export functions within the Service.
• Withdraw consent: stop using the Service and delete your account.

To exercise these rights, use the in-app account settings or email me at support@birthscienceunpacked.com from the email address associated with your account. I will respond within 30 days.

If you are a resident of California, the European Economic Area, the United Kingdom, or another jurisdiction with specific privacy laws, additional rights may apply. Contact me for jurisdiction-specific requests.

8. Cookies and Similar Technologies

The Service uses cookies and similar technologies that are strictly necessary to operate the Service, including session cookies for authentication and security. I do not use cookies for advertising or cross-site tracking. By using the Service, you consent to the use of these strictly necessary cookies.

9. Children's Privacy

The Service is intended for use by licensed healthcare professionals and is not directed to children under 18. I do not knowingly collect personal information from anyone under 18. If I learn that I have collected information from a child under 18, I will delete it.

10. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.

11. Not a Medical Record

The Service is a personal documentation and credentialing tool, not a legal medical record. It is not a substitute for institutional documentation systems, electronic health records, or medical charts. Users should follow their institutional and state requirements for official patient records. I am not responsible for use of the Service as a substitute for institutional systems.

12. Changes to This Policy

I may update this Privacy Policy from time to time. When I do, I will update the "Last Updated" date at the top of this Policy. If changes are material, I will provide notice through the Service or by email to your registered email address. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

13. Contact Me

For questions, concerns, or requests regarding this Privacy Policy or your personal information, contact: