Privacy

What Binderkit holds, and what leaves it.

Written in the same words as the product. If a sentence here and a screen in the application disagree, the screen is the bug.

Protected health information

None. There is no field in this product that can hold a name, a date of birth, a diagnosis or a finding about a person.

Personal information

Your own account: an email address, and your membership of an organisation and its facilities.

Public

Six tables — the rule libraries, the templates and the plans, keyed by facility code.

Where it lives

Records are held in Convex, in the United States, under an executed business associate agreement. Payment is taken by Stripe, and Stripe holds the card — we never see a card number. Transactional email is sent through Resend. Those three, and nothing else, are the processors this product depends on.

This product holds no protected health information, so there is no Customer business associate agreement to sign — which is why its signup is five steps rather than six. There is nothing here to protect that would need one.

What leaves the product

Egress is the part of a privacy notice that usually goes unwritten. Here it is, channel by channel.

Printing: Generated as a PDF inside the product and then downloaded or shared, never handed to the browser’s print dialog. The identity line prints blank and you complete it by hand.
Logs: The Convex dashboard only. No third-party log destination.
URLs: Opaque short-codes. A link cannot be read for a name.

This website

If you join the early-access list, this site stores the email address you typed, a phone number if you gave one, the licence track and the house count you picked, the product you were reading about, and the time you sent it. There is no analytics script, no advertising pixel and no third-party tag on this page. We write to you once, when the product opens. Reply to that message and we delete the row.

Cookies, and what is kept on your device

Before you answer, one thing can be kept: the theme or text size you picked, if you changed either. Everything else below waits for a yes, and saying no keeps nothing but the no.

pho-consent: A cookie holding your answer to that question and nothing else — the word all or the word min. It lasts a year so you are not asked on every visit, and it is set whichever way you answer, because a site that forgot your refusal would have to ask again.
pho-mode · pho-text: Your dark-mode and text-size choices, kept in this browser's local storage so the page opens the way you left it. Not cookies, and never sent to a server.
pho-draft: Only if you said yes. A copy of whatever you have typed into a form and not yet sent, so a refresh or a wrong tap does not lose it. It stays in this browser, is never sent anywhere on its own, and is deleted the moment the message sends. Say no and it is never written.

None of it identifies you to us, follows you to another site, or is shared with anyone. Clearing this browser’s site data removes all of it, and you are simply asked again.

Your rights

You can export everything the product holds for your organisation, at any time, from inside the product — and after a cancellation you can still sign in to export before anything is purged. Ask us to delete a record and we delete it; the audit log of who did what is retained, because a record that can be quietly removed is not an audit log.

The full Terms of Service and, where one applies, the Customer business associate agreement are presented at signup, in full, and a copy is kept in your account. This page summarises what the product does; it does not replace those documents.

Back to Binderkit