1. Who this policy covers
This policy explains how Healthcare Integration Academy, operating the HL7APP educational website at www.hl7app.com, handles information about visitors, learners and people booking training sessions. Contact the website operator at rohityahoooo@gmail.com about privacy matters.
2. Information we collect
- Account and profile: your email, account identifier, name, optional profile details such as a phone number, and communication preferences. Authentication is handled through Supabase; email/password accounts and Google sign-in are supported.
- Learning activity: lesson completion, answers, quiz attempts, scores and learning progress. Some activity is saved in your browser; supported progress is synchronized to your signed-in account.
- Purchases: Stripe customer, checkout, subscription and payment references, product, payment status and access period. Stripe collects payment-card details through its checkout; our application does not store full card numbers or card security codes.
- Support and bookings: messages, feedback, associated account information, purchase references and scheduling information you provide. Topic conversations are private to the learner and authorized instructors/administrators, not other learners. Messages are stored to provide support; they are not end-to-end encrypted. Do not send patient records or credentials.
- Technical activity: pages visited, timestamps, a hashed browser-session identifier for page-view statistics, and error details such as page URL, browser information and diagnostic messages. Hosting and security providers may also process IP addresses and request logs.
3. Google sign-in
If you choose Continue with Google, Google and Supabase provide identity information needed to authenticate you, such as your Google account identifier, email address, name and profile image when supplied. We use it to create or sign you into your learner account, associate your progress and access, and support your account.
The current sign-in integration does not request access to your Gmail messages, Google Drive files, contacts or calendar contents. A separate Google Calendar booking page is used only when you choose to schedule a meeting.
We do not sell Google sign-in data, use it for advertising, or use it to train generalized AI models. You can revoke the connection in your Google Account third-party connections settings; this does not itself delete your HL7APP account or cancel a paid subscription.
4. How we use information
We use information to operate and secure accounts, provide courses and progress tracking, verify payment and access, arrange sessions, answer support requests, investigate errors and abuse, and understand which pages are used. Purchase and account records also support accounting, dispute handling and legal obligations.
Marketing preferences are separate from necessary account and service messages. You can change your marketing preference in account settings or contact us to withdraw it. We do not sell your personal information or use the website's page-view statistics for third-party advertising.
5. Service providers and sharing
Information is handled by providers needed to deliver the service: Supabase for accounts and cloud records, Vercel for hosting and technical operations, Stripe for payments and subscription management, and Google when you select Google sign-in or use its scheduling page. When session-email delivery is enabled, Resend processes the email content needed to send booking and payment alerts.
The instructor receives the contact and purchase information needed to arrange paid sessions. Authorized administrators can review relevant account, subscription, progress and support records to operate the service. Information may also be disclosed when required by law or reasonably necessary to address fraud, security incidents or legal claims.
When you book and pay through Google Calendar, information you enter on its booking form is handled by Google and its Stripe payment integration. Those bookings are not automatically synchronized to the website's earlier payment history. Use Google's confirmation and your Stripe receipt for that appointment.
Providers may process information outside your province or country, including in the United States, where different laws may apply. Their own privacy policies also describe their processing. We do not promise that all information remains in Canada.
6. Cookies, browser storage and security
Authentication cookies maintain your signed-in session. Local storage saves learning activity on your device, and session storage records a temporary visit identifier and pages counted during that browser session. Clearing storage can remove unsynchronized progress; blocking necessary cookies can prevent sign-in. Payment and identity providers may use their own cookies on their services.
We use access controls, encrypted web connections and provider security features to help protect information. No website or transmission is completely secure. Keep your credentials private and report suspected account misuse to us.
7. Retention and deletion
Account and learning records are retained to provide the service while your account is maintained. Payment, support, diagnostic and security records may be retained longer where needed for accounting, legal requirements, disputes or security. Retention depends on the record and its purpose; we do not claim an automatic deletion deadline that the system does not implement.
Contact us to request account deletion or removal of information no longer needed. We may first verify account ownership, explain any records that must be retained, and coordinate the effect on active subscriptions. Deleting an account or disconnecting Google is not a substitute for cancelling subscription renewals. Backups and service-provider records may remain until their retention cycles expire.
8. Your choices and privacy requests
You can review your profile and marketing preferences in account settings. Email rohityahoooo@gmail.com to request access, correction, a copy, deletion, or information about how your data is handled, or to raise a privacy concern. Use the email associated with your account where possible; do not send identity documents unless a secure verification method has been agreed.
We assess requests under applicable privacy requirements and explain any limitations, such as records needed for legal obligations or another person's privacy. You may also contact the privacy regulator relevant to your location. Withdrawing permission for information necessary to provide an account may limit those services.
9. Patient information and young users
This is a professional education service, not a patient-care system. Do not submit real patient records, protected health information, passwords or confidential employer data in examples, quizzes, feedback or meetings. The service is not directed to children under 13; if you believe a child has provided personal information, contact us so we can investigate and address it.
10. Policy changes
We update this page when relevant practices change and revise the date above. Material changes will be brought to users' attention as appropriate, and additional consent will be sought where required. A policy update does not authorize unrelated use of previously collected information.