Privacy Policy

Last updated: [[ EFFECTIVE DATE ]]

Draft pending legal review. This document was prepared as a starting template and is not legal advice. Have a qualified attorney review it, and replace every [[ bracketed ]] placeholder, before publishing.

This Privacy Policy explains how Happy Sleepy Time Anesthesia LLC (operating the "Aura Anesthesia" and "Acuitas" brands — "Aura," "we," "us," or "our") collects, uses, shares, and protects information when you use our website, web application, and the free readiness diagnostic (together, the "Service"). By using the Service, you agree to this Policy.

1. Who we are and how to contact us

The Service is operated by Happy Sleepy Time Anesthesia LLC, [[ state of formation, e.g., an Ohio limited liability company ]]. For any privacy question or request, email auraanesthesiasupport@gmail.com.

2. Information we collect

Account information. When you create an account, we collect your email address, a display name (optional), and authentication credentials. Passwords are handled by our authentication provider and stored in hashed form — we never see your plaintext password.
Content you provide. Materials you upload (such as slides, notes, documents, and audio recordings), text you type into the tutor, and study data you generate (quizzes, flashcards, exam dates, and performance/answer history).
Diagnostic responses. The free readiness diagnostic can be taken without an account. We use your submitted answers to compute and show your score; we do not require your name or email to take it.
Usage and device data. Log data such as IP address, browser and device type, pages viewed, and actions taken, collected automatically to operate and secure the Service.
Cookies and local storage. We use strictly necessary cookies and browser local storage to keep you signed in and remember preferences. We do not use third-party advertising or cross-site tracking cookies.

3. How we use your information

Provide, operate, and maintain the Service and your account.
Process the materials you submit to generate quizzes, flashcards, tutor answers, citations, and readiness analytics.
Personalize your study plan, spaced-repetition schedule, and progress.
Communicate with you about your account, updates, and support.
Monitor, secure, debug, and improve the Service.
Improve and develop our AI features. We use de-identified or aggregated information about how you use the Service — such as questions asked, answers given, and performance — to analyze, improve, train, and develop our own AI features. For this purpose we do not use information that identifies you, and we do not use your uploaded materials as verbatim training data. You can opt out of this improvement use at any time in your account settings, or by emailing us. This is separate from our third-party providers, who (per their API terms) do not use content you submit to train their public models.
Comply with legal obligations and enforce our Terms.

4. AI processing and service providers (subprocessors)

To provide core features, we share the content you submit with trusted third-party providers that process it on our behalf. These include:

Supabase — database, file storage, and authentication.
OpenAI — text embeddings used for search and grounding.
Google (Gemini) — generation of quizzes, flashcards, and tutor answers.
Cloudflare — application hosting and content delivery.

These providers act as our processors and are contractually or by their terms limited to processing your content to provide the Service. Based on their published API terms, content submitted through their APIs is not used to train their public models; however, you should review each provider's own policy. We do not sell your personal information. [[ Confirm each provider's current data-use terms and link to their privacy policies. ]]

5. How we share information

We share information only:

with the service providers described above, to operate the Service;
to comply with law, respond to lawful requests, or protect the rights, safety, and security of users, the public, or Aura;
in connection with a merger, acquisition, or sale of assets, in which case we will notify you and this Policy will continue to apply; and
with your consent or at your direction.

6. Data retention and deletion

We retain your account information and content while your account is active. You can delete individual documents and generated content within the app, and you can request deletion of your account and associated data by emailing us. We may retain limited records as required for legal, security, or accounting purposes.

7. Your choices and rights

You may access, update, or delete much of your information within the app, or by contacting us. Depending on where you live, you may have additional rights (for example, to access, correct, delete, or port your data, or to object to certain processing) under laws such as the GDPR or the CCPA/CPRA. To exercise any right, email auraanesthesiasupport@gmail.com. We will not discriminate against you for exercising these rights. [[ Confirm which privacy laws apply to your business and add any legally required disclosures (e.g., a "Do Not Sell/Share" statement, EU representative, or legal bases for processing). ]]

8. Security

We use reasonable administrative and technical safeguards, including encryption in transit, access controls, and per-user database row-level security, to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. No protected health information (PHI)

Aura is an educational study tool, not a clinical system. You must not upload or enter patient-identifiable information or protected health information. We are not a HIPAA "covered entity" or "business associate" and do not offer a Business Associate Agreement. Do not use the Service to store or process any real patient data.

10. Children

The Service is intended for adults (18 and older) preparing for professional certification. It is not directed to children, and we do not knowingly collect information from anyone under 13 (or the minimum age in your jurisdiction). If you believe a child has provided us information, contact us and we will delete it.

11. International users

We operate in the United States, and your information will be processed there and in the regions where our service providers operate. By using the Service you understand your information may be transferred to and processed in the United States. [[ If you serve EU/ UK users, add your transfer mechanism (e.g., Standard Contractual Clauses). ]]

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance.

13. Contact us

Questions about this Policy? Email auraanesthesiasupport@gmail.com.