Privacy Policy

Schema Care is a trade name of Swift Parse LLC, a California limited liability company ("Schema Care", "we", "us"). This Privacy Policy explains what personal information we collect through the website at schemacare.com and the app at app.schemacare.com, why, and what choices you have.

This policy covers information about visitors to our website and about the people who hold Schema Care accounts.

It does not cover the medical records and other files that customers upload to the app, or the results the app produces from them. We process those on behalf of the customer, under the customer's agreement with us: our Terms of Service at schemacare.com/terms and, for protected health information, the Business Associate Agreement the customer signs. If your information is in a record a customer uploaded, the customer decides how it is used, and you should contact the customer about it.

When you visit the marketing site and blog, our analytics script sends Copper Analytics the address of the page you view, the address of the page that sent you there, and the width of your browser window. Like any web request, it also reaches Copper with your IP address and browser details. We use this to count visits and see which pages are useful. The script does not run on sign-in, account or dashboard pages.

When you create an account or sign in, we collect:

• your email address, and, if you sign in with Google or JustAuth, the name and profile picture that provider shares, and the provider's sign-in tokens;
• how you signed in and when, and a record of each session;
• your authenticator app secret, stored encrypted, and your recovery codes, stored only as hashes, with a record of failed codes;
• your workspace, your role in it, the matters you are granted, and invitations you send, including the invitee's email address; and
• a log of what you do in the app, such as opening a matter, reviewing a fact, changing settings or managing your team, with the time.

When an owner or admin signs a Business Associate Agreement in the dashboard, we record their name, title and organization, the time, the agreement version and a fingerprint of its text, and the IP address and browser details they signed from. This is the record of the agreement.

When you email a schemacare.com address, we receive your message, your email address and anything you include. When you ask for a sign-in link, we email it to you.

Our servers keep operational logs of events and errors. They identify accounts and records by id only, never by name, email or record content.

We use this information to provide and secure the Service, sign you in, keep the audit trail customers rely on, answer you, and meet our legal obligations. We do not use it for advertising.

The app sets cookies that sign-in needs: a session cookie, a cookie that protects sign-in forms against forgery, and short-lived cookies that carry you through a Google or JustAuth sign-in. In the dashboard, a small cookie tells the server when a page refreshed itself rather than being used, so that idle sessions end on time. The app also keeps a marker in your browser's local storage so that one sign-in is counted once.

The analytics script on the marketing site sets no cookies. It reads one setting from your browser's local storage that lets us exclude our own visits.

We do not use advertising cookies or tracking pixels, and we do not let advertising networks place cookies through our site.

We do not sell personal information. We do not share it for cross-context behavioral advertising, and we do not use it to profile you.

The app reads uploaded records with Amazon Textract and pulls out facts with Claude, an AI model, through Amazon Bedrock, inside our AWS account. Schema Care does not use customer records, or the results produced from them, to train, fine-tune or evaluate any AI model.

Our AWS account that processes records is opted out of AWS using customer content to improve its AI services. Amazon Bedrock is set to retain no prompts or responses in the US regions we use, and Bedrock's own logging of model requests is turned off.

We share personal information only with service providers that help us run Schema Care, only for that purpose:

• Amazon Web Services, which hosts the website and app and provides file storage, text extraction, AI model access, email delivery and logs;
• our database hosting provider, which stores account and workspace data;
• Google and JustAuth, if you choose them to sign in;
• Copper Analytics, for website visit counts;
• an AI model provider, used only for files marked as synthetic test data; and
• our email provider, which holds the messages you send us.

We may also disclose information when the law requires it, to protect the rights, safety or security of our customers, the public or Schema Care, or as part of a merger or sale of our business, in which case this policy continues to apply to it.

• Account information is kept while your account is open. After an account closes, we delete it within 30 days, except as listed below.
• Audit log entries are kept for six years, because customers and the law rely on them. They carry ids, not record content.
• Business Associate Agreement signature records are kept as long as they are needed as evidence of the agreement.
• Operational logs are kept for one year.
• Email you send to a schemacare.com address is stored by our mail system for 30 days, and the forwarded copy is kept in our mailbox until we delete it.
• Records customers upload are kept for the period the customer's workspace sets, from 1 to 3,650 days, 90 by default, and deleted with all their results when that period ends or the customer's account ends.

Stored file versions and backups expire on their normal schedule after deletion. We keep information longer when the law requires it or under a legal hold.

We protect personal information with measures such as encryption in transit and at rest, multi-factor sign-in, short sessions, role-based access and an audit log. The page at schemacare.com/compliance describes what is in place and what is not done yet.

No system is perfectly secure. Schema Care has not been independently audited or certified, and has no SOC 2 report. Please report a security issue to security@schemacare.com.

Wherever you live, you may ask us to:

• tell you what personal information we hold about you, where it came from, and who we share it with;
• give you a copy of it;
• correct it; or
• delete it.

California residents have these rights under California law, and we offer them to everyone, without deciding whether a particular law applies to us. Write to security@schemacare.com from the email address on your account, or tell us how to reach you if you have no account. We will confirm your identity before acting, and answer within 45 days. You may use an authorized agent, who must show us your written permission.

We may keep information we are required to keep, such as audit log entries and signed agreement records, and we will tell you when we do. We will not treat you differently for using these rights.

If your information is in a record a customer uploaded, we will pass your request to that customer, who decides how to respond.

Our website does not change what it does in response to Do Not Track or Global Privacy Control signals. Because we do not sell personal information or share it for advertising, there is no sale or sharing for those signals to stop. To keep our analytics script from counting your visits, you can block it in your browser.

Schema Care is a business service and is not directed to anyone under 18. We do not knowingly collect personal information from children through the website or accounts. If you believe a child has given us personal information, write to security@schemacare.com and we will delete it.

Schema Care is based in the United States. The app and its data are hosted on Amazon Web Services in the United States, in the us-west-2 (Oregon) region, and AI requests may be served from other AWS regions in the United States. If you use Schema Care from outside the United States, your information is transferred to and processed in the United States.

We may update this policy. The version number and the "Last updated" date at the top of this page change with every update. If we make a material change, we will tell account holders by email or in the dashboard before it takes effect.

Privacy requests and questions go to security@schemacare.com. General questions go to hello@schemacare.com. Please do not email medical records. Neither address is covered by a Business Associate Agreement.