Skip to content
Astrea Labs
Legal

Privacy notice

This notice covers this website and the Aletheia beta application. The Aletheia app's own data handling is covered by the Aletheia Privacy Policy. This website never receives patient or client data, and you should never send any.

What we collect

Aletheia beta application and license

  • Your application answers: name, professional email, credential, license numbers and states, NPI (if you give it), supervisor (if you are pre-licensed), practice details, the practice categories you tick, your Mac's chip and macOS version, and anything you write in the free-text boxes.
  • The disclosures and attestations you were shown: text version, a SHA-256 fingerprint of the wording, and the time you ticked each one.
  • Signing evidence: your typed signature, when you confirmed your email and signed, the signed PDF, and your IP address and browser user agent at signing and again when you confirm your license at renewal.
  • Our review: the decision, the result and date of our license check, and notes. If you are approved, your license ID, its dates and any revocation. We do not store the key itself.
  • A log of the emails we send (address, subject, type and time). Emails that contain a single-use link or your application answers are logged without their content.
  • A session cookie, beta_session, while you sign or open your key link. It lasts one to two hours.

When you sign, we email our reviewer a copy of your answers and the consents you ticked, so the application can be decided.

Accounts, feedback and the forum

  • Optional account: sign-in runs on Auth0 with a one-time code by email. We store your email, your Auth0 ID and your email preferences. Auth0 sets a session cookie while you are signed in.
  • Account invites: when we approve an application we email an invite to create an account. We store the invited email, the application it belongs to, a hash of the invite token, its expiry and when it was used.
  • Forum profile: your email (visible to staff only), username, handle and display setting, with your Auth0 ID.
  • Release and campaign emails: only if you opt in, we send lab news or product and release updates. We keep your opt-in choices and the time you made them, and a log of campaign sends.
  • Feedback: the email and report you submit. We email you a confirmation link and review each report before it is posted as a public GitHub issue. Your email address is not posted.
  • Forum: members only. We store your posts, votes and reports against your Auth0 ID, not your IP address.

Everyone

Our hosting provider keeps standard request logs, including IP addresses, for a short time. Vercel Web Analytics counts page views on this site. It is switched off on the beta application and key pages and on admin pages, and it never records query strings. We do not use ad pixels or session replay. Vercel BotID checks your browser on forms to stop automated sign-ups.

Who processes it

  • Vercel: hosting, private file storage for signed documents, the keys that seal them, Web Analytics and BotID.
  • Neon: the database.
  • Resend: sending email. Resend also keeps its own log of mail it sends, under its own retention policy.
  • Auth0: optional account sign-in.
  • GitHub: feedback reports that you submit and we approve.

We do not sell your data or use it for advertising.

How long we keep it

  • Unsigned applications: deleted after about 7 days.
  • Signed applications, our review, license records and signing evidence: for at least the term of the license plus six years. If an application is declined, for at least six years from the decision. Nothing deletes them automatically. The signed documents, review decisions and acceptance records are locked in the database against edits and deletion: a correction is added as a new record, and we cannot delete them on request during that period. We also use them to check any later application from you.
  • Email log, including failed sends: deleted after about 90 days.
  • Feedback you did not confirm: deleted after about 7 days. Confirmed reports are kept until we remove them; a published GitHub issue stays on GitHub.
  • Account, email preferences and forum content: until you ask us to delete them.

Your rights and contact

You can ask us for a copy of your data, for corrections, or for deletion of anything not covered by the retention period above, and you can unsubscribe from release and campaign emails. Emails about your application, key and account are sent only as needed. Write to support@astrealabs.com.