Privacy Policy

1. INTRODUCTION

BurnAid (“BurnAid”, “we”, “us”, or “our”) is a clinical reference, assessment, documentation, and calculation-support platform designed to assist qualified healthcare professionals in adult and pediatric burn-care scenarios, including burn assessment, burn area mapping, Total Body Surface Area (TBSA) estimation, medication dose calculation support, fluid resuscitation calculation support, nutritional assessment, clinical reporting, and related burn-care activities.

BurnAid is intended to support, not replace, professional clinical judgment, institutional protocols, local standards of care, or applicable legal and regulatory requirements. All outputs generated by BurnAid should be reviewed, validated, and interpreted by the responsible healthcare professional before use in patient care.

This Privacy Policy explains how BurnAid collects, processes, stores, uses, and discloses information when you access or use the BurnAid mobile application, web application, website, and related services (collectively, the “Services”).

By accessing or using BurnAid, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein, subject to applicable law.

2. PRIVACY-BY-DESIGN PRINCIPLES

BurnAid has been designed to minimize the collection and retention of patient-identifiable information wherever reasonably practicable.

Patient names and hospital-assigned patient identifiers are processed only during active assessment and report-generation workflows. BurnAid is designed not to retain direct patient identifiers in stored historical assessment records after completion of the assessment and report-generation process.

Historical assessment records retained by BurnAid are associated with internally generated BurnAid Assessment IDs and clinical assessment information de-linked from direct patient identifiers.

Certain retained assessment information may still constitute health-related information under applicable laws, even when direct patient identifiers have been removed or de-linked.

BurnAid is not intended to function as:

• An Electronic Medical Record (EMR) system
• An Electronic Health Record (EHR) system
• A Hospital Information System (HIS)
• A Patient Registry
• A Long-Term Patient Record Repository
• A Patient Identity Management System

Healthcare organizations remain responsible for maintaining official patient records within their own healthcare information systems.

3. INFORMATION WE COLLECT

3.1 Account Information

When creating or maintaining a BurnAid account, we may collect:

• Full name
• Email address
• Mobile number, if provided
• Hospital, clinic, institution, or organization name
• Professional designation or specialty
• Country and region
• Login credentials and authentication information

3.2 Subscription and Billing Information

When subscribing to BurnAid services, we may collect:

• Subscription plan information
• Billing information
• Country and tax jurisdiction
• Currency information
• Transaction references
• Invoice information
• Payment status
• Subscription history

BurnAid does not store complete credit card numbers, CVV numbers, banking credentials, or other sensitive payment credentials. Payments are processed by authorized third-party payment service providers.

3.3 Device and Technical Information

We may automatically collect:

• Device type and model
• Operating system and version
• Browser type and version
• IP address
• Device identifiers
• Language settings
• Time zone information
• Application version
• Access timestamps
• Diagnostic information
• Error logs and crash reports

3.4 Usage Information

We may collect:

• Features accessed
• Tools utilized
• Session duration
• Usage frequency
• User preferences
• Report generation activity
• Application performance information

4. PATIENT INFORMATION AND CLINICAL DATA

4.1 Information Processed During Assessment

To perform burn assessments and generate reports, healthcare professionals may enter information relating to adult or pediatric patients, including:

• Patient name
• Hospital patient identifier or medical record number
• Sex/Gender
• Height
• Weight
• Age
• Burn location information
• Burn area markings
• Burn depth classifications
• Clinical observations
• Assessment-related information

4.2 Temporary Processing of Patient Identifiers

Patient names and hospital-assigned patient identifiers are processed solely to:

• Conduct patient assessments
• Generate patient-specific reports
• Support clinical workflows during an active assessment session
• Allow user review and validation of reports before export or use

BurnAid is designed not to retain patient names, hospital-assigned identifiers, or medical record numbers within stored historical assessment records after completion of report generation and assessment processing.

4.3 Retained Clinical Assessment Data

BurnAid may retain:

• BurnAid-generated Assessment ID
• Sex/Gender
• Height
• Weight
• Age
• Burn area mapping data
• Burn depth classifications
• TBSA calculations
• Medication dose calculation support outputs
• Fluid resuscitation calculation support outputs
• Nutritional assessment calculation outputs
• Clinical observations
• Clinical reference information and calculation-support outputs
• Assessment timestamps
• User and organization references

Stored historical assessment records are designed not to retain patient names, hospital-assigned patient identifiers, or medical record numbers.

Customers and users acknowledge that retained clinical assessment data, even when de-linked from direct patient identifiers, may still be subject to healthcare privacy, data protection, institutional, or professional confidentiality requirements.

5. CLINICAL RECORDS AND REPORT STORAGE

BurnAid may retain clinical assessment records de-linked from direct patient identifiers to support reporting, analytics, historical review, and application functionality.

Users may generate, download, print, export, or share reports generated from assessment data.

Reports generated during an active assessment may contain patient-identifying information entered by the healthcare professional. Once a report is exported, downloaded, printed, emailed, transmitted, or stored outside BurnAid, responsibility for its protection, storage, transmission, sharing, and retention rests solely with the healthcare professional or healthcare organization.

BurnAid retains historical records using internally generated BurnAid Assessment IDs and is designed not to retain patient names or hospital-assigned identifiers within stored assessment records.

6. HOW WE USE INFORMATION

We may use information to:

• Provide BurnAid services and functionality
• Perform clinical reference, assessment, documentation, and calculation-support functions
• Generate reports and outputs
• Manage subscriptions and billing
• Authenticate users
• Provide customer support
• Monitor platform performance
• Improve product functionality
• Enhance user experience
• Detect fraud, abuse, or unauthorized access
• Maintain system security
• Comply with legal and regulatory obligations

BurnAid does not sell personal information, customer data, or patient-related information.

7. ANALYTICS, DIAGNOSTICS, AND PERFORMANCE MONITORING

BurnAid may use analytics and monitoring tools to understand service performance, improve reliability, maintain security, and improve functionality.

Information collected for analytics purposes may include:

• Device information
• Usage statistics
• Error reports
• Crash logs
• Performance metrics

Such information is used solely for operational, security, maintenance, support, and product improvement purposes.

8. COOKIES AND SIMILAR TECHNOLOGIES

The BurnAid website and web application may use cookies, local storage, session storage, and similar technologies to:

• Maintain user sessions
• Remember preferences
• Improve functionality
• Analyze usage trends
• Enhance security

Users may manage cookie settings through their browser preferences. Certain features may not function properly if cookies or similar technologies are disabled.

9. SHARING OF INFORMATION

BurnAid may share information as described below.

Service Providers

We may share information with authorized providers assisting with:

• Cloud hosting
• Infrastructure management
• Payment processing
• Email communications
• Analytics
• Security monitoring
• Customer support

BurnAid requires service providers to maintain appropriate confidentiality, security, and data protection obligations consistent with their role and the services they provide.

Legal Compliance

We may disclose information where reasonably necessary to:

• Comply with applicable laws
• Respond to lawful governmental, regulatory, or judicial requests
• Protect legal rights
• Investigate fraud or security incidents
• Enforce contractual obligations

Corporate Transactions

We may disclose or transfer information in connection with:

• Mergers
• Acquisitions
• Asset sales
• Corporate restructurings
• Financing transactions

Where required by applicable law, BurnAid will apply appropriate safeguards in connection with such transfers.

10. INTERNATIONAL DATA PROCESSING

BurnAid supports users across multiple countries and regions. Information may be processed, transferred, and stored in countries different from the user’s country of residence.

Where required by applicable law, BurnAid will implement reasonable safeguards intended to support lawful international data processing and transfers.

Users and healthcare organizations are responsible for determining whether their use of BurnAid is permitted under their local laws, institutional policies, and applicable data transfer requirements.

11. DATA RETENTION

BurnAid retains information only for as long as reasonably necessary to:

• Provide Services
• Maintain user accounts
• Support reporting functionality
• Retain historical assessment records de-linked from direct patient identifiers
• Process subscriptions and billing
• Comply with legal obligations
• Resolve disputes
• Enforce agreements
• Maintain system integrity

Patient names and hospital-assigned patient identifiers are not intended to be retained within stored historical assessment records after assessment completion and report generation.

Backup copies, logs, or technical records may be retained for limited periods as reasonably necessary for security, continuity, legal, or system integrity purposes, subject to applicable safeguards.

12. INFORMATION SECURITY

BurnAid implements reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, misuse, or destruction.

Security measures may include:

• Encryption of data in transit
• Access controls
• Authentication mechanisms
• Secure hosting environments
• Security monitoring
• Audit logging
• Backup and recovery procedures

No method of electronic transmission or storage can guarantee absolute security. Users and healthcare organizations are responsible for maintaining appropriate safeguards for their own devices, accounts, exported reports, and institutional systems.

13. USER RIGHTS

Subject to applicable law, users may have the right to:

• Access their personal information
• Correct inaccurate information
• Request deletion of information
• Restrict processing
• Object to certain processing activities
• Request a copy of their personal information

Requests may be submitted using the contact information below. BurnAid may need to verify the requester’s identity before responding to a request.

Where BurnAid processes information on behalf of a healthcare organization, certain requests relating to patient information may need to be directed to the relevant healthcare organization, which remains responsible for official patient records and patient-rights responses under applicable law.

14. THIRD-PARTY SERVICES

BurnAid may integrate with or link to third-party services, including payment providers, hosting providers, analytics platforms, healthcare systems, or other external services.

We are not responsible for the privacy practices, security practices, or content of third-party services that are not controlled by BurnAid. Users should review the privacy policies and terms of such services separately.

15. PEDIATRIC PATIENT INFORMATION AND CHILDREN’S PRIVACY

BurnAid is intended for use by qualified healthcare professionals and healthcare organizations. The Services are not directed toward children or intended for direct use by individuals under the age of 18.

BurnAid may be used by qualified healthcare professionals as a clinical reference, assessment, documentation, and calculation-support tool for both adult and pediatric burn-care scenarios. In such cases, pediatric patient-related information may be entered by the healthcare professional during active assessment and report-generation workflows.

BurnAid processes pediatric patient-related information in accordance with this Privacy Policy and applicable healthcare privacy requirements. Patient names, hospital-assigned patient identifiers, and medical record numbers are processed only as needed for active assessment and report generation and are designed not to be retained in stored historical assessment records after completion of the assessment and report-generation process.

Healthcare professionals and healthcare organizations remain responsible for obtaining any required parental, guardian, patient, or institutional consents or authorizations and for ensuring that their use of BurnAid complies with applicable pediatric healthcare, privacy, consent, and institutional requirements.

16. HEALTHCARE PRIVACY AND INSTITUTIONAL RESPONSIBILITY

Where BurnAid processes protected health information, personal health information, or similar regulated health information on behalf of a healthcare organization, hospital, clinic, covered entity, business associate, or equivalent regulated entity, additional contractual terms, data processing terms, or business associate terms may apply as required by applicable law.

Healthcare professionals and healthcare organizations remain responsible for determining whether their use of BurnAid complies with applicable healthcare privacy laws, institutional policies, patient consent requirements, professional obligations, and local regulatory requirements.

BurnAid does not replace the healthcare organization’s official medical record system, consent process, documentation process, or institutional privacy compliance program.

17. CHANGES TO THIS PRIVACY POLICY

We may revise this Privacy Policy from time to time to reflect changes in legal requirements, technologies, business practices, or BurnAid services.

Updated versions will be posted within the Services and on our website with a revised “Last Updated” date.

Continued use of BurnAid after such changes become effective constitutes acknowledgement of the revised Privacy Policy, subject to applicable law.

18. CONTACT US

If you have questions regarding this Privacy Policy or BurnAid’s privacy practices, please contact:

BurnAid Privacy Team
Email: privacy@burnaid.app
Website: https://burnaid.app

19. CONSENT AND ACKNOWLEDGEMENT

By accessing, registering for, subscribing to, or using BurnAid, you acknowledge that you have read and understood this Privacy Policy. Where consent is required by applicable law, BurnAid will seek such consent in accordance with applicable requirements.

Healthcare professionals and healthcare organizations are responsible for obtaining any patient, parent, guardian, institutional, or regulatory consents or authorizations required for their use of BurnAid and for any information they enter, export, download, print, transmit, or store outside BurnAid.