Privacy Policy

Depending on how you use the Service, we may collect:

• Provider and learner account information — name, email address, password (stored hashed), membership/role, and optional profile and practice details.
• Patient Practice Academy information — display name, email address, password (stored hashed), email-verification and Academy-access status, the Practice Academy joined, join date, assigned resources or programs, completion and progress status, learning feedback, and notification preferences.
• Google sign-in information — if a provider or learner chooses “Sign in with Google,” we receive the Google account email, name, and profile image and create or link the Learning Center account.
• Provider learning activity — pathway progress, lesson completion, worksheet answers, notes, uploads, support requests, and similar usage needed to save work.
• Practice Academy activity — assigned-item completion and program progress associated with a patient account. We also use aggregate daily counts for public-library page opens, resource activity, and feedback. Those aggregate metrics do not store patient names, email addresses, IP addresses, or visitor identifiers.
• Billing and membership information — plan selections, invoice identifiers, payment status, and customer identifiers needed to create and track QuickBooks Online invoices and membership activation. We do not store full payment-card numbers; card entry, if any, is handled by Intuit/QuickBooks payment pages.
• Technical information — basic logs such as timestamps, browser/device signals, IP address as processed by our hosting provider, essential cookies or session tokens, and security/authentication events.

• Provide, secure, troubleshoot, and improve the Service
• Authenticate accounts, verify patient email addresses, and maintain sessions
• Save provider learning work, Academy settings, and preferences
• Deliver a provider’s published Academy content and individual patient assignments
• Show an Academy provider its patient-access roster and assignment completion or program progress
• Send account, assignment, safety, and opted-in notification emails
• Create invoices, confirm payment status, and activate paid memberships
• Respond to support requests, prevent abuse, and meet legal obligations

We do not sell personal information or use patient information for targeted advertising.

Each Practice Academy belongs to the provider or practice that subscribes to and manages it. Sunshyn does not operate one shared clinical Academy on behalf of all providers.

• A patient joins a particular provider’s Academy through its link or QR code and must verify an email address. The patient account is private and protected by its sign-in credentials.
• The Academy’s authorized provider or practice team can see the patient’s display name, email address, verification/access status, join date, assigned resources and programs, and related completion or progress for that Academy.
• A patient can see that provider’s published content, the items assigned to that patient, and the patient’s own progress. Other patients cannot see the patient’s email address, account access, or individual assignments through the Academy.
• Providers control their Academy’s content and invitations and are responsible for giving patients any practice-specific privacy notice, obtaining any required permission, limiting team access, and using patient information in compliance with applicable law.

Academy access information may be sensitive because it can reveal a relationship with a provider and the educational material assigned. We limit its use and disclosure as described in this policy.

Do not use the Service for medical records, diagnoses, clinical notes, care plans, insurance/member identifiers, appointment communications, treatment decisions, or emergencies. Patients should not submit symptoms, medical records, or clinical questions through Academy fields or peer chat. Use the private clinical system or contact method designated by the treating practice.

Whether information is protected health information (“PHI”) depends on the information, the provider’s status, and applicable law. A provider must not enter, upload, assign, or disclose PHI through the Service unless Sunshyn has expressly authorized that use in writing and all required agreements and safeguards are in place. This Privacy Policy does not create a business associate agreement.

Provider learning worksheets, uploads, mentorship tools, support tickets, and free-text fields must use de-identified examples only. Do not enter patient names or other details that could identify a patient.

Google sign-in is optional and is offered to provider and learner accounts, not as the patient Academy sign-in method. If you use it, Google’s policies also apply to data Google processes. We use Google to authenticate your identity and obtain the limited profile details needed to operate your account. You can disconnect Google access in your Google Account permissions; you may then need another sign-in method or administrator help.

Paid memberships, including Practice Academy subscriptions, may be invoiced through Intuit QuickBooks Online (“QuickBooks”). When billing is enabled:

• We may create or update a QuickBooks customer using the purchaser’s name, email, and practice label and create invoices with online payment links.
• Intuit processes payment data on QuickBooks-hosted pages under its own terms and privacy policy.
• We receive invoice balance and payment-status updates so we can activate or restrict paid features.
• Authorized Sunshyn staff may connect a QuickBooks company for invoicing. Connection tokens are stored for server-side use and are not exposed to users or patients.

Patient Practice Academy information is not sent to QuickBooks for provider billing.

We may share information only as needed with:

• The applicable Academy provider or authorized practice team — for the patient roster, assignments, and progress described in Section 3
• Service providers that host, email, secure, support, or operate the Service (for example Amazon Web Services), subject to appropriate safeguards
• Google — only when a provider or learner chooses Google sign-in
• Intuit / QuickBooks — when a purchaser pays for or renews a membership
• Legal or safety recipients — when required by law or reasonably necessary to protect users, Sunshyn, or others

We may also disclose information in connection with a merger, financing, acquisition, or sale of assets, subject to applicable law and continued protection of the information.

We use essential cookies and session tokens to keep users signed in, protect against cross-site request forgery, and remember authentication state. These are required for the Service to function. We do not use third-party advertising cookies on the Service.

We retain account, patient Academy access, learning, assignment, progress, and billing-status data while needed to provide the Service and for backups, security, dispute resolution, accounting, and legal requirements. Retention may also depend on the subscribing provider’s instructions and applicable agreements.

We use reasonable administrative, technical, and organizational measures, including encrypted transport (HTTPS), access controls, and hashed passwords. No online service is perfectly secure. If a security incident requires notice, we will provide notice as required by applicable law.

• Update available profile, account, and notification settings while signed in
• Ask the applicable provider to correct Academy roster information or revoke that provider’s Academy access
• Request access, correction, or deletion by emailing Sunshyn; we may need to verify your identity and coordinate with the subscribing provider
• Close and delete a provider account from Account / Settings, subject to records we must retain for accounting, security, agreements, or law
• Disconnect Google sign-in through Google Account settings
• Cancel or change a provider membership through Membership settings or by contacting us

Deleting an account or revoking Academy access may not immediately remove backup copies, de-identified aggregate counts, safety records, or information that must be retained by law or contract.

Adults may separately opt into Sunshyn Circle through a participating Practice Academy. Circle participation and peer conversations are separate from the provider’s Academy roster, individual assignments, and practice medical records.

• We collect an email address, hashed password, chosen nickname, feeding stage, support topics, time zone, matching preferences, and Circle consent/settings.
• Possible matches see only the nickname, general stage, time zone, and shared support topics. They do not see the member’s email address or originating practice.
• Private chat messages are stored to deliver chat and enforce safety. When a report is submitted, a limited recent-message snapshot is preserved for Sunshyn staff review.
• The participating Academy provider does not receive access to Circle identities, matches, messages, or reports through its Academy.
• A member may pause matching, block a connection, disable email notices, or delete the Circle account. Safety and legal records may be retained when reasonably necessary.

Do not share medical records, precise location, passwords, financial information, or other sensitive information in peer chat. Circle is not an emergency or clinical-care service.

Provider accounts and patient Practice Academy accounts are intended for adults. The Service is not directed to children under 13, and children should not create accounts. Academy content may discuss infant or child care, but users should not enter information that identifies a child. Contact us if you believe a child has provided personal information.

Residents of California or another U.S. state with applicable privacy laws may have rights to know, access, correct, or delete certain personal information and to opt out of “sale” or “sharing” as defined by law. We do not sell personal information or share it for cross-context behavioral advertising. Email the contact below to exercise a right. We will verify and respond to requests as required by applicable law.

We may update this policy. We will change the “Last updated” date and provide any additional notice required by law. Continued use after an update means you accept the revised policy.

Sunshyn Credentialing & Medical Billing Group
Email: sunshyncredentialing@gmail.com
Support: rachael.lara@sunshyncredentialing.com
Website: www.sunshyncredentialing.com
Related: Terms of Service

This page is provided for product transparency and third-party app configuration. It is not formal legal advice. Have qualified counsel review the policy and the Service’s healthcare-privacy obligations for every jurisdiction and provider arrangement.