Effective Date: August 30, 2025
Last Updated: August 5, 2026

LactaSite ("we," "our," or "us") is committed to protecting the privacy and security of information entrusted to us. This Privacy Policy explains how we collect, use, and safeguard personal and health information when you use our web application, which is designed for lactation professionals to manage their practice and patient records. Our platform is password protected and built to comply with the Health Insurance Portability and Accountability Act (HIPAA).

1. Information We Collect

We may collect the following types of information:

• Professional Information: Name, email address, phone number, practice details, and account login credentials.
• Patient Information: Protected Health Information (PHI) as defined by HIPAA, which may include patient names, contact information, medical history, lactation notes, and related records.
• Technical Information: Device type, IP address, browser type, operating system, and usage activity within the app.
• Support and Communication Records: When you contact us for support, we may collect information related to your inquiry.

2. How We Use Information

We use information solely to:

• Provide, maintain, and improve our web application.
• Enable lactation professionals to securely document and manage patient care.
• Ensure compliance with HIPAA and other applicable regulations.
• Communicate with users regarding updates, support, and security notifications.
• Monitor and enhance system security, performance, and reliability.

We do not use patient information for marketing or any non-care-related purposes.

3. Data Security and HIPAA Compliance

We implement administrative, physical, and technical safeguards designed to meet HIPAA standards, including but not limited to:

• Password-protected, role-based access controls.
• Encrypted data transmission (TLS/SSL) and encrypted storage.
• Regular security audits and monitoring.
• User authentication and session management.
• Secure backup and recovery procedures.

All staff and contractors with access to PHI are trained in HIPAA compliance and bound by confidentiality agreements.

4. Data Sharing and Disclosure

We do not sell or rent your information. We may share information only in the following limited circumstances:

• With Authorized Users: Patient information is accessible only to the healthcare professionals who create or are granted access to the record.
• With Service Providers: We may use third-party vendors (e.g., secure hosting, backup, or technical support) bound by HIPAA-compliant Business Associate Agreements (BAAs).
• As Required by Law: We may disclose information when required by applicable law, regulation, or court order.

5. User Responsibilities

As a covered entity or business associate under HIPAA (depending on your role), you are responsible for:

• Using the platform in accordance with HIPAA regulations.
• Maintaining the confidentiality of your login credentials.
• Ensuring that patient access and permissions are properly managed.

6. Data Retention

We retain records in accordance with legal, clinical, and HIPAA requirements. Users may request data export or deletion in compliance with applicable laws and contractual obligations.

7. Your Rights

Depending on your role (provider or patient), you may have the right to:

• Access and obtain a copy of your information.
• Request corrections or updates.
• Request restrictions on certain uses or disclosures.
• Receive an accounting of disclosures.

We will respond to requests as required by HIPAA and applicable state law.

8. Children's Privacy

This application is intended for professional use only. We do not knowingly collect personal information directly from children under 18.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any significant changes will be communicated to registered users via email or in-app notification.

10. Third-Party Integrations (Google Calendar)

LactaSite offers an optional Google Calendar integration to help practitioners manage their appointment schedule. If you choose to connect your Google account, we request only three narrowly-scoped Calendar permissions:

• View your list of calendars (read-only), so you can choose which of your calendars the integration uses.
• View free/busy information, so appointment slots are not offered when you are already busy.
• Create and manage the events LactaSite adds, so appointments booked in LactaSite appear on your calendar and stay up to date.

Those three uses are the entirety of what we do with Google user data. We never read the titles, descriptions, attendees, or any other contents of your existing calendar events — only whether a time block is free or busy. We do not access Gmail, Google Drive, Google Photos, contacts, or any other Google data. We do not use Google user data for advertising or marketing, and we do not sell or transfer it to any other party except as necessary to provide the scheduling functionality you requested. Access is granted through secure OAuth authentication, and you may revoke it at any time through the integration settings in LactaSite or your Google account permissions settings.

Google user data is never transferred to any third-party AI/ML service and is never used to develop, improve, or train AI or machine-learning models.

LactaSite's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We handle any accessed calendar data in accordance with HIPAA requirements where applicable and do not share such data except as necessary to provide the requested functionality.

11. Artificial Intelligence Features

LactaSite includes AI-assisted clinical documentation features, such as drafting chart notes and care plans and transcribing dictated notes. These features are powered by Microsoft Azure OpenAI Service under a HIPAA Business Associate Agreement; the provider does not use data submitted through the service to train its models, and the data is processed in the United States.

These AI features operate solely on information that you and your practice enter into LactaSite. They have no access to Google user data (see Section 10).

In the mobile app, visit-recording transcription runs on-device — the audio never leaves your phone. Audio recorded with the dictation microphone is transmitted securely to our servers for cloud transcription.

12. Mobile Application

The LactaSite mobile app for practitioners uses the following device capabilities, each solely for the documented clinical function:

• Camera: to capture clinical photos that are uploaded to the patient's record.
• Microphone: for visit recording (transcribed on-device; audio never leaves the phone) and for dictation (audio transmitted securely for cloud transcription), as described in Section 11.
• On-device storage: to hold in-progress visit data before it is securely synced to your account.

The mobile app contains no advertising, analytics, or third-party tracking SDKs.

13. Data Deletion Requests

You may request deletion of your account and associated data at any time by emailing hello@lactasite.com from the email address on your account. We will acknowledge your request within 7 days and complete it within 30 days where deletion is permitted.

Account information such as your login credentials and profile is deleted on request. Clinical records are subject to legal and professional retention requirements (including HIPAA and state medical-record retention schedules) and generally cannot be deleted on request; such records are retained for the legally required period and remain protected as described in this policy.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

For additional support or questions, please contact us.