Privacy Notice
Effective October 24, 2026. Covers the Parent Binder, client binders for professionals, optional monthly updates, and the pages at starrynightops.com/care/. Starry Night is a sole proprietorship run by Nick, 201 N MacArthur Dr, West Lafayette, IN 47906, nick@starrynightops.com. Our Consumer Health Data Privacy Policy lists the health data we collect, why, what we share, with whom, and how to use your rights; this notice adds how we handle it.
1. Permission first
The person the records are about (usually a parent) must ask for the service and give permission before we collect anything, or their health care power of attorney agent, guardian or conservator, or other representative with legal authority to make health care decisions for them, must do so with a copy of the document. We can't yet take records for someone who has died. Permission has separate, unticked boxes for (a) collecting and using the records and (b) sharing the binder with named people. Where state law requires it (for example California and Texas), the form includes a separate authorization with its own signature, the named recipients, and an end date no later than one year away. Professionals who send a client's records confirm in a written agreement that they hold the client's written authorization.
We don't accept records about reproductive or sexual health or gender-affirming care. If we find them in a pile, we leave them out of the binder, delete them and tell you.
2. How it's processed
- Files come to us through a secure Dropbox upload link made for your case (no account needed), which we close once the files arrive. Please don't email records.
- An AI model (Anthropic's Claude, through its business API) reads the pages and extracts dates, medicines and amounts. Software then checks each item against the page it cites. Anthropic's business terms bar it from training on our data, and it deletes API inputs and outputs within 30 days, except where kept longer for safety review, usage-policy enforcement or legal reasons.
- A person (the founder) reviews each binder before it's delivered. Every binder and draft says "Prepared with AI assistance and reviewed by a person. Not medical or legal advice."
- We send the binder only to the people named on the permission form, as a password-protected PDF, with the password in a separate email.
3. Notice of electronic disclosure
Health information you send us is subject to electronic disclosure to the service providers named in our Consumer Health Data Privacy Policy (Anthropic, Dropbox, Google Workspace) to prepare the binder, and to the recipients you name on the permission form.
4. How long we keep it
| What | How long |
|---|---|
| Records you send, our working copies, and the binder copy in our sent email | Deleted within 7 days of delivery. If you choose the free update or monthly plan, kept only until the update or plan ends, then deleted within 7 days. We confirm each deletion in writing. |
| Signed permission form and authority documents | 3 years after the order, to show we had permission, then deleted |
| Order record (name, email, date, amount; no health details) | As long as tax law requires (generally up to 7 years) |
Our service providers may keep encrypted backups for a limited time after deletion under their own schedules.
5. Tracking
These pages use no analytics scripts, ad pixels, social media plugins or cookies. No third party collects information about you across websites or over time through our pages. Our host, Cloudflare, processes standard request data (such as IP address) to deliver and protect the site.
6. Security
Access is limited to the founder. Accounts use multi-factor sign-in. Working files stay on one encrypted computer and in our Dropbox and Google Workspace accounts, never in other cloud services. We give your information to no one other than the recipients and service providers listed above.
7. Your rights
The person the records are about, or their legal representative, can ask to see, correct, get a copy of, or delete their information, withdraw permission, or appeal our answer. Email nick@starrynightops.com with the subject "Health data request". We respond within 45 days (we may extend once by 45 days and will say why). Nevada residents: deletion requests are completed within 30 days of confirming who you are. Connecticut residents: you can also ask us to correct data and to receive it in a portable format, and we answer appeals within 60 days; if we deny your appeal you may contact the Connecticut Attorney General. Details and Washington-specific information: Consumer Health Data Privacy Policy.
8. If something goes wrong
If health information is accessed or disclosed without permission, we tell the people affected without unreasonable delay and within the time the law requires, and notify the Federal Trade Commission and state authorities where required. That's why the permission form asks for the person's mailing address and preferred way to be contacted.
9. Children
The service is for adults. We don't knowingly collect information about anyone under 18.
10. Changes to this notice
We post changes here with a new effective date, and email customers with an open order or plan about any material change before it applies. We won't use health information already collected in a new way without asking for permission again.
Starry Night is not a doctor, hospital or insurer and is not covered by HIPAA. We don't claim HIPAA compliance; this notice and our Consumer Health Data Privacy Policy describe how we handle your information.