Privacy Policy

When an account is created or activated, Anestra stores name, email address, role (student or a staff role), program, campus, and cohort, plus a unique account identifier used to sign in. For students, that identifier is how their education records are tied to them.

Anestra also stores the role, program, campus or campuses, and cohort used to decide what the account may see. Staff may set an optional profile photo. A student may have an optional assigned clinical mentor.

Sign-in uses email and password, or an email sign-in link. The staff portal is for staff. Students are not admitted there.

Students enter some of these records. Staff and Anestra servers write others that stay tied to the same student. They include:

• Clinical days and clock-in and clock-out punches
• Cases and the credit computed from them
• Preceptor evaluations
• Weekly self-evaluations
• Weekly advisor reports
• End-of-rotation site evaluations
• Absence requests, including an optional interview-confirmation image
• Staff operational notes tied to the student, such as absences, makeup, communications, clearance, time corrections, interventions, and alerts
• Program progress toward clinical requirements
• One-way staff-to-student messages. The student can mark a message read. There is no student reply, group chat, or attachment on that inbox.
• Account-deletion requests the student files, and the program's recorded outcome

An interrupted preceptor-evaluation form can be resumed from a pointer stored on the student's device only.

Location is used only at clock-in and clock-out, as a one-shot check to verify that the student is present at the assigned clinical site.

• Location is not collected in the background.
• Location is not collected continuously.
• Raw GPS coordinates are not stored.
• What is stored is whether the check placed the student at the site, how far the device was from the site, and the site information needed to run that check.
• Location permission can be changed or revoked in iOS Settings.
• If location is off or denied, manual clock-in remains available for coordinator review. A manual punch does not record a location reading.

Hospital records store the site's own coordinates and check-in area so that check can run. Those are hospital facts, not a student track.

Anestra does not use Firebase Analytics, Firebase Crashlytics, advertising SDKs, or cross-app tracking. Firebase and Google Cloud still process authentication and operational and security metadata to run the service.

Anestra does not collect push-notification tokens, and it does not collect background or continuous location.

Google Firebase and Google Cloud process data on Anestra's behalf in the United States, including authentication, the database, server functions, and file storage. They also process limited operational and security metadata under Google's cloud terms.

Service providers who process personal information on Anestra's behalf are required to maintain appropriate privacy and security protections.

Clinical and education records are visible to authorized staff of the student's own program. Platform operators may act across programs.

Anestra does not sell personal information. Anestra does not use third-party advertising.

Preceptors see only the temporary evaluation handoff on the student's device. There is no preceptor portal. Signed evaluations stay as they were signed.

The platform is not designed to collect protected health information (PHI). Users are prohibited from entering PHI in cases, evaluations, messages, or comments. If PHI is found, it may be removed and the participating program notified.

Participating educational programs generally determine account eligibility, required education records, access permissions, and retention requirements.

After a student leaves or graduates, education records are retained by the program as its accreditation and policies require. This policy does not state a numbered retention period. The participating program decides how long records are kept, and why: they are official program records used for education, accreditation, and legal obligations.

The program retains its own academic and clinical records for a person, including name, school email, clinical days, attendance, hours, evaluations, case logs, absences and program communications, under its accreditation record-keeping obligations. These records are not deleted by an account-deletion request. This policy does not state a numbered retention period.

Audit history is append-only and is retained so the record of who changed what cannot be rewritten. Backend backups exist under the cloud provider that hosts the service.

Anyone with an Anestra account may request deletion. Students do this in the app: Settings, then Privacy & Account, then Request account deletion. Staff, and students who cannot use the app, email privacy@anestra.org from the email address on the account and name their program.

The program that holds the account decides. On approval, Anestra removes the person's ability to sign in and the personal details named on the deletion page. The program keeps the academic and clinical records named under Retention. On decline, nothing changes. Anestra emails the person the outcome either way. Deletion is not reversible.

The steps are written out on the Delete your account page.

Anestra is for adult graduate students in an anesthesiologist assistant program and for program staff. It is not for children.

If this policy changes, the updated policy will be posted at this address with a new effective date.

Privacy requests: privacy@anestra.org