Privacy policy
Privacy Policy
Last updated October 16, 2026
This application holds information about named patients and their medical situation. An HLC is not a hospital, so the health-privacy laws binding one do not legally bind it — but the information is the same information, so this policy describes handling built to that standard anyway.
Two different things, with different rules
This public website and the committee application are separate, and it matters which one you are reading about.
The website is barnabyhub.com — these pages, the feature catalog, and the two contact forms. Anyone can visit it, and it collects almost nothing.
The application is your committee’s own address, which only invited members can sign into. Everything about cases, visits and members below refers to that.
What the public website collects
- Nothing at all, if you only read
- No sign-in, no account, and no advertising or cross-site tracking of any kind. The site sets no cookies on a visitor who does not submit a form.
- What you type into a contact form
- Your name, email address, the committee name if you give one, your message, and the IP address the message came from. It is stored so we can reply and so repeated abuse of the form can be blocked, and it is readable only by the people who administer the platform.
- An automated check that you are a person
- Cloudflare Turnstile runs on the contact forms. It confirms a real browser is submitting; it is not given your message.
- What you enter when you contribute
- Contributing sends you to our payment processor's own page. Card details go to them and never reach us. We are told the amount, the date and the name and committee if given — enough to say thank you and to keep our own books, and nothing about the card itself.
- Aggregate visit statistics
- We run our own copy of Umami on our own server for public pages only. It is cookieless, hashes IP addresses rather than storing them, builds no profile of you, and is never loaded on a committee’s own pages — a committee URL can contain a case identifier, and no analytics tool should ever hold a record of which patient records were opened.