WHETSTONE

Privacy Policy

Last updated: May 6, 2026

1. Who We Are

Whetstone is operated by Whetstone Healthcare Consulting LLC, a Washington-based company building AI-powered clinical communication training tools. This policy describes how we collect, use, share, and protect information when you use the Service at whetstone.health and its associated training modules.

2. Information We Collect

We collect the following categories of information:

Account information — name, email address, professional credentials (e.g. MD, RN, LCSW), and (optionally) a profile photo.
Authentication data — hashed passwords or single-sign-on identifiers managed by Supabase.
Usage data — which modules you've opened, lessons completed, role-play sessions started, scores earned, and timestamps.
Practice content — text you type into role-plays, exercises, or the Transcript Analyzer. This must not contain Protected Health Information (PHI) — see our Terms of Service.
Billing information — subscription status, billing cadence, and a Stripe customer ID. We never see or store your full credit card number; that lives with Stripe.
Continuing education data — if you enable CME tracking, the credentials you provide for credit reporting.
Technical data — IP address, browser type, and basic device information for security and debugging.

3. How We Use Information

We use information to operate, secure, and improve the Service. Specifically:

Authenticate you and personalize the experience (your scores, your saved phrases, your classroom enrollments).
Generate AI feedback, scores, and analytics on your practice sessions.
Show instructors aggregate progress for the classes they teach.
Process payments through Stripe and manage your subscription.
Send transactional emails (account confirmations, billing receipts, password resets).
Track CME credits when you opt in.
Detect abuse and protect platform integrity.

4. How AI Analysis Works

When you submit text for AI scoring (role-play turns, transcript uploads, exercise responses), Whetstone sends that text to a large language model (Claude, developed by Anthropic) hosted on Microsoft Azure AI infrastructure in the United States to generate feedback and a score. Your text is not used to train the model. For the Encounter Analyzer and clinical integrations, this processing runs under Microsoft's Business Associate Agreement with HIPAA-aligned safeguards. We store the resulting scores and the text you submitted in your account so you can review them later.

5. Sharing Information

We share information only as needed to operate the Service:

Stripe — for processing payments. They receive billing details only.
Microsoft Azure AI — hosts the Claude model (developed by Anthropic) that performs AI scoring. The text you submit and a system prompt are processed on Microsoft's U.S. infrastructure; for the Encounter Analyzer and clinical integrations this is covered by Microsoft's Business Associate Agreement. No account-identifying metadata is sent.
Supabase — our database and authentication provider. They store your data on our behalf.
Resend — for sending transactional email.
Your instructors — if you join a classroom via invite code, the instructor of that class can see your scores, completion progress, and submitted exercises within the modules that class is enrolled in.

We do not sell your data. We do not run third-party advertising. We do not share data with marketing partners.

6. Data Retention

We retain your account data for as long as your account is active. When you delete your account (Account Settings → Delete Account), we delete your authentication record and all associated data — profiles, scores, transcripts, saved phrases, classroom memberships — within 30 days. Backups are retained for an additional 30 days for disaster recovery, then permanently purged.

7. Your Rights

You have the right to:

Access your data — visible in your dashboard, history, and Account Settings.
Correct your data — update name, credentials, and email at any time.
Delete your data — Account Settings → Delete Account, or email us.
Export your data — email [email protected] for a portable copy.

8. HIPAA Notice

Whetstone has two categories of features with different rules for Protected Health Information (PHI). Practice and training features (role-plays, exercises) are for fictional or de-identified content — do not enter PHI. The Encounter Analyzer and clinical integrations (including the Dragon Copilot extension) are designed to process real clinical encounters, which may contain PHI, on HIPAA-eligible Microsoft Azure infrastructure (United States) under Microsoft's Business Associate Agreement, with HIPAA-aligned safeguards. Whetstone Healthcare Consulting LLC enters into a Business Associate Agreement with institutional customers. See our Terms of Service Section 7 for the full notice.

9. Cookies and Local Storage

We use cookies and browser local storage to keep you signed in, remember your theme preference, and persist UI state (which tab was last open, etc.). We do not use third-party advertising cookies or cross-site tracking.

10. Security

Data is encrypted in transit (TLS) and at rest (Supabase-managed encryption). Authentication is handled by Supabase Auth with industry-standard password hashing. Row-level security policies enforce that you can only read your own data. No system is perfectly secure — if you discover a vulnerability, please email [email protected].

11. Children

The Service is intended for healthcare and training professionals. We do not knowingly collect data from anyone under 18.

12. International Users

Whetstone is operated from the United States. By using the Service from outside the U.S., you consent to your data being transferred to and processed in the U.S.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. The "Last updated" date at the top of this page reflects the most recent revision.

14. Contact

For privacy questions or to exercise your rights, contact us at [email protected].