Privacy policy

1. What this policy covers

This policy covers belay.health, the “Book 15 minutes” form on it, email you send to our @belay.health addresses, and our meetings with you. We’re a US company, and this website is for organizations in the United States.

It doesn’t cover the Belay app. Organizations use the app under their own agreements with us, and those agreements cover the information in it. It also doesn’t cover other websites we link to.

2. What we collect

When you send our “Book 15 minutes” form. The form asks for your work email, your name, your role, your organization and how many buildings it runs. You can also add a message. Please don’t include health information or details about your staff or residents.

Along with the form, we receive:

• which page the form was on, and any campaign tags in the link that brought you there (like utm_source, which tells us which email or post you came from);
• what your browser reports about itself, such as its name, version and operating system;
• a scrambled fingerprint of your internet connection (a salted hash of your IP address), which we use to stop floods of automated requests. Our form never stores the IP address itself;
• the results of our spam checks, such as whether the form was sent within a few seconds of opening;
• the date and time you sent it.

If you send the form again with the same email within 10 minutes, we update your first request instead of saving a second one. We keep requests our spam checks catch, marked as spam, so we can find real people caught by mistake.

When you email us. We receive your email address, your name as your email shows it, and whatever you write or attach. If you write to us about a job, we use what you send to consider you and reply.

When we meet. If we talk by phone or video call, we may keep notes of what we discuss.

When you browse the site. Like any website, our hosting provider, Netlify, receives the technical details your browser sends with each request, such as your IP address, the page you asked for, the page you came from and your browser type. It handles them on our behalf to deliver pages and protect the site. We don’t use them to identify you.

Our earlier website. Before this version of belay.health, our contact form also asked for a phone number (optional) and how many beds your facility has. If you sent us that form, this policy covers that information too.

The turnover calculator. The calculator on our turnover page works in your browser. What you type into it isn’t sent to us.

3. How we use it

We use the information you send us to:

• reply to you and find a time to talk;
• talk with you and your organization about Belay, and follow up afterward;
• consider you for a role, if you wrote to us about one;
• keep the form working and free of spam and abuse;
• see which pages and campaigns lead people to contact us;
• keep a record of our conversations;
• meet legal obligations and protect our rights.

We don’t sell your information, use it for advertising, or use it to build a profile of you across other websites.

4. Who we share it with

We share it with the service providers that help us run the website and answer you, so they can do that work for us:

• Netlify hosts the website, runs the form and stores the requests it receives.
• Cloudflare checks that requests sent through our booking form come from people, not automated programs.
• Discord (a team chat service) may carry new requests to our team as a message. Resend (an email delivery service) sends our emails about your request: a confirmation to you, and a copy to our team.
• Google provides our email, where we receive your emails and reply to you, and the spreadsheets where we keep requests, including those from our earlier website.
• Our calendar, video-call and note-taking tools, when we meet with you.

We may also disclose information when the law requires it, or to protect the rights and safety of our company, our customers or others. If our company is sold or merges with another, the information may pass to the new owner as part of that deal.

5. Cookies and tracking

We don’t set cookies on this website, and our pages don’t store anything in your browser. There are no analytics or advertising tools and no tracking pixels. Every page, font, image and video comes from belay.health itself, with one exception: on the booking page, a check from Cloudflare called Turnstile confirms that the form is being sent by a person, not an automated program. It loads from Cloudflare’s servers and runs in its own small frame. It sees technical details such as your IP address and browser, and Cloudflare may set a cookie inside that frame that the check needs. Cloudflare also uses these details to improve its bot detection. It doesn’t receive what you type into the form.

Your browser may send a Do Not Track or Global Privacy Control signal. Because we don’t follow you across websites or sell or share your information, there’s nothing for these signals to switch off.

If we ever add analytics or anything else that changes this, we’ll update this policy first.

6. How long we keep it

• Your requests and our emails with you: we keep them while we’re talking with you and your organization about Belay, and afterward as a record of those conversations. We don’t delete them on a fixed schedule today. We’ll delete yours when you ask (see “Your choices and rights”), unless we need to keep something to meet a legal obligation.
• Records that limit floods of requests: these hold only scrambled fingerprints of your connection and your email address, and the times of recent requests, with no name, email or IP address. We use them only for these limits, and we don’t delete them on a fixed schedule either.
• Our hosting provider’s technical logs: kept under its own policies.

7. How we protect it

• The site uses HTTPS, so what you send through the form is encrypted on its way to us.
• Only our team, and the service providers above as they do their work, can see the requests you send. The export we use to list them needs a secret key.
• Our form never stores your IP address, and our logs record what happened to each request, not who sent it.

No website or system is perfectly secure, so we can’t promise that information will never be exposed. If a breach affects your information, we’ll tell you as the law requires.

For how we protect our customers’ data in the Belay app, see Security.

8. Your choices and rights

Wherever you live, you can ask us to:

• tell you what information we have about you, and give you a copy;
• correct it;
• delete it;
• stop contacting you.

Email privacy@belay.health, ideally from the address you used with us. We may ask you to confirm the request from that address, so we know it’s you. We’ll answer within 45 days. If we need more time, we’ll tell you why and take at most 45 more days. If we can’t do everything you asked, we’ll explain why, and you can reply to ask us to look again.

You can also ask someone to make a request for you. We’ll ask them for proof that you’ve authorized them. We won’t treat you differently for making a request.

If you work for one of our customers. The information about you in the Belay app comes from your employer, and your employer’s agreement with us covers how it’s handled. Please contact your employer first. If you write to us, we’ll pass your request on to them.

9. California residents

We give the rights above to everyone. For California residents, here’s the information California’s privacy law (the California Consumer Privacy Act) asks businesses to provide about the last 12 months:

• What we collect: identifiers (name, email address, phone number if you gave one on our earlier form, connection fingerprint); professional and employment information (role or job title, organization, number of buildings or beds, and anything you send us about a job); internet activity (the form page and campaign tags, browser details, spam-check results); and anything you choose to write or tell us.
• Where it comes from: you, and your browser.
• Why: the purposes in “How we use it”.
• Who receives it: the service providers in “Who we share it with”, for those purposes.
• Sold or shared for advertising: none, now or in the past 12 months. We don’t sell or share personal information, including about anyone under 16.
• Sensitive personal information: we don’t ask for it, and we don’t use any you send us to infer things about you.
• How long we keep it: as described in “How long we keep it”.

California residents can use the rights above: to know what we collect and how we use and disclose it, to get a copy, to correct it, to delete it, and not to be treated differently for using these rights. We don’t share personal information with other companies for their own marketing.

Other states. If you live in another state with a privacy law, you have the rights that law gives you, and you can use them the same way.

10. Children

This website is for businesses. It isn’t meant for children, and we don’t knowingly collect information from anyone under 16. If you think a child has sent us information, email privacy@belay.health and we’ll delete it.

11. Changes to this policy

We may update this policy. When we do, we’ll change the date at the top. If we make a significant change, we’ll point it out on this page.

12. Contact us