Privacy Policy

1. Who we are

This Privacy Policy describes how TogaTech, LLC, a Virginia limited liability company doing business as Medical Cyber Specialties (“we,” “us,” or “our”), handles information in connection with the SwimLanes website and platform.

2. Account information

When you create an account, we collect your email address, display name, and your organization affiliation. This is used to operate your account, authenticate you, and deliver the service — not sold or shared for advertising purposes.

3. Anonymous visitor analytics

When you visit our public marketing pages (before creating an account), we log the page visited, your IP address, browser user agent, and an approximate location (city/region/country) derived from your IP using a local, offline geolocation database — we do not send your IP to a third-party geolocation service for this. Known bots and automated crawlers are filtered out of this logging. This data is used internally to understand traffic to the site. We do not currently run an automated deletion schedule against this data.

4. Bot and abuse detection

On certain forms (such as registration), we use behavioral signals — mouse movement, touch, and timing patterns collected during your visit — to help distinguish real visitors from automated bots. This is scored in the moment and is not stored in a database; the outcome and basic request metadata (IP, user agent) may appear in server logs used for security troubleshooting.

5. Cookies

We use a single session cookie to keep you signed in. It is marked HttpOnly (not readable by page scripts) and SameSite=Lax, and expires automatically. We do not use a persistent “remember me” cookie or third-party advertising/tracking cookies.

6. Who we share information with

• Payment processing — Stripe, for billing and subscription management.
• Email delivery — either your organization's own configured email relay, or our platform's own email provider, solely to deliver account, security, and product emails.
• AI features (opt-in, per action) — if you or your organization chooses to use an AI-assisted feature, the content you submit for that specific action is sent to whichever AI provider (Anthropic, OpenAI, Google Gemini, or Microsoft Copilot) you or your organization has configured. This only happens when you take that action — it is never automatic or in the background.
• Sign-in providers — if you choose to sign in with Google, GitHub, Microsoft Entra ID, Okta, or a SAML identity provider, that provider shares your basic profile information with us to authenticate you.

We do not sell personal information.

7. Health information

SwimLanes is not designed or intended to store Protected Health Information (PHI). This matches the posture stated in our Software License Agreement. If your organization has a specific need to process PHI in connection with the service, contact us to discuss a Business Associate Agreement before doing so.

8. Your rights

We do not currently offer a fully automated self-service data export or deletion tool. To request access to, correction of, or deletion of your personal information, email david@medicalcyberspecialties.com and we will handle your request directly.

9. Children's privacy

This site is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

10. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision.

11. Contact

Questions about this policy? Reach us at david@medicalcyberspecialties.com or via our Contact page. See also our Terms of Service.