Privacy Policy

Effective Date: March 16, 2026

Thrawn, Inc. ("Thrawn," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at www.trythrawn.com, platform, and related services (collectively, the "Service").

By using the Service, you consent to the practices described in this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

Account Information: Name, email address, institution or program name, phone number, and job title when you create an account or request a consultation.
Scheduling Data: Rotation and block structures, call and clinic requirements, resident and fellow rosters, PGY levels, duty hour rules, vacation and time-off requests, rotation and elective preferences, prior assignment history, educational requirements, and other program constraints you provide to us for schedule generation.
Contact Form Submissions: Name, email, program details, and message content when you contact us through our website.
Payment Information: Billing details processed through our third-party payment processor. We do not store full credit card numbers on our servers.

Thrawn's Service is built to schedule clinicians, not to manage patients. We do not require, and ask that you do not send us, patient records or protected health information (PHI).

1.2 Information Collected Automatically

Usage Data: Pages visited, features used, time spent on the Service, referring URLs, and interaction patterns.
Device Information: Browser type, operating system, device type, IP address, and general location (city/region level).
Cookies and Similar Technologies: We use cookies and similar tracking technologies to maintain sessions, remember preferences, and analyze usage. See Section 6 for details.

1.3 Information from Third Parties

We may receive information from third-party services your program connects to your account (for example, residency management systems, calendar systems, or HR and credentialing systems) solely for the purpose of generating and delivering your schedules.

2. How We Use Your Information

We use the information we collect to:

Provide the Service: Process your program's scheduling constraints, generate block, call, clinic, and attending schedules, and deliver finished schedules to your team.
Communicate with You: Send account notifications, schedule deliveries and revisions, consultation follow-ups, and responses to inquiries.
Improve the Service: Analyze usage patterns, diagnose technical issues, and develop new features.
Ensure Security: Detect and prevent fraud, unauthorized access, and other security threats.
Comply with Legal Obligations: Meet regulatory requirements, respond to lawful requests, and enforce our Terms of Service.

We do not sell your personal information to third parties. We do not use your program's scheduling data to train models offered to other customers without your written agreement.

3. How We Share Your Information

We may share your information only in the following circumstances:

Service Providers: With trusted third-party vendors who assist us in operating the Service (e.g., cloud hosting, payment processing, email delivery). These providers are contractually obligated to protect your data and use it only for the services they provide to us.
Within Your Institution: Finished schedules and related outputs are delivered to the program contacts your institution designates.
Legal Requirements: When required by law, regulation, legal process, or governmental request.
Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change.
With Your Consent: When you explicitly authorize us to share your information.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

Account and scheduling data: Retained for the duration of your agreement with Thrawn, plus a reasonable period afterward to support schedule history, revisions, and accreditation recordkeeping requested by your program. Retention periods may be set in your service agreement.
Contact form submissions: Retained for up to 2 years.
Usage and analytics data: Retained in aggregated, anonymized form indefinitely.

You may request deletion of your data at any time by contacting us (see Section 11). Certain data may be retained as required by law or by the terms of your institution's agreement.

5. Data Security

We implement industry-standard security measures to protect your information:

Encryption: Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Access Controls: Role-based access controls limit data access to authorized personnel only.
Audit Logging: Access to program data is logged.
Infrastructure: Our systems are hosted on secure, enterprise-grade cloud infrastructure with redundancy and backup.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

6. Cookies and Tracking Technologies

We use cookies and similar technologies for:

Essential Cookies: Required for the Service to function (e.g., authentication, session management).
Analytics Cookies: Help us understand how visitors use our website so we can improve it.

You can control cookies through your browser settings. Disabling essential cookies may impair Service functionality.

7. Education Records and FERPA

Resident and fellow scheduling information provided by an institution may constitute an education record under the Family Educational Rights and Privacy Act (FERPA). Where Thrawn processes such information on behalf of an institution, we act at the institution's direction as a school official with a legitimate educational interest, use the information only to provide the Service, and do not redisclose it except as permitted by the institution or required by law. Residents and fellows should direct requests regarding their education records to their sponsoring institution.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information, subject to legal retention requirements.
Portability: Request your data in a structured, machine-readable format.
Opt-Out: Opt out of non-essential communications at any time.

If your information was provided to us by your institution, we may direct your request to that institution.

To exercise any of these rights, contact us at privacy@trythrawn.com.

9. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

The right to know what personal information we collect, use, and disclose.
The right to request deletion of your personal information.
The right to opt out of the sale of personal information. We do not sell personal information.
The right to non-discrimination for exercising your privacy rights.

To submit a CCPA request, contact us at privacy@trythrawn.com.

10. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from a child under 18, we will take steps to delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Effective Date" above. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, contact us at:

Thrawn, Inc. Email: privacy@trythrawn.com Website: www.trythrawn.com