Privacy.
Stoneset Inc. is a California corporation that builds software, most of it for healthcare. This page covers two separate things: this website, and the data that reaches Stoneset’s applications when someone uses them.
This website
This site sets no cookies, runs no analytics, and carries no advertising or tracking scripts of any kind. Nothing on it profiles you, and nothing follows you off it.
It is served by Vercel and its DNS is handled by Cloudflare. Like any web host, those providers keep ordinary request logs — IP address, timestamp, page requested — for operational and security purposes, under their own policies. Stoneset does not read those logs to identify visitors and does not combine them with anything else.
If you email support@stonesetinc.com, Stoneset keeps that correspondence in order to reply to it, and for no other purpose.
Stoneset’s applications
Stoneset’s software is built for named professional practices under written agreement, not offered for public sign-up. Access to each application is invitation-only: an account is created by arrangement, and someone who has not been added cannot get in by any means, including by presenting a valid identity from another provider.
Where an application handles protected health information, the practice is that information’s custodian and Stoneset processes it only for the purposes their agreement permits. Data is stored in Amazon Web Services, in a Stoneset account covered by a Business Associate Agreement with AWS, encrypted in transit and at rest. Stoneset does not sell data, does not use it for advertising, and does not use it to train machine-learning models.
Signing in with Google
Some Stoneset applications let an authorised user sign in with a Google account. When they do, Google shares three things: the account’s email address, basic profile information such as a display name, and whether Google considers that email address verified.
That data is used for exactly one purpose — to establish who is signing in and to check the address against the list of people already authorised for that application. Signing in with Google never creates an account; an unrecognised address is refused.
Calendar access
One Stoneset application, SYNC-OP, connects to a practitioner’s own Google Calendar in order to count appointments against a client’s authorised sessions. This access is requested separately from sign-in and granted explicitly by the account holder. The application reads appointments; it does not create, change, or delete calendar entries except for features the account holder has expressly enabled, and it never writes clinical information into a calendar unless the practice has confirmed a Business Associate Agreement covers its Google Workspace.
Calendar information is used solely to derive that count and to raise the questions the software cannot answer on its own. It is not used for any other purpose, not transferred to anyone else, and not used to train any model.
Google API Services User Data Policy
Stoneset’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Service providers
Stoneset uses a small number of providers to operate this software: Amazon Web Services for hosting and storage, Google for sign-in and calendar access where an account holder has granted it, and a telecommunications carrier to deliver plain notification messages that contain no personal or clinical information. No one else receives this data.
Withdrawing access, and deletion
You can revoke an application’s access to your Google account at any time at myaccount.google.com/permissions. Doing so stops all further access immediately.
To ask what Stoneset holds about you, or to have it deleted, email support@stonesetinc.com. Where the information belongs to a healthcare provider’s record rather than to Stoneset, the provider decides such requests — Stoneset will say so and tell you who to ask.
Children
Stoneset’s software is sold to professional practices and is not directed at children. Where a practice’s records concern a minor, those records are the practice’s and are governed by its agreements with the family.
Changes
If this policy changes in a way that affects how data is used, the date at the top of this page changes with it. Material changes affecting an existing client are also raised with that client directly rather than left to be noticed here.
Contact
Stoneset Inc., California, USA — support@stonesetinc.com. Replies within two business days.