Privacy Policy

Effective Date: March 9, 2026

1. Introduction

TrainBase, LLC ("TrainBase," "we," "us," or "our"), a Texas limited liability company, provides a cloud-based training platform that helps medical practices create AI-powered training videos. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our website, platform, and related services (collectively, the "Services").

By accessing or using our Services, you agree to this Privacy Policy. If you do not agree, you must discontinue use of the Services.

2. Information We Collect

2.1 Account Information

• Name, email address, and contact details
• Organization name and role information
• Payment and billing information (processed and stored by Stripe; TrainBase does not store full credit card numbers)
• Subscription tier and account preferences
• Authentication credentials (passwords are stored as salted, one-way hashes)

2.2 Content You Create

• Screen recordings of your workflows and systems
• Audio recordings from your microphone
• Mobile video uploads of clinical environments and procedures
• Text scripts, training materials, and AI-generated content
• Editing metadata (crop regions, blur regions, trim points)

2.3 Automatically Collected Information

• Device type, operating system, and browser information
• IP address and approximate geographic location
• Pages visited, features used, and session duration
• Referring URLs and search terms

2.4 Cookies and Tracking Technologies

We use essential cookies required for authentication and session management. We do not use third-party advertising cookies. We may use analytics tools to understand how our Services are used. You can control cookie preferences through your browser settings, though disabling essential cookies may prevent you from using certain features.

2.5 Guest User Information

For users accessing our Guest Pass feature without creating an account:

• Temporary video recordings (automatically deleted; see Section 5.1)
• Device and browser information
• Session-level usage data (not linked to any identity)

3. How We Use Your Information

3.1 Service Delivery

• Process your recordings into training videos
• Generate AI-powered scripts, voiceovers, and summaries
• Provide video editing tools including face redaction, cropping, trimming, and blur
• Detect and redact Protected Health Information (PHI) using optical character recognition and natural language processing
• Deliver subscription services, invoicing, and hardware components

3.2 AI and Automated Processing

We use artificial intelligence and automated systems to:

• Analyze video content and generate training scripts (via Google Cloud Vertex AI)
• Generate synthetic voiceovers from post-redaction text scripts (via ElevenLabs)
• Detect and redact faces and PHI in video frames
• Provide training recommendations based on content analysis

Your content is transmitted to third-party AI processors as described in Section 4. We do not use your content to train third-party AI models. We contractually require our AI service providers not to use your data for model training.

3.3 Communications

• Service-related notifications (processing status, account changes)
• Security alerts and breach notifications
• Product updates and feature announcements (you may opt out of non-essential communications)

4. Third-Party Service Providers

We share information with the following categories of service providers, each of which processes data only for the purposes described:

4.1 Payment Processing

• Stripe, Inc. — Processes subscription payments and billing. Stripe's handling of your payment information is governed by Stripe's Privacy Policy.

4.2 AI and Content Processing

• Google LLC (Google Cloud Vertex AI) — Analyzes video content for script generation, training recommendations, and PHI detection assistance. Video content is transmitted to Google Cloud Vertex AI for processing under Google Cloud's Business Associate Agreement with TrainBase. Google Cloud's terms prohibit use of customer data for model training.
• ElevenLabs, Inc. — Generates synthetic voice audio from AI-generated text scripts. Only post-redaction text scripts are transmitted; raw video, audio, and PHI are never shared with ElevenLabs.

4.3 Cloud Infrastructure

• Amazon Web Services, Inc. (AWS) — Provides object storage (S3) for video files, thumbnails, and scripts.
• Railway Corp. — Provides application hosting and compute infrastructure.

4.4 Other Disclosures

We may disclose your information:

• As required by law, regulation, subpoena, or court order
• To protect the rights, safety, or property of TrainBase, our users, or others
• In connection with a merger, acquisition, or sale of assets (with prior notice)

We do not sell your personal information to third parties.

5. Data Retention and Deletion

5.1 Guest Users

• Guest recordings are scheduled for deletion within 24 hours of creation if not claimed by creating an account
• Deletion is performed through automated and periodic manual processes
• No account creation is required for guest access

5.2 Subscribers

• Your content remains available for the duration of your active subscription
• Upon cancellation or termination, your content is retained for 30 days to allow data export, then permanently deleted from our systems and cloud storage
• Account metadata (email, subscription history) may be retained for up to 3 years for tax, legal, and compliance purposes
• You may request deletion of your personal data at any time by emailing privacy@trainbase.com. We will respond to verifiable deletion requests within 30 days.

5.3 Transient Processing Data

Temporary files created during video processing (intermediate frames, audio segments, OCR data) are deleted promptly after processing is complete and are not retained as permanent records.

6. HIPAA Compliance

6.1 Protected Health Information (PHI)

We understand that medical training content may incidentally contain Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). TrainBase operates as a Business Associate under HIPAA when processing PHI on behalf of Covered Entities. We:

• Maintain administrative, physical, and technical safeguards for PHI as described in our Business Associate Agreement
• Provide a click-wrap Business Associate Agreement (BAA) that becomes effective upon acceptance of these Terms of Service for all subscriber accounts
• Strongly recommend using simulated patients and dummy data when creating training content
• Provide automated PHI detection and redaction tools to minimize PHI exposure in published content

6.2 Security Measures

• All data transmitted between your device and our servers is encrypted in transit using TLS 1.2 or higher
• Data stored in cloud infrastructure (AWS S3) is protected by the provider's server-side encryption
• Application-level access controls limit data access to authenticated, authorized users
• Role-based access control (Owner, Admin, Hunter, Trainee) restricts actions by permission level

7. Guest User Disclaimer

8. Your Rights and Choices

8.1 All Users

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request your data in a commonly used, machine-readable format
• Opt-Out: Opt out of non-essential communications at any time

8.2 Texas Data Privacy and Security Act (TDPSA)

If you are a Texas resident, you have the right to:

• Confirm whether we are processing your personal data and access such data
• Correct inaccuracies in your personal data
• Delete personal data you have provided or that we have obtained
• Obtain a portable copy of your personal data
• Opt out of the processing of personal data for targeted advertising, sale, or profiling

We do not sell personal data or use it for targeted advertising or profiling. To exercise your rights, contact privacy@trainbase.com. We will respond within 45 days. If we decline your request, you may appeal by contacting us at the same address.

8.3 California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purpose, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, completing transactions).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell personal information or share it for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Note: Medical information governed by the California Confidentiality of Medical Information Act (CMIA) and PHI governed by HIPAA are exempt from certain CCPA provisions. To submit a verifiable consumer request, contact privacy@trainbase.com. We will respond within 45 days.

8.4 Communication Preferences

• Opt out of marketing communications via the unsubscribe link in any email or by contacting us
• Service-related notifications (security, billing, processing status) cannot be opted out of while your account is active

9. Data Security

We implement commercially reasonable security measures designed to protect your information, including:

• TLS encryption for all data in transit
• Cloud provider server-side encryption for stored files
• Hashed and salted password storage
• Role-based access controls
• Regular security monitoring and incident response procedures

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of a security incident, please notify us immediately at privacy@trainbase.com.

10. International Users

Our Services are primarily designed for users in the United States. If you access our Services from outside the United States, you understand and consent to the transfer of your information to the United States, where data protection laws may differ from those in your jurisdiction.

EU/EEA Residents: If you are located in the European Union or European Economic Area, we acknowledge the applicability of the General Data Protection Regulation (GDPR). We process your personal data on the legal bases of contractual necessity (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)), and, where applicable, your explicit consent (Art. 6(1)(a)). You have the right to access, rectify, erase, restrict processing of, and port your personal data, as well as the right to object to processing. To exercise these rights, contact privacy@trainbase.com. International data transfers are conducted pursuant to Standard Contractual Clauses (SCCs) where required.

Other International Users: We extend the same data subject rights (access, correction, deletion, portability) to all users regardless of jurisdiction. Contact us to exercise these rights.

11. Children's Privacy

Our Services are intended for business use by authorized representatives of medical practices and are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. For material changes, we will provide at least 30 days' notice to active subscribers via email or in-platform notification before the changes take effect. Your continued use of the Services after the effective date of changes constitutes acceptance. The "Effective Date" at the top of this page indicates when this policy was last revised.

13. Contact Information

This Privacy Policy is incorporated into and subject to our Terms of Service below.

---

Terms of Service

Effective Date: March 9, 2026

These Terms of Service ("Terms" or "Agreement") constitute a legally binding contract between you ("Customer," "you," or "your") and TrainBase, LLC, a Texas limited liability company ("TrainBase," "we," "us," or "our"). By creating an account, subscribing to a plan, or using any part of our Services, you accept these Terms in full.

1. Service Description

TrainBase provides a cloud-based software platform (the "Services") that enables medical practices and healthcare organizations to create training videos by recording screen workflows and physical tasks, which are then processed using artificial intelligence for script generation, voiceover synthesis, video editing, and PHI redaction.

The Services include web-based tools, mobile-optimized interfaces, and any associated documentation or support materials provided by TrainBase.

2. Subscription Plans

2.1 Standard Tier ($199/month)

• Digital screen recording capabilities
• AI script generation and synthetic voiceover
• Video editing, trimming, and blur/redaction tools
• Workspace with role-based team access

2.2 Growth Tier ($499/month)

• All Standard Tier features
• Mobile camera upload functionality for clinical skills training
• Complimentary Studio Rig (overhead phone stand) provided upon signup
• Enhanced processing capabilities and priority support

2.3 Enterprise Tier

• Custom pricing and features for hospital systems and large organizations
• Requires a separately negotiated Master Services Agreement
• These Terms apply except to the extent superseded by the Master Services Agreement

2.4 Pricing Changes

Pricing is subject to change with 30 days written notice. Existing subscribers will be grandfathered at their current rate for 12 months following any price increase. After the 12-month grandfathering period, the then-current pricing will apply upon your next billing cycle.

3. Account Registration and Security

• You must provide accurate, current, and complete registration information
• You are responsible for maintaining the confidentiality of your account credentials
• You must promptly notify us of any unauthorized access to your account
• Account access may be shared with team members within your organization through our invitation system, subject to role-based permissions
• You may not share credentials or allow unauthorized individuals to access the Services under your account

4. Guest Pass Terms

4.1 Free Trial Access

Unauthenticated users may record and process one video for free through our public-facing website without creating an account ("Guest Pass"). Guest Pass usage is subject to these Terms and the additional restrictions in our Guest User Disclaimer.

4.2 Data Retention for Guest Users

4.3 Guest User Limitations

Guest users acknowledge they are using the Services at their own risk, without HIPAA protections, and without any warranty or data protection guarantees beyond those required by applicable law.

5. Hardware Terms

5.1 Studio Rig Provision

The Studio Rig provided to Growth Tier subscribers is a promotional tool included with the subscription service and is not a separate retail purchase. Title to the Studio Rig transfers to you upon delivery.

5.2 Hardware Warranty Disclaimer

TrainBase provides no warranty for third-party hardware beyond the original manufacturer's warranty terms. All hardware is provided "AS-IS" and TrainBase's sole liability for defective hardware is limited to replacement of defective units within 30 days of receipt, subject to availability.

6. Data Processing and Privacy

6.1 Data Types Processed

In the course of providing the Services, we process:

• Screen recordings of electronic medical record (EMR) systems and other software
• Audio recordings from user microphones
• Mobile video uploads of clinical environments, equipment, and procedures
• Text scripts and metadata generated by AI or provided by users

6.2 Third-Party AI Processing

The Services utilize third-party artificial intelligence providers to process your content:

• Google Cloud Vertex AI (Google LLC): Video and text content is transmitted to Google Cloud Vertex AI for script generation, content analysis, and training recommendations. Processing occurs under Google Cloud's BAA with TrainBase. Google Cloud's terms prohibit use of customer content for model training.
• ElevenLabs, Inc.: AI-generated text scripts (post-redaction) are transmitted for synthetic voice generation. Raw video, audio, and PHI are never transmitted to ElevenLabs.

By using the Services, you consent to this processing. You represent and warrant that you have all necessary rights and authorizations to submit content for AI processing.

6.3 PHI and HIPAA Compliance

• TrainBase strongly recommends using simulated patients and dummy data whenever possible to minimize PHI exposure
• TrainBase operates as a Business Associate under HIPAA when processing PHI on behalf of Covered Entities
• A click-wrap Business Associate Agreement (BAA) is automatically effective for all subscriber accounts upon acceptance of these Terms. This BAA satisfies the HIPAA requirement for a written agreement between Covered Entities and Business Associates.
• You are responsible for determining whether your use of the Services involves PHI and for complying with all applicable HIPAA requirements as a Covered Entity or Business Associate

7. Fair Use Policy

7.1 AI Generation Limits

To ensure service quality and prevent abuse, TrainBase reserves the right to impose reasonable limits on:

• Minutes of voice synthesis per billing period
• Number of videos processed per month
• Total storage capacity per workspace

Current limits are communicated within the platform. We will provide at least 30 days' notice before reducing limits that would affect your existing usage.

7.2 Acceptable Use

You agree not to:

• Use the Services for purposes other than legitimate training content creation
• Attempt to reverse-engineer, decompile, or extract source code from the Services
• Circumvent or disable security features, access controls, or usage limits
• Use the Services to store or distribute malware, illegal content, or content that infringes third-party rights
• Record or upload videos of individuals without their informed consent, in violation of applicable wiretapping, eavesdropping, or one-party/two-party consent laws
• Record or upload videos containing minors without verifiable parental or guardian consent
• Record or upload real patient encounters, protected health information (PHI), or personally identifiable information (PII) in Guest Mode, which is not HIPAA-compliant
• Share login credentials or allow unauthorized access to the Services
• Resell, sublicense, or commercially redistribute the Services or content generated by the Services

Enforcement: Violations of this Acceptable Use Policy may result in immediate account suspension, termination without refund, and reporting to applicable law enforcement authorities.

8. Payment Terms

8.1 Billing

• All subscriptions are billed monthly in advance on the calendar anniversary of your signup date
• Payments are processed through Stripe. By subscribing, you authorize recurring charges to your payment method
• You are responsible for keeping your payment information current
• Subscription fee changes require 30 days' advance written notice to active subscribers

8.2 Refunds

If you cancel within the first 14 days of your initial subscription, you may request a full refund by contacting support@trainbase.com. After the initial 14-day period, subscriptions are non-refundable for partial months. TrainBase may, at its sole discretion, issue refunds or credits in cases of documented service failures.

8.3 Late Payment

If payment fails, we will attempt to process the charge up to three times over 7 days. If payment remains unsuccessful, your account may be suspended. Content will be retained for 30 days following suspension, after which it may be permanently deleted.

9. Service Availability

TrainBase strives for high availability but does not guarantee uninterrupted access. The Services are provided on an "as available" basis. We will use commercially reasonable efforts to provide advance notice of scheduled maintenance. TrainBase is not liable for service interruptions caused by circumstances beyond our reasonable control (see Section 16).

10. Limitation of Liability

10.1 Liability Cap

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, TRAINBASE'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICES, WHETHER IN CONTRACT, TORT (INCLUDING NEGLIGENCE), STRICT LIABILITY, OR OTHERWISE, SHALL NOT EXCEED THE TOTAL AMOUNTS ACTUALLY PAID BY CUSTOMER TO TRAINBASE IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

10.2 Excluded Damages

IN NO EVENT SHALL TRAINBASE BE LIABLE FOR ANY INDIRECT, INCIDENTAL, CONSEQUENTIAL, SPECIAL, OR PUNITIVE DAMAGES, INCLUDING BUT NOT LIMITED TO LOSS OF DATA, LOSS OF REVENUE, LOSS OF PROFITS, LOSS OF BUSINESS OPPORTUNITIES, OR COST OF SUBSTITUTE SERVICES, EVEN IF TRAINBASE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

10.3 PHI-Specific Acknowledgment

Customer acknowledges that: (a) uploading content containing real patient data carries inherent risks; (b) automated PHI detection and redaction tools are aids, not guarantees, and may not identify all PHI; (c) Customer remains ultimately responsible for reviewing published training content for PHI before distribution; and (d) TrainBase's liability for PHI breaches is subject to the limitations in the Business Associate Agreement.

10.4 Not a Medical Device

TrainBase is a training content creation platform. It is not a medical device, clinical decision support system, or diagnostic tool. Training content generated by TrainBase (including AI-generated scripts, voiceovers, and quizzes) is intended solely for employee education and workflow documentation purposes. It should not be relied upon for clinical decision-making, patient diagnosis, treatment planning, or any purpose requiring medical judgment. Customer is solely responsible for verifying the accuracy of all AI-generated training content before use. TrainBase makes no warranty regarding the medical accuracy, completeness, or suitability of AI-generated scripts or voiceovers.

10.5 AI-Generated Content

Portions of the Service use artificial intelligence to generate training scripts, voiceovers, and quiz questions. Customer acknowledges that: (a) AI-generated content may contain errors, omissions, or inaccuracies; (b) AI-generated content should be reviewed by qualified personnel before publication; (c) the copyright status of AI-generated content is evolving under U.S. law, and TrainBase makes no representation that AI-generated output is copyrightable; and (d) Customer assumes responsibility for all uses of AI-generated content within their organization.

11. Customer Indemnification

You agree to indemnify, defend, and hold harmless TrainBase and its officers, directors, employees, and agents from and against any claims, damages, losses, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to:

• Your violation of these Terms or applicable law
• Your content, including any claims that content you upload infringes third-party intellectual property or privacy rights
• Your failure to comply with HIPAA or other applicable regulations governing PHI
• Unauthorized access to your account resulting from your failure to safeguard credentials

12. Data Security

TrainBase implements commercially reasonable security measures as described in our Privacy Policy (Section 9 above). Customer remains responsible for:

• Ensuring that users within your organization comply with your own privacy and security policies
• Reviewing published training content for inadvertent PHI before distributing to trainees
• Reporting suspected security incidents to privacy@trainbase.com promptly

13. Termination

13.1 By Customer

You may cancel your subscription at any time through your account settings or by contacting support@trainbase.com. Cancellation takes effect at the end of the current billing period. No refunds are issued for partial months after the 14-day initial period.

13.2 By TrainBase

TrainBase may suspend or terminate your access to the Services:

• Immediately, for material breach of these Terms (including non-payment after the cure period in Section 8.3)
• Immediately, if required by law or to prevent harm to other users
• With 30 days' notice, for any other reason

13.3 Data Retention Upon Termination

Upon cancellation or termination, your content will be retained for 30 calendar days to allow data export. After this retention period, all content (videos, scripts, thumbnails) will be permanently deleted from our servers and cloud storage. Account metadata may be retained as described in Privacy Policy Section 5.2.

13.4 Data Export

During the 30-day retention period following termination, you may download your published videos and scripts through the platform interface. For bulk data export requests, contact support@trainbase.com.

14. Intellectual Property

14.1 Your Content

You retain all ownership rights in the content you upload to the Services (including videos, recordings, and source materials). By uploading content, you grant TrainBase a limited, non-exclusive license to process, store, and display your content solely as necessary to provide the Services.

14.2 Output Content

Content generated by the Services from your source materials — including AI-generated scripts, synthetic voiceovers, edited videos, and training materials — is owned by you. TrainBase does not claim ownership of output content created from your inputs.

14.3 TrainBase Platform

TrainBase retains all rights, title, and interest in the Services, including the platform software, user interfaces, algorithms, AI models (excluding third-party models), documentation, and TrainBase trademarks. Nothing in these Terms transfers any TrainBase intellectual property to you.

15. Dispute Resolution

15.1 Governing Law

These Terms are governed by and construed in accordance with the laws of the State of Texas, without regard to its conflict-of-laws principles.

15.2 Informal Resolution

Before initiating formal dispute resolution, both parties agree to attempt to resolve any dispute informally by contacting the other party and negotiating in good faith for at least 30 days.

15.3 Binding Arbitration

Any dispute not resolved informally shall be resolved by binding arbitration administered by the American Arbitration Association ("AAA") under its Commercial Arbitration Rules, conducted in Houston, Texas. The arbitrator's decision shall be final and binding and may be entered as a judgment in any court of competent jurisdiction.

15.4 Arbitration Opt-Out

You may opt out of the arbitration provision by sending written notice to legal@trainbase.com within 30 days of accepting these Terms. If you opt out, disputes will be resolved in the state or federal courts located in Harris County, Texas, and both parties consent to personal jurisdiction in those courts.

15.5 Class Action Waiver

All disputes must be brought in an individual capacity, not as a plaintiff or class member in any purported class, consolidated, or representative proceeding.

16. Force Majeure

Neither party shall be liable for delays or failures in performance resulting from causes beyond its reasonable control, including but not limited to acts of God, natural disasters, pandemic, war, terrorism, government actions, power failures, internet or telecommunications outages, or third-party service provider failures. The affected party must provide prompt notice and use commercially reasonable efforts to resume performance.

17. Modifications to Terms

TrainBase reserves the right to modify these Terms. For material changes, we will provide at least 30 days' advance notice to active subscribers via email or in-platform notification. Your continued use of the Services after the effective date of modifications constitutes acceptance. If you do not agree to modified Terms, you must cancel your subscription before the effective date.

18. General Provisions

• Entire Agreement: These Terms, together with the Privacy Policy and BAA, constitute the entire agreement between you and TrainBase regarding the Services, superseding any prior agreements.
• Severability: If any provision of these Terms is found to be unenforceable, the remaining provisions shall remain in full force and effect.
• Waiver: TrainBase's failure to enforce any right or provision shall not constitute a waiver of that right or provision.
• Assignment: You may not assign these Terms without TrainBase's prior written consent. TrainBase may assign these Terms in connection with a merger, acquisition, or sale of all or substantially all of its assets.
• Notices: Notices to TrainBase must be sent to legal@trainbase.com. Notices to you will be sent to the email address on your account.

19. Contact Information

By creating an account or using TrainBase Services, you acknowledge that you have read, understood, and agree to be bound by these Terms of Service, our Privacy Policy, and our Business Associate Agreement.