HL7 Edge Gateway — Account and Commerce Privacy Notice

Version: 2026-10-30

Published: October 30, 2026

Gurande Chameshi Inc., doing business as Lambogenius, administers the account, commerce, license-delivery, download and support services described here. Contact legal@lambogenius.com for privacy questions, access/correction/deletion requests, complaints or suspected privacy incidents. Contact hello@lambogenius.com for billing and technical support. Lambogenius's Privacy Officer, a member of Lambogenius management, is accountable for privacy compliance, requests and incident response and can be reached at legal@lambogenius.com; both mailboxes are monitored.

Information and purposes

We process account/sign-in information supplied by the chosen identity provider, organization and contact details, payment-provider customer/subscription references, purchased edition and price, agreement/consent records, payment/subscription status, license identifiers and issuance records, authenticated download audit records, and information voluntarily supplied for support. These records support account identification, security and abuse prevention, payment, license administration, downloads, support and necessary business/acceptance records.

Stripe hosts card collection. Full card numbers are not submitted to Lambogenius through hosted Checkout. Stripe and identity providers describe their own processing in their applicable notices. Do not send full license credentials, API/access/purchase tokens, passwords, private keys, patient data or message payloads to support.

Customer-hosted Gateway processing

Gateway operates in Customer's chosen infrastructure and validates signed license credentials offline. The commerce integration does not send Gateway messages, patient information, maps or routing configuration to Lambogenius for license verification. Customer controls its configured sources, destinations, logs, storage, queues, archiving and external services. Their data processing, security and retention requirements must be assessed separately by Customer.

This notice is for Lambogenius account/commerce/support services. It is not a patient-data processing agreement, clinical certification, or an agreement to host or review healthcare payloads. Separately agreed services may need additional terms and privacy arrangements before sensitive information is provided.

Service providers and international processing

The current account/commerce delivery architecture uses DigitalOcean for backend application hosting; Supabase for the application database; Upstash for cache; Cloudflare for website delivery and object storage; and Stripe for payment services. Available sign-in options use Microsoft, Google or GitHub. Information is disclosed to relevant providers for the service functions above, subject to the applicable service arrangements. Customer's selected identity and payment providers also operate under their own terms and notices.

Account and commerce information may be processed outside Customer's province or country and be subject to applicable access laws there. No Canada-only storage or processing promise is made. We may disclose information when legally required or as part of a business transfer subject to appropriate protections. This notice does not authorize sale of Customer data.

Retention, requests and safeguards

Records are retained while needed for the purposes for which they were collected and applicable contractual, accounting, legal, dispute or security obligations. Retention varies by record category. Information no longer required is deleted or anonymized through the applicable operating process. There is no single universal retention period or automatic account-deletion promise.

Contact legal@lambogenius.com to request access, correction, deletion or information about processing. We may verify identity and organization authority before acting. Requests are reviewed manually. We may retain records required for applicable obligations, disputes, security or protected backups and explain relevant limits. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or another privacy authority with jurisdiction. Deleting an account does not necessarily remove required records or all provider and backup copies immediately. Purchased rights and required consent records are not silently altered as a consequence of a request.

We use access controls, authentication and other safeguards appropriate to the service. No system is represented as risk-free. Report suspected account or credential issues promptly without including the credential itself. Management coordinates assessment, containment, appropriate assistance and any required incident response or notifications for the actual circumstances.

Changes

An approved notice will be published with its version. Material changes will be presented through the service or an appropriate contact mechanism. Updating a privacy notice does not silently amend existing software agreements or purchased rights.