Privacy Policy

Blue Banana EHR (“Blue Banana”, “we”, “us”) is a synthetic FHIR R4 mock electronic health records service operated by Keragon, Inc. (“Keragon”) at bluebananaehr.com. Blue Banana exists to help developers and our internal teams build and test healthcare integrations against fully synthetic patient data. Blue Banana never stores, processes, or transmits real Protected Health Information (PHI).

This Privacy Policy explains what we collect about you when you create a developer account, sign in, and use the service.

a. Information you provide

• Account information — email address and a hashed password when you sign up with email and password.
• Google account information— if you choose “Sign in with Google”, Google shares your email, name, profile picture, and Google account ID with us. We request only the basic profile and email scopes. We do not request access to your Gmail, Drive, Calendar, Contacts, or any other Google service.
• API keys you create — friendly names you choose for the API keys you mint on /account. The secret value of each key is hashed at rest; we display it only once at creation time.

b. Information collected automatically

• Session cookies — a first-party HTTP-only cookie issued by our auth system (Better Auth) so you stay signed in. No third-party tracking cookies are set.
• Request metadata — IP address, user agent, and timestamps for the API and dashboard requests you make. We use this to enforce rate limits, debug errors, and prevent abuse.
• Tenant identifier — every authenticated user is assigned a dev-<id> tenant so the synthetic data you write is isolated from other developers.

c. What we do not collect

Blue Banana is designed for testing. We do not ask for and we do not want real patient data. Every FHIR resource hosted by Blue Banana is generated by Synthea and tagged with the extension http://bluebananaehr.com/synthetic-data: true. Do not upload real PHI; if you do, you are violating these terms and we will delete it.

We use the information described above to:

• Authenticate you and keep your account secure.
• Provision and isolate your developer tenant.
• Send transactional email — account verification, password resets, and security notifications — via our email provider (Resend).
• Enforce rate limits and detect abuse.
• Diagnose errors and improve the service.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use it for advertising.

When you choose to sign in with Google, we receive your basic Google profile (email, name, profile picture, and Google account ID) through Google's OAuth flow. We use this information solely to:

• Create or sign you into your Blue Banana account.
• Display your name and profile picture in the dashboard.
• Send you transactional email at your Google address.

We do not request, store, transmit, or use your Google data for any other purpose. We do not share your Google data with third parties, and we do notuse it to train machine-learning models. Blue Banana's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Blue Banana's access at any time from your Google account at myaccount.google.com/permissions.

We share personal information only with the service providers we need to run Blue Banana, and only to the extent required for them to provide their service to us:

• Vercel — application hosting and serverless compute.
• Neon — managed Postgres database where your account and tenant records live.
• Resend — outbound transactional email (verification, password reset).
• Google— only if you choose “Sign in with Google”, and only via the standard OAuth flow.

We will also disclose information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, the safety of users, or the integrity of the service.

• Account data— kept while your account is active and for a short period after closure to satisfy backup and legal-records retention. You can request deletion at any time (see “Your rights” below).
• API keys — kept until you revoke them or close your account.
• Logs — request and error logs are retained for a rolling window (typically 30 days) for security and debugging.

We use industry-standard safeguards to protect your account: TLS in transit, hashed passwords and API key secrets, scoped database access, and SSRF protections on outbound webhooks. No system is perfectly secure — if you believe your account has been compromised, contact us immediately at legal@keragon.com.

You can, at any time:

• Access the account information we hold about you from your /account page.
• Correct inaccurate information by editing your profile or contacting us.
• Delete your account and all associated tenants by emailing legal@keragon.com.
• Revoke Google access from your Google account permissions page at any time.

Depending on where you live (e.g. EEA, UK, California), you may have additional rights under GDPR, UK-GDPR, CCPA, or similar laws — including rights to data portability and to object to processing. To exercise any of these rights, email us at legal@keragon.com.

Blue Banana is a developer tool and is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

Blue Banana is operated from the United States. If you access the service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

We may update this policy from time to time. When we make material changes we will update the “Last updated” date at the top of the page and, where appropriate, notify signed-in users by email. Your continued use of the service after an update means you accept the revised policy.

Questions about this policy or how we handle your information? Email us at legal@keragon.com.

Keragon, Inc. · United States