Privacy Policy

What we collect

• Contact form: your name, practice, email address and message, and your internet (IP) address to stop spam and abuse.
• Customer portal accounts: name, email address, role and practice, a securely hashed password (we never store the password itself), sign-in times and the IP address used, for security.
• Your practice’s settings: practice name, number of kiosks, plan and game choices, Learning corner choices, and branding you upload or choose (logo, colors, mascot pictures and names, fonts, music), plus support requests and messages.
• Orders and billing: the products and amounts you buy, the shipping name, address and phone number you give at checkout, and the status of your payments, subscription and invoices. Card and bank details are entered directly into Stripe’s secure form and are kept by Stripe; we only see the card brand, the last four digits and the expiry date.
• Kiosks: technical information only: a security key for each kiosk, when it last checked in, its software version, computer name, update and security (network lockdown) status, and its IP address.
• Website demos: a temporary cookie that times your two-minute demo. Scores are not saved and no names are collected.
• Server logs: like most websites, our server records requests (such as the page, time and IP address) to keep the service secure and working.

Children and the kiosks

The kiosks are made for children to play on in waiting rooms. They do not collect personal information from children: there are no accounts, names, photos, cameras, microphones or saved scores, and nothing a child does on a kiosk is sent to us. Lessons are read aloud from recordings stored on the kiosk.

Our website and customer portal are meant for adults at practices (and parents trying the demos), not for children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, please contact us and we will delete it.

Health information

PediatricGames does not need, and asks you not to provide, patient or other health information. The kiosks and portal are not designed to hold it, and we are not a HIPAA business associate for this service. If health information is sent to us by mistake, we delete it when we notice it.

How we use information

• To build, ship, brand, update and support your kiosks and run your customer portal.
• To take payments, send receipts and invoices, and keep the records the law requires.
• To answer messages and requests, and to send service emails (such as password links, order and billing notices). We do not send marketing email without your permission.
• To keep the website, portal and kiosks secure, prevent fraud and abuse, and fix problems.
• To meet legal obligations and enforce our Terms of Service.

Who we share it with

We do not sell or rent personal information, and we do not use advertising or tracking cookies. We share information only with companies that help us run the service, under contracts that protect it, or when the law requires:

• Stripe (payments and invoices).
• SMTP2GO (sending our emails).
• Cloudflare (website delivery and security; it sees visitors’ IP addresses).
• OpenAI, only if your practice uses the optional AI mascot maker: the description you type is sent to create the picture.
• Authorities or others when required by law or to protect rights and safety, and a buyer of our business if it is sold (under this policy).

Cookies

We use only cookies that the website needs to work: a sign-in cookie for the customer portal, a security cookie for the contact form and a timer cookie for the two-minute demos. The payment form in the customer portal is provided by Stripe, which uses its own cookies for fraud prevention (see Stripe’s privacy policy). We do not use analytics or advertising cookies.

How long we keep it

We keep account, practice and support information while you are a customer and for a reasonable time afterwards, payment and tax records for as long as the law requires (typically seven years), contact-form messages for up to two years, and server logs for a short period, usually no more than 90 days. You can ask us to delete information earlier where the law allows.

Security

We protect information with encryption in transit (HTTPS), hashed passwords, access limited to people who need it, signed and checked kiosk updates, and kiosks locked down so they cannot reach your office network. No system is perfectly secure; if we learn of a breach affecting your information we will tell you as the law requires.

Your choices and rights

You can see and update most of your information in the customer portal. You can ask us for a copy of your personal information, or to correct or delete it, by emailing [email protected]. Depending on where you live, you may have additional rights under state privacy laws; we will honor them as required and will not treat you differently for using them. We may need to confirm your identity before acting on a request.

Changes to this policy

If we change this policy we will post the new version here with a new date and, for significant changes, tell customers by email or in the customer portal.