This Privacy Policy explains how Case Close ("we," "us," "our") collects, uses, and protects information through our mobile application and website (together, the "Service"). It's written for the medical device sales representatives and distributor organizations who use Case Close, and it addresses how we handle protected health information ("PHI") encountered in the course of that use.
Who this applies to
Case Close is a business tool built for medical device sales representatives and the distributor companies that employ them. It is not directed at patients, and patients do not create accounts or interact with the Service directly.
Information we collect
- Account information: your name, company/distributorship name, email address, and password.
- Case information: photographs of case sheets, scheduler sheets, and inventory sheets you capture; the data extracted from them (which may include patient identifiers, dates of service, surgeon and hospital names, procedure types, and itemized product/lot information); electronic signatures; and any patient photo-consent records you collect through the Service.
- Business data: manufacturer and hospital contacts, inventory records, pipeline/CRM notes, and invoicing information you enter.
- Payment information: subscription and billing details are handled entirely by our payment processor, Stripe. We do not receive or store your card number.
- Usage information: standard technical logs (device type, app version, timestamps) needed to operate and troubleshoot the Service.
How we use this information
We use the information above solely to provide the Service: to let you capture and process case sheets, generate and send restock and billing documents, track inventory, manage your sales pipeline, and administer your account and subscription. We do not sell personal information or PHI, and we do not use PHI for advertising.
How photo/voice data is processed
When you photograph a case sheet, scheduler sheet, or inventory sheet, the image is sent to an AI model (Anthropic's Claude, hosted on Amazon Web Services via Amazon Bedrock) to extract the data you requested. When you dictate case details or notes, the audio is sent to OpenAI's transcription API to convert it to text. Both of these processing steps happen under service agreements appropriate to the handling of PHI; see "Subprocessors" below.
Subprocessors
We rely on the following service providers to operate Case Close, each of which processes data only as necessary to provide their respective service to us:
- Supabase — database, authentication, and file storage.
- Amazon Web Services (Bedrock) — AI-based extraction from photographed documents.
- OpenAI — voice transcription.
- Stripe — subscription billing and payment processing.
- Your connected email provider (e.g. Gmail, Yahoo) — sending restock/billing emails on your behalf, using an account you explicitly connect and authorize.
HIPAA
Case sheets and related records processed through the Service may contain protected health information. We maintain administrative, technical, and physical safeguards designed to protect this information consistent with the HIPAA Security Rule, including encryption in transit and at rest, access controls scoped to your organization, and audit logging. Where required, we enter into Business Associate Agreements with the distributor organizations and subprocessors handling PHI on our behalf.
Data retention
We retain case and account data for as long as your account is active, or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your account and associated data by contacting us (below), subject to any retention we're required to maintain by law or by agreement with your organization.
Your rights
You may request access to, correction of, or deletion of your personal information by contacting us at the email below. If you're a rep using Case Close under a distributor organization's account, some requests may need to be coordinated with your organization's administrator.
Children's privacy
Case Close is a business tool intended for adult professional use and is not directed at children. We do not knowingly collect information from children.
Changes to this policy
We may update this policy from time to time. We'll update the "Last updated" date above when we do.
Contact us
Questions about this policy or your data can be sent to support@caseclosemed.com.