This Privacy Policy explains how Catalyst MedTech LLC dba CaseClose ("we," "us," "our") collects, uses, and protects information through our mobile application and website (together, the "Service"). It's written for the medical device sales representatives and distributor organizations who use CaseClose, and it addresses how we handle protected health information ("PHI") encountered in the course of that use.
Who this applies to
CaseClose is a business tool built for medical device sales representatives and the distributor companies that employ them. It is not directed at patients, and patients do not create accounts or interact with the Service directly.
Information we collect
- Account information: your name, company/distributorship name, email address, and password.
- Case information: photographs of case sheets, scheduler sheets, and inventory sheets you capture; the data extracted from them (which may include patient identifiers, dates of service, surgeon and hospital names, procedure types, and itemized product/lot information); electronic signatures; and any patient photo-consent records you collect through the Service.
- Business data: manufacturer and hospital contacts, inventory records, pipeline/CRM notes, and invoicing information you enter.
- Payment information: subscription and billing details are handled entirely by our payment processor, Stripe. We do not receive or store your card number.
- Usage information: standard technical logs (device type, app version, timestamps) needed to operate and troubleshoot the Service.
How we use this information
We use the information above solely to provide the Service: to let you capture and process case sheets, generate and send restock and billing documents, track inventory, manage your sales pipeline, and administer your account and subscription. We do not sell personal information or PHI, and we do not use PHI for advertising.
How photo/voice data is processed
When you photograph a case sheet, scheduler sheet, or inventory sheet, the image is sent to an AI model (Anthropic's Claude, hosted on Amazon Web Services via Amazon Bedrock) to extract the data you requested. When you dictate case details or notes, the audio is sent to OpenAI's transcription API to convert it to text. Both of these processing steps happen under service agreements appropriate to the handling of PHI; see "Subprocessors" below.
Subprocessors
We rely on the following service providers to operate CaseClose, each of which processes data only as necessary to provide their respective service to us:
- Supabase — database, authentication, and file storage.
- Amazon Web Services (Bedrock) — AI-based extraction from photographed documents.
- OpenAI — voice transcription.
- Stripe — subscription billing and payment processing.
- Your connected email provider (e.g. Gmail, Outlook, or another email service) — sending restock/billing emails on your behalf, using an account you explicitly connect and authorize.
Google user data (Gmail)
If a user chooses to connect a Gmail account, CaseClose asks for one permission: to send email on that user's behalf (the Gmail "send" permission). We use it only to send the restock, billing and case-completion emails the user starts from within CaseClose, from the user's own address. We do not read, search, store or index the content of the user's mailbox, and we do not access their inbox, contacts or other Google data.
We store an encrypted authorization token so sending keeps working. It is used only to send those emails. We do not sell Google user data, use it for advertising, or share it with third parties except as needed to deliver the email the user asked us to send. No humans read Google user data. Users can disconnect at any time in the app or at myaccount.google.com/permissions, and we delete the stored token when they disconnect or their account is removed.
CaseClose's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
HIPAA
Case sheets and related records processed through the Service may contain protected health information. We maintain administrative, technical, and physical safeguards designed to protect this information consistent with the HIPAA Security Rule, including encryption in transit and at rest, access controls scoped to your organization, and audit logging. Where required, we enter into Business Associate Agreements with the distributor organizations and subprocessors handling PHI on our behalf.
Data retention
We retain case and account data for as long as your account is active, or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your account and associated data by contacting us (below), subject to any retention we're required to maintain by law or by agreement with your organization.
Your rights
You may request access to, correction of, or deletion of your personal information by contacting us at the email below. If you're a rep using CaseClose under a distributor organization's account, some requests may need to be coordinated with your organization's administrator.
Children's privacy
CaseClose is a business tool intended for adult professional use and is not directed at children. We do not knowingly collect information from children.
Changes to this policy
We may update this policy from time to time. We'll update the "Last updated" date above when we do.
Contact us
Questions about this policy or your data can be sent to support@caseclosemed.com.