Privacy Policy

01Who is responsible

For your account data (as our customer), the controller is CodeSoft Lab LLC.

For patient and caregiver data entered by a practice, the controller is the practice; CodeSoft Lab LLC acts as processor. Patients who wish to exercise their rights should first contact their practice.

02Data we process

Depending on use:

• Account details: name, email, phone, role, practice
• Patient data entered by the practice: contact details, history, diagnoses, exams, treatments, appointments, documents
• Inpatient caregiver data: name, relationship, contact details
• Usage data: sign-ins, actions in the app (activity history)
• Technical data: IP address, browser, device
• Payment details: processed directly by the payment provider — we do not store card numbers

03Why we use it

We use data to:

• provide, secure and improve the service
• manage your account and subscription
• send notifications, reminders and portal links on behalf of the practice
• provide technical support
• comply with legal obligations

04Legal basis

Processing is based on our contract with you, our legal obligations, our legitimate interests (e.g. service security) and, where required, consent. For health data, the legal basis is determined by the practice as controller.

05Partners & sub-processors

We do not sell or share data for commercial purposes. We only use the necessary providers, bound by confidentiality and security obligations:

• hosting and database
• email and SMS delivery
• subscription payments
• telehealth video
• AI provider — only if the practice enables AI features with its own key
• Google Calendar — only if the practice connects its account

06Transfers outside the EEA

If a provider processes data outside the European Economic Area, the transfer takes place with the appropriate safeguards required by the GDPR.

07Security

We apply technical and organisational measures, including:

• encryption in transit (TLS) and at rest
• per-practice data isolation at database level (row-level security)
• roles and permissions per member (RBAC)
• portals with personal, time-limited links
• an activity history for every record
• regular backups

08Retention

Account data is kept while the subscription is active and for a reasonable period afterwards for legal and accounting purposes. Patient data is kept according to the practice's instructions and medical record-keeping obligations; after the relationship ends, the practice can request its export and deletion.

09Your rights

Under the GDPR you have the right to:

• access your data
• rectify inaccurate data
• erasure
• restrict processing
• data portability in a readable format
• object
• withdraw consent at any time
• lodge a complaint with the competent supervisory authority

10Cookies

We use the necessary cookies and browser local storage to run the app: sign-in, security and preferences such as language and appearance. These do not require consent.

Only if you accept it in the cookie notice, we measure traffic anonymously and in aggregate (Vercel Web Analytics) to improve our pages. We do not use advertising cookies or third-party tracking cookies.

You can change your choice at any time from the "Cookie settings" link at the bottom of every page.

11Contact

For questions about data protection or to exercise your rights, write to us at info@codesoftlab.com.