Privacy Policy

What We Collect

• Account information: name, email address, and organization name (provided during sign-up via OAuth)
• Compliance records: document titles, types, categories, dates, status, and assigned staff names
• File attachments: documents you upload related to compliance records
• Usage data: pages visited, features used, and session information
• Payment information: processed by Stripe; we do not store credit card numbers

What We Do Not Collect

• No patient health information (PHI)
• No clinical records, patient charts, or diagnostic data
• No personal health numbers or OHIP numbers
• No credit card numbers

Back Office Hub is not an electronic health record (EHR) system. It tracks operational compliance documents only.

Data Storage and Security

• All data transmitted over HTTPS (TLS encryption in transit)
• File uploads stored in encrypted cloud object storage (S3)
• Database records stored on managed cloud infrastructure
• Authentication handled via OAuth (no passwords stored)
• Role-based access: only authorized members of your organization can view your data
• Organization data isolation: clinics cannot access each other's records

Third-Party Services

• Stripe for payment processing
• Resend for transactional email delivery
• Manus OAuth for authentication

Data Retention

We retain your data for as long as your account is active. If you cancel and request deletion, we remove your data within 30 days. Backup copies may persist for up to 90 days.

Your Rights

• Export your records to CSV at any time
• Request deletion of your organization's data
• Contact us with privacy questions at healthopsrx@gmail.com