Privacy Policy

1. Who This Applies To, and Our Role

This Policy covers information collected through the Service itself — our website, application, and related communications. It applies to account holders and Authorized Users at client organizations ("you," "your"). If your organization has signed a Master Services Agreement with us, that agreement's data protection terms (including this Policy as incorporated there) govern your organization's use in addition to this page.

For account, contact, and billing information, we determine how and why that information is used. For Schedule Data your organization enters (physician names, roles, availability, PTO, coverage rules), your organization controls that information and directs how it's processed; we process it on your organization's behalf to provide the Service. If you have questions about Schedule Data your organization controls, you may need to contact your organization's administrator directly.

2. Information We Collect

• Account information: Name, email address, organization/clinic name, and login credentials, managed through our authentication provider, Supabase.
• Billing information: Payment method and billing details (such as card type, expiration date, and last four digits) are collected and processed by our payment processor, Stripe. We do not store full credit card numbers on our own servers.
• Clinic and schedule data: Physician and staff names, roles, coverage rules, PTO/availability entries, and generated schedules that you or your organization enter into the Service ("Schedule Data"). The Service does not require a medical reason, diagnosis, or other patient information to record why someone is unavailable — please enter only the scheduling information necessary, and do not put medical or patient details into notes, labels, or other free-text fields.
• Technical and usage data: IP address, browser and device type, pages visited, and similar log data, collected to operate, secure, and improve the Service.
• Communications: Messages you send us (support requests, demo requests) and our replies.

We do not intentionally collect Protected Health Information (PHI) or other patient-identifying information. See Section 7.

3. How We Use Information

We use information to:

• Provide, operate, and maintain the Service, including generating and updating call schedules.
• Process payments and manage your subscription.
• Communicate with you about your account, billing, updates, and support.
• Monitor, secure, and improve the Service, including diagnosing technical issues.
• Comply with legal obligations and enforce our Terms of Service.

We do not use your information to train third-party AI models, and we do not use Schedule Data for any purpose unrelated to providing the Service, except as described in Section 5.

4. Legal Basis / Consent (where applicable)

Where required by applicable law, our basis for processing your information is: performance of our contract with you (providing the Service), your consent (e.g., for optional communications), and our legitimate interest in operating and securing the Service.

5. Sharing of Information

We do not sell your personal information. We share information only:

• With service providers who process data on our behalf, currently: Supabase (authentication and database hosting), Stripe (payment processing), and Vercel (application hosting/infrastructure). These providers are contractually restricted to using data only to provide services to us.
• As required by law, such as in response to a valid subpoena, court order, or government request.
• To protect rights, safety, or property — ours, our users', or the public's, including to investigate fraud or security incidents.
• In connection with a business transfer (merger, acquisition, or sale of assets), subject to this Policy or a substantially similar one.

Our list of current service providers may change as our infrastructure evolves; we will keep this section reasonably current and will not materially reduce the protections described here without notice.

6. No Sale of Information, Advertising, or Profiling

We do not sell personal information for money. We do not use personal information for targeted advertising across unrelated websites or services, and we do not profile individuals in ways that produce legal or similarly significant effects (such as decisions about employment, credit, healthcare, or insurance). If this changes, we will update this Policy and provide any notice or opt-out required by applicable law before applying a new practice.

7. HIPAA and Patient Information

The Service is an administrative scheduling tool. It is not designed or intended to receive, store, or process PHI or other patient-identifying information, and OrchestrateHealth does not act as, or represent itself as, a HIPAA Business Associate absent a separate signed Business Associate Agreement. You are responsible for ensuring that you and your organization do not enter PHI or patient-identifying information into the Service.

8. Sensitivity of Schedule Data

Call schedules, combined with a physician's identity and expected location, can reveal where a specific person is expected to be at a specific time. Your organization is responsible for controlling who has access to Schedule Data and for not distributing it through unsecured or public channels. We provide access controls in the Service to support this; using them is your organization's responsibility.

9. Data Storage and Security

We use industry-standard cloud infrastructure (Supabase, Vercel) to store and manage data, with payment data handled by Stripe. Data is encrypted in transit and at rest. We apply role-based access controls limiting our own personnel's access to data to what's needed to operate and support the Service. No system is completely secure, and we cannot guarantee against all unauthorized access.

10. Security Incident Notification

If we become aware of a security incident resulting in unauthorized access to or disclosure of your data, we will notify affected account holders without undue delay after confirming the incident, with information reasonably available to us about the nature and scope, to help you determine appropriate next steps.

11. Cookies and Local Storage

We use cookies and local storage for authentication, session management, and remembering your preferences. We do not use cookies for advertising or third-party tracking.

On our public marketing pages, we also collect anonymous, first-party analytics — pages viewed, buttons clicked, and general navigation paths — using a randomly generated identifier stored in your browser's local storage. This identifier is not tied to your name, email, or account, is not shared with third parties, and is not used for advertising.

12. Data Retention

We retain account and Schedule Data for as long as your account is active, and for a limited period after cancellation or suspension to allow for data export and account recovery, after which it may be permanently deleted. See our Terms of Service for retention timelines tied to non-payment or termination. Deleted data may persist briefly in encrypted backups until overwritten through our normal backup cycle.

13. Your Rights and Choices

You may access, update, or request deletion of your account information at any time by emailing us at the address below with the subject line "Privacy Request." Depending on where you live, you may have additional rights under applicable law — for example, to access, correct, delete, or obtain a copy of your personal information, or to appeal a decision on your request. We will respond to verified requests within a reasonable time and consistent with any deadline applicable law requires. If we deny a request and applicable law gives you an appeal right, email us with the subject line "Privacy Appeal" and we will review it.

If your request concerns Schedule Data controlled by your organization rather than by us (see Section 1), we may need to direct you to your organization's administrator.

14. Communication Preferences

You may opt out of non-essential promotional emails using the unsubscribe link in the message or by contacting us. We will continue to send transactional and service-related messages (account, billing, security, and support communications) regardless of your promotional-email preference.

15. Children's Privacy

The Service is not directed to, and is not intended for use by, individuals under 18. We do not knowingly collect personal information from children.

16. International Users

The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. If we make a material change, we will provide notice through the Service or by email, and the "Last updated" date above will reflect the date of the most recent substantive change.

18. Contact

Questions about this Privacy Policy, or requests regarding your data, can be sent to:

Chappo Ventures LLC d/b/a OrchestrateHealth
Email: andrew@orchestratehealth.app