Privacy

What we store

Your account. Your name, your email address, your role within your organization’s account (administrator or member), the notification settings you choose, and, if you add it, a phone number. Sign-in is by a link or code sent to your email, or by a password; only a salted hash of the password is stored, by our authentication provider, and each new password is checked against known data breaches before it is accepted.

Preference entries. Each entry is one statement about a surgeon’s preference, filed under that surgeon and, where it applies, a procedure, with a category, a status, a score of how well it is supported, and the dates it was created and last confirmed. Every entry keeps its provenance: who contributed it, through which channel, and the text as it was received. A corrected entry is not erased but marked as superseded, so the history of a preference stays readable; a log of changes to a book is kept for 90 days.

Photos. A photo added to a card is re-encoded on the uploader’s device before it is sent, which removes its embedded data, including location; it is stored with its caption, who uploaded it and when, and the uploader’s confirmation that it contains no patient information. A retired photo is held for 30 days and then deleted. Photos are visible to the people who can see the card, through links that expire.

Billing. For a paid plan we keep the plan, the number of seats bought, and the state of the subscription. Card details and billing addresses are collected and held by Stripe and never reach CaseCart.

Contributions and messages. Text you submit through the service, including replies to emails the service sends you, is stored and attributed to you before it is merged into the record. Emails the service sends are logged as sent; if you rate one, the rating is kept.

Case information your organization chooses to provide. An organization may give the service basic case-level information so that preferences can be shown in context: a date, a start time, a room, the surgeon, and the procedure as written. Nothing about the patient is part of that information; though this schedule can be utilized to serve up case specific preferences for users.

What we do not store

No protected health information. CaseCart does not hold patient names, medical record numbers, dates of birth, ages, or any other patient identifier, and it is built so that it cannot acquire them by accident. Schedule text, email replies and photo captions pass through a deterministic check for patient identifiers before they are written to the database. Preferences describe the surgeon’s practice, never a patient, and a photo shows the setup, never the patient.

No clinical record. Nothing in the service is a record of care delivered to any patient, and nothing in it should be read as one.

Subprocessors

CaseCart runs on a small number of companies that process data on our behalf. Each is bound by its own terms and processes data only as needed to provide its part of the service; none of them is given patient information, because the service holds none. We will update this list before adding a provider that handles your data.

Supabase — database, authentication, and storage of card photos.

Vercel — application hosting, serverless functions and scheduled jobs.

Resend — sending of service email, including sign-in email delivery, and receipt of replies to it. United States.

Apple, Google and Mozilla push services — only if you turn on alerts on a device: your browser gives us an opaque delivery address held by its vendor’s push service, and each alert travels to it encrypted to that device. An alert carries what the matching email’s subject line carries (a case count, a time and a procedure, an attending’s name on a post-case ping) and never patient details. Removing the device under Account, or revoking the permission on the device, ends it.

Stripe — payments, subscriptions, invoices and sales-tax calculation for paid plans. Stripe receives the name and email of the person who pays and the billing details they enter; it receives no preference content. United States.

Anthropic — the language model that reads free-text contributions and proposes how they merge into the record, keeps the record tidy (merging duplicates and flagging conflicts for people to resolve), writes briefs from the record and the captions of a card’s photos, and transcribes case information an organization provides. Processed under Anthropic’s commercial terms.

Sentry — error reports from the application: the stack trace and the message of an error, without the contents of the request that caused it. United States.

Cloudflare — DNS for casecart.ai, and an encrypted backup copy of card photos in object storage (R2, North America), kept under the same paths as the originals and deleted whenever the original is deleted.

Google Workspace — the mailbox behind @casecart.ai.

Isolation, and who sees what

Every record carries the identifier of the book it belongs to, and the database enforces, at the row level and for every query, that a person reads only the books they hold a seat on. A book is owned by one organization; its owner may link it to another organization, which may then seat its own people on it within the limits the owner sets, and either side may end the link. There is no view across books a person has no seat on, and no aggregate of preference content that reaches across organizations.

Within a book, every seated person can read the preference record and add to it, except that on Business and Enterprise an administrator may limit which sections each seat sees. Any seated person may export the book as a file. A book’s administrators additionally resolve entries that conflict or could not be filed and manage its attendings, procedures and links, and an organization’s administrators manage its people, invitations, seats and plan. Links in service email carry a per-message token that identifies the message and its recipient; a token is never a database key and is only ever in that recipient’s inbox.

One exception exists, for support. A named member of CaseCart staff may open a support session on an organization: a read-only window of at most eight hours, with a stated reason, recorded with who opened it, when, why and which pages were opened. While it is open the organization’s administrators see a banner naming the person and the reason and can end the session at once. A session covers the organization and the books it owns; a book another organization owns needs a session on its owner. Nothing can be changed through a support session; staff hold no shared or per-organization credentials, and each holds this access under their own account.

Retention and removal

Records are kept for as long as their book is in use, because the value of a shared record lies in its continuity: an entry contributed by someone who has since left remains attributed to them. A person who leaves an organization is therefore deactivated rather than deleted: sign-in to that organization is disabled, email stops, and their name stays on the entries they contributed. A person with no footprint at all, having contributed nothing and received no service email, can be deleted outright by an administrator, and in that case the account is removed from the sign-in system as well. Any user may turn notifications off at any time under Settings → Alerts, or from the unsubscribe link in any service email, without affecting anything else.

Some records are deleted on a schedule, as the terms describe: a book whose owner has stopped paying and that no linked organization takes over, at 12 months, after notices 60 and 30 days before; a Free account not signed in to for a year, with its book, after the same notices; a removed attending’s card at 30 days unless the attending takes it into an account of their own; a retired photo at 30 days; the log of changes to a book at 90 days. No copy is kept of anything deleted on these schedules; the export offered to administrators is the way to keep one.

When an organization ends its use of the service, its account and every record beneath it are deleted on request to support@casecart.ai. Database backups held by the hosting provider expire on their own schedule after 7 days.

Changes and contact

If this page changes in a way that alters what is stored, who can see it, or who processes it, users will be told the next time they sign in. Questions go to support@casecart.ai.