Privacy Policy

1. Who We Are and Our Role

RelyCare is operated by Adham Yasser, trading as RelyCare. You can contact us at adham@relycare.app.

For clinic-submitted patient, caregiver, session, and clinical documentation data, the clinic is the controller, responsible party, covered entity, or equivalent legal role under applicable law. RelyCare acts as a processor, operator, service provider, or business associate, depending on the legal framework and whether the required agreement is in place. For account, billing, security, and product administration data, RelyCare may act as an independent controller.

2. Information We Collect and Process

2.1 Account, Team, and Clinic Data

• Names, email addresses, roles, clinic membership, authentication identifiers, and user preferences.
• Clinic name, slug, location/timezone, subscription status, services, pricing, configuration, and onboarding information.
• Team invitations, access changes, and related audit events.

2.2 Patient, Caregiver, and Clinical Data

• Patient profile information, guardian/caregiver contact details, diagnoses or therapy concerns if entered by the clinic, therapy goals, services, appointment/session records, attendance, homework, progress trajectories, and reports.
• Clinical SOAP notes, target-level metrics, evidence quotes, transcripts, AI trace metadata, clinician edits, session flags, and verification evidence used to support documentation.
• Parent/caregiver requests and WhatsApp-style communication records when the clinic enables parent communication workflows.

2.3 Audio and Transcription Data

• Uploaded voice notes and temporary audio recordings are stored in private, encrypted Amazon Web Services (AWS) S3 storage while speech-to-text processing and clinical notes are generated.
• Uploaded session audio, recorded session chunks, and merged final recordings remain in private, encrypted AWS S3 storage only while the note is in draft or pending review.
• When a clinician finalizes the session, RelyCare automatically and permanently executes deletion of the raw audio objects from AWS S3 and any storage cache, clearing all stored media pointers. S3 lifecycle rules act as an automated passive backstop for any abandoned or unfinalized drafts.
• Transcripts, derived clinical notes, target metrics, and audit evidence are retained as part of the official clinic record unless deleted under your clinic's account lifecycle or an approved deletion request.

2.4 Technical, Security, and Usage Data

• IP address, device/browser information, user agent, authentication events, audit logs, feature usage, application errors, and diagnostic logs.
• AI usage metadata such as model name, token counts, pipeline stage, cost metadata, and processing status.

3. How We Use Information

• Provide, secure, maintain, and improve the RelyCare service.
• Generate transcript-backed SOAP notes, progress data, parent summaries, homework, reports, and clinical evidence artifacts.
• Support clinic administration, scheduling, team access, settings, billing, and support requests.
• Operate parent communication and request workflows where enabled by the clinic.
• Maintain audit logs, investigate security events, prevent abuse, and comply with legal obligations.
• Produce owner-requested data exports and support account deletion or retention workflows.

We do not sell patient data. We do not use identifiable patient data for advertising. We do not intentionally use identifiable patient data to train foundation models. If de-identified or aggregated data is used to improve RelyCare, it is handled so it is not intended to identify a patient, caregiver, clinician, or clinic.

4. Legal Bases and Customer Instructions

Depending on the jurisdiction and data type, we process data to perform our contract with the clinic, follow clinic instructions, maintain security, comply with law, support legitimate product operations, and, where required, rely on consents or authorisations obtained by the clinic.

Clinics are responsible for identifying and documenting their lawful basis for processing clinical data and for obtaining appropriate patient, parent, or caregiver consents, authorisations, and notices where required before entering clinical data, session audio, or parent communication data into RelyCare. Clinics are also responsible for determining whether HIPAA, POPIA, GDPR, state privacy law, professional record-keeping rules, school/education privacy rules, or payer requirements apply to their use of RelyCare.

Before recording a patient, the clinic must obtain any patient, parent, or guardian consent or authorisation and give any notice required by applicable law. RelyCare does not collect, store, or verify proof of that consent or authorisation as part of the patient profile; the clinic must retain its own evidence.

5. Subprocessors and Third-Party Services

We use trusted infrastructure and service providers to operate RelyCare. Categories include:

• Application, Hosting, and Storage Infrastructure: Amazon Web Services (AWS). This includes AWS CloudFront for global content delivery and TLS 1.3 encryption, AWS Lambda for serverless application compute, and AWS S3 for static assets and temporary encrypted audio storage. RelyCare maintains an executed Business Associate Addendum (BAA) with AWS for HIPAA-regulated environments.
• Database and Authentication: Supabase (PostgreSQL managed database, row-level security, and authentication).
• Distributed Cache and Rate Limiting: Upstash (Serverless Redis for API rate limiting, queue coordination, and token protection).
• AI Processing: Google Gemini models for speech-to-text transcription, clinical note generation, clinical verification, and session plan suggestions; ElevenLabs for voice output where AAC features are enabled.
• Analytics and Product Telemetry: PostHog. Configured to track platform usage without capturing patient names or clinical note content.
• Error Monitoring: Sentry, with client-side and server-side data sanitization designed to scrub clinical content and patient identifiers from diagnostic error traces.
• Communication and Notifications: Resend for transactional email notifications and team invitations; Meta / WhatsApp Business API where parent communication workflows are explicitly enabled by the clinic.
• Calendar Integrations: Google Calendar, solely when an authorised clinic user connects their calendar account.
• Billing and Subscriptions: Polar and Stripe for subscription management. RelyCare never collects, stores, or handles full payment card numbers directly.

We require all service providers to process data only for the purposes specified by RelyCare and to maintain appropriate administrative, technical, and physical safeguards. For HIPAA-regulated customers, required downstream business associate and subcontractor terms are maintained before PHI is processed.

6. Security Measures

RelyCare uses administrative, technical, and organisational safeguards designed to protect clinical information, including:

• Role-based access controls for clinic owners, admins, clinicians, and team members.
• Per-clinic data isolation and server-side ownership checks for sensitive actions.
• Encryption in transit using HTTPS/TLS.
• Encryption at rest through infrastructure providers, plus application-level encryption for retained clinical SOAP notes, evidence artifacts, and AI traces.
• Owner-only compliance exports and audit logging for key clinic actions.
• Temporary audio processing workflows with raw audio deletion after session finalization.
• Security logging, error monitoring, and incident response procedures.

No system is perfectly secure. Clinics must also maintain appropriate local safeguards, user access reviews, staff training, consent processes, device security, and professional record retention procedures.

7. HIPAA, POPIA, and Health Privacy

HIPAA may apply when RelyCare is used by a HIPAA covered entity and RelyCare creates, receives, maintains, or transmits PHI on that customer's behalf. In that case, RelyCare must be treated as a business associate and a signed BAA is required before PHI is submitted.

POPIA may apply to South African clinics and patients. Clinics remain responsible for their role as responsible party, including lawful processing conditions, information officer duties where applicable, patient/caregiver notices, security safeguards, operator agreements, and data subject request handling.

Health professional record-keeping rules may require clinics to retain accurate clinical records for specified periods. RelyCare helps create and export records but does not replace the clinic's responsibility to maintain legally sufficient records.

8. Data Retention, Export, and Deletion

• Clinic records remain available while the subscription or authorised access is active, unless deleted by the clinic or under an approved deletion workflow.
• Raw session audio is a temporary processing artifact and is deleted when the clinician finalizes the session. Transcripts, SOAP notes, target metrics, evidence, reports, and audit logs remain as part of the clinic record.
• Cancelled clinic accounts may be retained for a limited post-cancellation period to allow export, account recovery, legal compliance, or dispute handling, after which deletion workflows may remove associated records.
• Owner users can request a machine-readable JSON archive from the Compliance Center. The archive action is logged in the audit trail.
• Billing, audit, security, and legal records may be retained longer where required for accounting, compliance, fraud prevention, dispute resolution, or legal obligations.

9. Privacy Rights and Requests

Depending on applicable law, individuals may have rights to access, correction, deletion, portability, objection, restriction, withdrawal of consent, or complaint. Because clinics control patient records in RelyCare, patient or caregiver requests should normally be directed to the clinic first.

Clinic users can contact us at adham@relycare.app for account, export, deletion, or security requests. We may need to verify identity and authority before acting on a request.

10. Cookies, Analytics, and Tracking

RelyCare uses essential cookies for authentication and security. We use product analytics to understand usage and improve the platform. We do not use advertising cookies inside the clinical application, and analytics should not be used to intentionally collect patient clinical content.

HIPAA-regulated customers should not use tracking technologies in ways that disclose PHI to vendors without a valid permission and required agreement.

11. International Transfers

RelyCare is operated internationally and uses infrastructure and service providers that may process data in multiple jurisdictions. Where required, we rely on appropriate contractual and organisational safeguards for cross-border processing. Clinics are responsible for assessing whether their jurisdiction requires additional patient notices, contractual terms, or transfer safeguards.

12. Changes to This Policy

We may update this Privacy Policy as the product, law, or subprocessors change. Material updates will be communicated to registered clinic users where practical. The latest version will remain available on this page.

13. Contact

South African users may also contact or complain to the Information Regulator of South Africa. HIPAA-regulated customers should follow their internal HIPAA/privacy process and signed BAA terms for PHI-related incidents or requests.