Scrub Out

Privacy Policy

1. About this policy

Scrub Out is a productivity application for orthopedic medical device sales professionals, operated by CaseReady LLC ("CaseReady," "we," "us," or "our"). This Privacy Policy explains what personal information we collect when you use Scrub Out (the "Service"), how we use it, how we share it, how long we keep it, and the rights and choices you have. By creating an account or using the Service, you acknowledge you have read and understood this policy.

2. Information we collect

We collect personal information in three ways: information you provide directly, information we collect automatically when you use the Service, and information we receive from third parties.

Information you provide

• Account information: name, email address, password (stored as a one-way hash, not in plain text)
• Professional information: territory, company name, vendors you sell, professional title
• Billing information: we don't store payment card numbers. Stripe collects and processes those directly. We store only your Stripe customer ID, subscription status, trial end date, and renewal dates
• Content you create in the Service: facility entries, tray logs, peel pack photos, surgeon preferences, call schedule entries, inventory sheet uploads, notes, and team invitations
• Communications you send us: support requests, in-app feedback, and any messages you send to [email protected]

Information collected automatically

• Device and usage data: IP address, browser type, operating system, device type, app version, the screens you visit, the buttons you tap, and the dates and times of those events. Collected via PostHog and associated with your account through an internal user identifier, for product improvement
• Error and crash data: stack traces, error messages, the actions you took just before an error occurred. Collected via Sentry
• Push notification subscriptions: if you opt in, we store the technical endpoint that allows us to deliver notifications to your device (provided by Apple Push Notification Service or Google Firebase Cloud Messaging)

Information from third parties

• Payment confirmations from Stripe: we receive webhook notifications when your subscription starts, renews, fails, or is canceled
• National Provider Identifier (NPI) lookups: when you search for a surgeon, we query the public NPPES Registry for matches. We don't share your search terms with anyone other than that registry

3. How we use your information

We use your personal information to:

• Provide, operate, and maintain the Service
• Process subscription payments and manage your account
• Send transactional emails (sign-up confirmations, password resets, billing receipts, security alerts) — we do not send marketing emails unless you explicitly opt in
• Deliver push notifications you've opted into
• Improve the Service by analyzing how features are used
• Respond to your support requests and inquiries
• Detect, prevent, and respond to fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal information for monetary or other valuable consideration, and we do not share it with advertisers for cross-context behavioral advertising.

4. When we share information

We share personal information only in the following limited circumstances:

• With service providers (subprocessors) who help us operate the Service, listed below
• With members of your team if you join a team — your team-shared content (facility data, tray logs, peel packs, surgeon prefs, schedule, inventory sheets, notes, activity log) becomes visible to other members of your team. Solo users' data is private to the user
• With law enforcement or government agencies when required by valid subpoena, court order, or other legal process, or where we believe in good faith that disclosure is necessary to protect rights, property, or safety
• In connection with a merger, acquisition, or sale of assets, personal information may be transferred as part of the transaction; if that happens, we'll notify you by email and update this policy
• With your consent, for any other purpose disclosed at the time of collection

5. Third-party data processors (subprocessors)

We rely on the following providers, each of which processes only the minimum data needed for its function. We have data processing agreements in place with each:

6. Data storage and security

Your data is stored on Supabase infrastructure, primarily in the United States (AWS us-east-1). We use industry-standard safeguards including:

• Encryption in transit: all connections use HTTPS / TLS 1.2 or higher
• Encryption at rest: databases and file storage are encrypted at the disk level
• Row-level security policies that ensure team-based data isolation — only authenticated members of your team can read your team's data, regardless of how a query is constructed
• Strong password hashing: we use bcrypt or equivalent. We never store passwords in plain text
• Stripe webhook signature verification to prevent payment fraud
• Supabase Vault for storing operational secrets (API keys, etc.)

No system is perfectly secure. If we ever detect a breach affecting your data, we'll notify you by email within 72 hours, in keeping with applicable breach-notification laws.

7. How long we keep your data

You can request immediate deletion of your account at any time by contacting [email protected]. We will complete deletion within 30 days, except for data we're legally required to retain (such as billing records).

8. HIPAA notice and PHI prohibition

Do not enter Protected Health Information (PHI) into Scrub Out. PHI under HIPAA includes patient names, medical record numbers, dates of birth, addresses, phone numbers, dates of service, diagnoses, treatment information, insurance information, account numbers, biometric identifiers, photographs of identifiable patients, or any other identifier that could be linked to an individual receiving care.

What is acceptable to enter: facility names (publicly listed hospitals), surgeon names (publicly listed via the NPPES NPI Registry), tray names, vendor names, equipment serial numbers, peel pack photos of equipment only, your own schedule and notes about workflows, and any data not connected to identifiable patients receiving care.

Any user who enters PHI into the Service does so in violation of our Terms of Service and assumes all liability for that conduct. If you discover PHI in your account or your team's account, contact [email protected] immediately and we will help you remove it.

We do not actively monitor user content for PHI. If we become aware that PHI has been entered, we reserve the right to remove it and to suspend or terminate the account that entered it.

9. Your rights and choices

Regardless of where you live, you have the following rights:

• Access: request a copy of the personal information we hold about you
• Correct: ask us to fix inaccurate or incomplete information
• Delete: request deletion of your account and personal information (subject to legal retention requirements)
• Export: use the in-app Settings → Export My Data feature to download a JSON copy of everything you've created at any time
• Opt out of marketing: we don't send marketing emails unless you opt in. If you do opt in, every such email contains an unsubscribe link
• Opt out of push notifications: toggle them off in Settings → Notifications, or revoke browser/iOS permission at any time
• Object or restrict processing in certain circumstances

To exercise any of these rights, email [email protected] with your account email and what you'd like to do. We will respond within 30 days. We may need to verify your identity before fulfilling certain requests; usually this means confirming you control the account email.

10. California privacy rights (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA).

Categories of personal information we collect

Sources, purposes, and disclosure

Sources: directly from you (account creation, in-app activity); automatically from your device (analytics, error monitoring); from third parties (Stripe payment confirmations, NPPES NPI Registry).

Purposes: operating the Service, processing payments, customer support, security, fraud prevention, product improvement, legal compliance.

Categories disclosed for a business purpose to subprocessors: A, B, D, F, G, I, L (limited to the subprocessors listed in Section 5 above, each only what they need).

Your California rights

• Right to know what personal information we collect, the sources, the purposes, the categories disclosed, and the categories of recipients
• Right to delete personal information we hold (subject to legal exceptions)
• Right to correct inaccurate personal information
• Right to opt out of "sale" or "sharing": we do not sell or share your personal information within the meaning of CCPA/CPRA. There is no opt-out to take because we don't engage in those practices
• Right to limit use of sensitive personal information: we use sensitive personal information (account credentials) only for the purposes for which it was provided (authenticating you), so this right is honored by design
• Right to non-discrimination: we will not deny service, charge different prices, or provide a different level of service based on your exercise of these rights

To exercise California rights, email [email protected]. You may also designate an authorized agent to act on your behalf in writing; we will require the agent to provide proof of authorization and may verify your identity directly.

"Shine the Light" disclosure (Cal. Civ. Code § 1798.83): California residents may request information about disclosures of personal information to third parties for those parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

11. European users (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and related laws apply.

Data controller: CaseReady LLC, 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States. Contact: [email protected].

Lawful basis for processing: we process personal information based on (a) the contract between you and us (to provide the Service you signed up for); (b) our legitimate interests (improving the Service, securing it, preventing fraud), balanced against your rights; (c) your consent (for optional features like push notifications and marketing emails, if any); and (d) compliance with legal obligations (tax records, lawful requests).

Your GDPR rights include access, rectification, erasure, restriction, portability, objection, and the right to withdraw consent. You also have the right to lodge a complaint with your local supervisory authority.

We do not have a designated EU representative because Scrub Out is targeted to United States medical device sales professionals and we do not actively market to or systematically monitor individuals in the EU.

12. International data transfers

Scrub Out is operated from the United States. When you use the Service from outside the United States, your personal information will be transferred to and processed in the United States. The U.S. may not have data protection laws as comprehensive as those in your country. By using the Service, you consent to this transfer. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms in our agreements with subprocessors.

13. Cookies and similar technologies

We use a small number of first-party cookies and equivalent technologies:

• Authentication cookie (set by Supabase) — keeps you signed in. Required for the Service to function
• PostHog distinct ID — an identifier used to attribute product-usage events to your account. This is a first-party cookie/localStorage entry, not used for cross-site or cross-app tracking
• Theme preference — stores your light/dark mode choice in localStorage
• App version cache — service worker storage that lets the app work offline and load faster

We do not use advertising cookies, social-media tracking pixels, or third-party trackers for marketing purposes. You can clear cookies and localStorage at any time in your browser settings; doing so will sign you out and reset your preferences.

14. Push notifications and email

Push notifications are off by default. If you opt in via Settings → Notifications, your browser or device asks for permission, and (with your consent) registers a subscription endpoint with us. You can disable notifications at any time by toggling them off in the app, by revoking permission in your browser/device settings, or by uninstalling the app — any of which removes you from delivery.

Transactional emails (sign-up confirmation, password reset, billing receipts, security alerts, trial-ending reminders) are essential to the Service and cannot be opted out of as long as you have an active account, except by deleting your account.

Marketing emails: we don't send marketing emails as of this writing. If we ever start, we will require you to explicitly opt in, and every such email will contain an unsubscribe link.

15. Children's privacy

Scrub Out is designed for medical device sales professionals and is not intended for use by anyone under 18. We do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK). If you believe we have inadvertently collected personal information from a child, contact us at [email protected] and we will delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (using the address on your account) at least 14 days before they take effect. The "last updated" date at the top reflects the most recent revision. Continued use of the Service after the effective date of a change constitutes acceptance.

17. How to contact us

CaseReady LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States

Email: [email protected]