Privacy Policy — NRO (draft v3, post adversarial review)

Information we collect

NRO processes account email addresses, clinic profile information, supply catalog entries, low-stock reports, orders, receiving records, and documents or product photos submitted by users. Support communications include the information provided in those messages.

NRO and its providers process technical information needed to run and secure the service, such as connection logs, device and browser information, and session data. We use the browser storage needed to keep you signed in. We do not use advertising trackers.

NRO does not record prices as data. It has no price fields, its recognition reads product names and quantities rather than prices, and its data layer rejects price values instead of storing them in your records. A photo you upload may show prices printed on the document itself; that photo is stored as part of your clinic's records, as described below.

Patient information

NRO is not a medical record system and is not designed to collect, store, or process patient information or protected health information (PHI). Our Terms prohibit uploading patient information.

If patient information is uploaded by mistake, contact support@usenro.com and we will delete it — the photo, any text extracted from it, and the associated record in NRO. Anyone who believes their own information was uploaded may contact support the same way; you do not need to send us the information again for us to act. If we become aware of patient information in NRO ourselves, we remove it without waiting for a request. Removal of patient information is handled promptly and does not wait for the account-closure timeline described below.

How information is used

Information is used to operate clinic accounts, organize supply records, track orders and arrivals, prepare activity summaries, provide support, and protect the service. Product and document photos are processed with AI to prepare information for human review.

Service providers and disclosures

Supabase provides application database, storage, and authentication services. OpenAI processes product and document photos through its API, along with text needed for matching and summaries, such as supply names and document lines. Vercel provides application deployment; the current company website is hosted separately through OpenAI Sites and its hosting infrastructure. Email providers process account messages and support mail.

MedLei LLC does not sell clinic data or use it for advertising. Information is provided to service providers as needed to operate the service, or when legally required to respond to a valid request or protect rights and security.

Support access

Clinic data is separated by clinic-level access controls enforced in the database, so an account from one clinic cannot open another clinic's records. MedLei LLC personnel may access clinic data only when necessary to provide support, maintain the service, or address a security issue, and only to the extent needed for that purpose.

AI processing

OpenAI API data is not used for model training by default. This does not mean that processing involves no retention; OpenAI's API retention policies apply. When you ask NRO to read a document or a photo, the extracted information is saved with it in your clinic's account, marked as needing review. It does not change your orders, receiving records, or supply list until a person reviews and confirms it.

Retention, export, and deletion

Records are retained while a clinic's account is active, to provide the service and maintain the clinic's supply history.

An authorized clinic representative may request export or deletion of the clinic's data by emailing support@usenro.com. MedLei LLC verifies the requester's authority before releasing data. Verification is not required for removal of patient information to begin.

When a clinic closes its account, its records — including document photos and information extracted from them — are kept for 30 days after the closure in case the clinic needs an export or reverses the closure, and are then deleted. If an export request is pending at the end of that period, deletion happens after the export is completed. Backup copies and provider logs may remain for a limited period afterward under the providers' own retention practices, and are removed in accordance with those practices.

Where information must be retained to meet a legal obligation, address a dispute, or protect security, only the specific information required is retained, and only for as long as required.

People who contact us without a clinic account — for example, website visitors, applicants, and support contacts — have their messages kept while needed to respond and to operate the service, and may ask for their messages to be deleted through support.

Security

NRO uses clinic-level database access policies, authentication, and encrypted hosting services. If we become aware of a security incident affecting your information, we will notify the affected clinic's account contact without unreasonable delay, and affected individuals where required by law. No method of storage or transmission eliminates every risk. The Security overview describes the safeguards and AI processing in more detail.

Policy changes and contact

Updates to this policy will be published here with a revised date. Material changes will be communicated by email to account holders or by a notice in the service.

For privacy questions or data requests: MedLei LLC · support@usenro.com