Clinic data, access, and AI processing.

Per-clinic data isolation

Clinic records are stored in Supabase PostgreSQL. Row-level security policies limit access according to clinic membership, separating one clinic's records from another clinic's records.

These controls apply at the database level, rather than relying only on which records the interface displays.

Storage and encryption

NRO application data is hosted on Supabase. Supabase encrypts customer data at rest and uses TLS for data in transit.

Encryption protects data during storage and transmission; it does not remove the need for appropriate account access and careful handling by clinic staff.

Account and ordering access

NRO uses Supabase Auth for email-and-password sign-in, with a minimum password length of eight characters. The ordering PIN is checked by a server-side function rather than a local browser-only comparison.

The clinic is responsible for safeguarding credentials and limiting access to authorized staff. Report suspected unauthorized access to support@usenro.com.

AI processing with human confirmation

Product and document photos are sent to the OpenAI API to extract text and product information. The extracted result must be reviewed and confirmed by a person before it is saved as a record.

OpenAI does not use API inputs or outputs to train its models by default. This is separate from retention: API processing may involve retained logs under OpenAI's applicable policies. NRO does not claim zero data retention.

Not for patient information

NRO is a supply-tracking tool, not a medical record system. It is not designed to collect or store patient information, and our Terms prohibit uploading it. Clinics are responsible for what their staff photograph. If patient information is uploaded by mistake, we delete it on request — contact support@usenro.com.

Data use, export, and deletion

MedLei LLC does not sell clinic data or use it for advertising. Service providers process information to host the application and provide its features, as described in the Privacy Policy.

Clinics can request export or deletion of their data through support@usenro.com. Requests are handled through support after verifying the requester's authority to act for the clinic.