Privacy Policy
Last updated October 22, 2026
This policy explains what information CaseSlate (“we”) handles for the surgeons' offices that use it, and how we use and protect it.
Information we handle
- Office user accounts: the name and email address used to sign in.
- Case information the office enters or uploads: surgery order sheets and the details on them (patient name, date of birth, procedure, surgeon, facility, dates and times).
- The office's contact directory: names, companies and email addresses of the representatives it notifies.
- Records of the notification emails sent for each case, and an audit log of changes.
- The office's connected email account: its address and the sign-in credential needed to send from it (stored encrypted).
Google user data
When an office connects a Google account in CaseSlate's Settings, CaseSlate requests these permissions:
- Send email on your behalf (gmail.send) — used only to send the case notification emails the office's scheduler creates in CaseSlate, from the office's own account. CaseSlate cannot read, search or delete messages in the mailbox.
- Your email address and basic profile — used only to show which account is connected and to send from that address.
We store the connected account's address and an encrypted access credential so emails can be sent when the scheduler acts. We do not sell Google user data, use it for advertising, use it to train AI models, or share it with anyone except as needed to send the office's emails or as required by law. No person at CaseSlate reads it except with the office's permission, for security, or as required by law.
CaseSlate's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
An office can disconnect at any time by connecting a different account in Settings or by removing CaseSlate at myaccount.google.com/permissions. To have the stored credential and account address deleted, email us.
How we use information
Only to run CaseSlate for the office: reading uploaded order sheets, keeping the office's case list, and sending the notifications the office asks for. Uploaded order sheets are read by an AI service running in our cloud account to fill in the case details; that information is not used to train AI models.
Where it's stored and who processes it
Data is stored in our database and file storage (Supabase) and the app runs on Vercel; order sheets are read using Amazon Web Services. Access is limited to signed-in office users and the administrators who maintain CaseSlate. Data is encrypted in transit, and email credentials are also encrypted at rest.
Retention and deletion
Case records are kept while the office uses CaseSlate so it can look up past cases. An office can ask us to delete its data or a specific case by emailing us.