Privacy Policy

RoundsBrief collects identifiers and account details, professional-learning content, optional calendar data, and security, consent, subscription, and usage metadata for the purposes described below. We do not sell personal information, share it for cross-context behavioral advertising, or use advertising trackers under the current pilot.

Do not submit identifiable patient information, patient recordings, or live EHR data. The current service is limited to synthetic information or material already de-identified through an appropriate process.

• Identifiers: name, email address, internal account, organization, and workspace IDs, and verification status. Legacy mobile numbers collected before email-only signup may remain until the account is deleted or a valid deletion request is completed.
• Credentials, consent, and security: password hash, session-token hash, accepted policy versions and timestamps, login and security events, hashed rate-limit keys derived from an IP address or account identifier, and operational timestamps. RoundsBrief does not store plaintext passwords or session tokens.
• Workspace content: debrief transcripts, organized segments, cases, notes, tasks, research questions, insights, conversations, edits, source wording, provenance, preferences, and feedback you choose to save.
• Audio: when you request transcription, the browser sends a recording to the RoundsBrief host. The host-local adapter writes a temporary file for processing and deletes it afterward. The application does not intentionally add audio to the workspace database. If transcription fails, the browser-held recording may remain available in that browser tab for retry, listening, re-recording, or manual transcription until you clear it, navigate away, reload, or close the tab.
• Calendar information: event titles, descriptions, dates, external source IDs, revisions, import timestamps, and connection metadata for imports you enable. Google access is read-only in RoundsBrief.
• Commercial information: plan, subscription, billing-customer identifiers, payment status, and renewal dates. Paid checkout is disabled during the invitation pilot. If enabled later, the hosted payment provider—not RoundsBrief—will collect card details.
• Operational metadata: feature actions, success or failure, model/provider labels, latency, error codes, consent and audit records, and pseudonymous actor or resource references. We do not use session replay in the current pilot.

We receive information directly from you, automatically from your interactions with the service, from your browser or device, from administrators limited to permitted account and pilot operations, and from integrations you deliberately enable, such as calendar or future payment providers.

We use information to create and authenticate accounts; record legal consent; provide transcription, organization, search, recall, tasks, calendar import, export, and deletion; secure and troubleshoot the service; prevent fraud and abuse; process subscriptions if later enabled; respond to incidents and legal obligations; and measure aggregate feature adoption, reliability, and pilot readiness.

When product-improvement analytics are enabled for your account, metadata-only reports may use feature actions, completion counts, success or failure outcomes, latency, plan state, and account-level return patterns to improve product speed, reliability, usability, and workflow design. You can change this choice in Privacy & settings. Turning it off excludes your account activity from product-improvement reports; required security and service-operation records may still be retained and used for those limited purposes.

Private workspace content is not used for targeted advertising, sold to data brokers, exposed in owner analytics, or used to train public models under the current pilot configuration. Enabling product-improvement analytics does not authorize access to private workspace content.

The current application and host-local transcription run on the Windows computer operating the RoundsBrief pilot; this is not necessarily your device. The invitation site is exposed through secure networking infrastructure. Optional Google Calendar access involves Google. Paid Stripe processing and production email services are not active unless separately configured and enabled.

Information may be disclosed to service providers performing a narrowly defined function; to a customer organization only under a separate agreement and permission model; during a business transaction subject to appropriate protections; or when reasonably necessary to comply with law, protect rights, investigate abuse, or address an emergency. Providers receive only information needed for the enabled function.

The current pilot does not promise a particular data-residency jurisdiction or cross-border transfer mechanism. A verified provider and subprocessor inventory, contracts, residency position, and transfer analysis are required before production use.

The site owner can review account identity and operational details needed to run the invitation pilot, including name, email, account and verification status, signup and recent-activity timestamps, plan status, your product-improvement sharing choice, and feedback you submit. Contact details attached to feedback are shown only when you consent to follow-up.

Product-adoption counts, RoundsMind control counts, successful feature-event reports, and retention funnels include only accounts with product-improvement analytics enabled. The owner dashboard displays the sharing state and withholds per-account feature counts when sharing is disabled. Required failure and security metadata may remain available for service operation.

Owner analytics do not expose passwords, session tokens, private transcripts, notes, task titles, cases, research questions, conversations, Ask Rounds prompts or answers, RoundsMind maps, source excerpts, or audio. Platform, practice, support, and billing administrators do not receive standing access to private workspace content. Break-glass content access is disabled in the pilot.

Host operators and persons with privileged access to the Windows host or database may technically be able to access stored files. Access is restricted operationally, but the current pilot has not completed production-grade privileged-access management, independent monitoring, or formal workforce controls.

RoundsBrief is not authorized to receive protected health information in the current pilot and is not represented as a production HIPAA environment. Whether an organization is a covered entity or business associate depends on the parties and service relationship; a privacy policy does not create HIPAA compliance.

If RoundsBrief ever processes PHI for a covered entity, an executed business associate agreement, approved architecture, risk analysis, vendor agreements, safeguards, training, incident procedures, and other legal and technical requirements must be completed before processing.

The identifier scanner does not establish Safe Harbor or Expert Determination. Even properly de-identified information can retain residual re-identification risk.

Active account and workspace records remain in the local database until you delete the account or the pilot operator lawfully removes them. Authentication sessions expire after 12 hours. Verification challenges and Google OAuth state expire after about 10 minutes, although expired rows may remain in the local database until a later cleanup or account deletion. In-memory rate-limit buckets expire by their configured windows and are discarded when the process restarts.

A validated account-deletion request removes account credentials, active sessions, legal-consent rows, private workspace content, feedback, preferences, local calendar tokens, and account-linked billing metadata from the active database. It also attempts to revoke Google access when connected; local token deletion continues even if Google is unavailable. Retained operational audit events are stripped of organization, user, resource, and metadata links and re-hashed so they are no longer directly attributable through the deleted account.

Temporary transcription files are deleted after each completed or failed processing attempt. Browser-held recordings follow the browser behavior described above.

Local SQLite backup files can contain an earlier copy of records, including records later deleted from the active database. The current pilot has backup and restore tooling but does not yet enforce a fixed automated backup-expiration schedule or independently verified encrypted-backup lifecycle. Backups are excluded from the source repository and must be access-restricted. A defined, tested production schedule and deletion-verification process are launch requirements.

We will not retain personal information longer than reasonably necessary for the disclosed purpose unless law requires otherwise. Billing, tax, fraud, dispute, or legal-hold records may require a different period if those functions are activated; the applicable schedule must be published before activation.

Account settings let you enable or disable metadata-only product-improvement analytics. The stored choice is included in your export and removed with your account. Account settings also provide password-confirmed JSON export and password, email, and exact-phrase-confirmed account deletion. The export includes account and consent information, workspace records, relationships, tasks, research, conversations, preferences, dashboard history, user-owned knowledge-source metadata, integration metadata without secret tokens, and attributable audit events. It is a point-in-time application export, not a promise of compatibility with every third-party system.

You may disconnect calendar access and control what content you submit. Depending on applicable law and your location, you may also have rights to know, access, correct, delete, restrict, object, appeal, or obtain a portable copy of personal information and to receive non-discriminatory treatment.

RoundsBrief does not currently sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Legally required request, appeal, and authorized-agent channels must be added before broader launch.

The service uses an essential HTTP-only, SameSite=Strict session cookie for authentication. It may keep an unsent recording in memory within the active browser tab as described above. The current pilot does not use advertising cookies or cross-site behavioral tracking. Future analytics or cookie changes require updated disclosure and consent where applicable.

Current controls include BCrypt password hashing, hashed session tokens, HTTP-only and SameSite=Strict cookies, owner- and workspace-scoped queries, same-origin mutation checks, content-type and declared-size validation, rate limits, restricted owner authorization, metadata-only administration, encrypted local storage of Google refresh tokens when that integration is configured, dependency scanning, security headers, audit metadata, processor gates, backup and restore scripts, and health checks.

The pilot does not promise end-to-end encryption, managed key custody, encrypted managed backups, multi-factor authentication, an independently validated penetration test, uninterrupted availability, or compliance certification. No safeguard eliminates all risk.

We will investigate suspected incidents and provide notices required by applicable law. A documented incident-response plan, named contacts, escalation coverage, and jurisdiction-specific breach analysis remain production requirements. Health-app breach obligations may apply even when HIPAA does not.

The service is intended for adults 18 and older and is not directed to children. International production availability, data-transfer mechanisms, representative appointments, and region-specific terms are not currently enabled for this U.S.-oriented invitation pilot.

Material changes use a new version and require renewed acceptance when appropriate. Consent versions and timestamps are retained while the account is active. They are included in export and removed with account deletion under the current pilot architecture, subject to older backup copies as disclosed above.

A monitored privacy email, final legal business name, physical notice address, privacy-request channel, appeal process, and jurisdiction-specific notices must be added before paid or broader public launch. Until then, use the support channel provided directly to invitation-pilot participants.