orthobrain CRM Privacy Policy

Applies to: orthobrain CRM mobile and web application (com.orthobrain.crm).

Scope of This Policy

This Privacy Policy applies exclusively to the orthobrain CRM application (“the App”), an internal business tool used by authorized orthobrain personnel and approved partners.

This policy is separate from, and supplements, the general orthobrain Privacy Policy (https://orthobrain.com/privacy-policy/), which governs orthobrain’s patient- and provider-facing products and website.

I. Who Can Use This App

Access to the App is restricted to authorized users only. User accounts are created and managed exclusively by orthobrain administrators through the web-based Admin Management Portal. There is no public sign-up, and users cannot create their own accounts. Accounts are provisioned solely for internal business purposes — for example, employees, contractors, or approved business partners performing CRM-related duties — and are deactivated or removed by an administrator when a user’s role no longer requires access.

II. Information We Collect

The App collects and processes only the information necessary to authenticate users and operate CRM functionality on their behalf:

• Account credentials — username/email and hashed password or SSO token, used to authenticate access to the App.
• Profile identifiers — name, employee/user ID, and assigned role, used to identify the user within the CRM and apply access permissions.
• CRM business data — records the user enters or accesses in the course of their role, used to deliver core CRM functionality.

III. How Information Is Used

Information collected through the App is used strictly to authenticate and authorize access, enforce role-based permissions set by administrators, enable core CRM functionality such as records management, communication tracking, and reporting, and to maintain app security, diagnose issues, and improve performance.

IV. Data Retention Policy

Active accounts: Account and profile data is retained for as long as the user’s account remains active, as determined by the administrator who provisioned it.

Deactivated accounts: When an administrator deactivates or removes a user’s access, the associated login credentials and authentication data are retained for up to 90 days to support account recovery and audit requirements, after which they are permanently deleted or irreversibly anonymized.

Business/CRM records: Records entered by users as part of normal CRM use are retained according to orthobrain’s internal data retention schedule and applicable legal/regulatory requirements, independent of the individual user account’s status.

V. Data Deletion

Because App users are managed centrally, individual end users cannot delete their own accounts or data directly within the App. An organization administrator may deactivate and permanently delete a user’s account and associated authentication data at any time via the Admin Management Portal. A user who wishes to have their account or data deleted should contact their organization’s administrator, or submit a request to [email protected]; requests will be verified and processed within 7 business days.

Once deleted, login credentials and personal profile data are permanently removed from active systems. Business records the user created in the course of their role may be retained by orthobrain as company business records, independent of the individual’s account, consistent with Section IV.

VI. Data Sharing and Disclosure

We do not sell user data. We may disclose limited information to service providers who process data on our behalf solely to operate the App (e.g., cloud hosting, authentication infrastructure) under contractual confidentiality obligations, when required by law, regulation, or valid legal process, or to protect the rights, property, or safety of orthobrain, its users, or others.

VII. Data Security

orthobrain applies administrative, technical, and physical safeguards appropriate to the sensitivity of the data processed by the App, including access controls, encryption in transit, and role-based permissions managed through the Admin Management Portal.

VIII. Children’s Privacy

The App is intended solely for use by authorized adult business users and is not directed to, nor knowingly used by, children under 18.

IX. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by an updated Effective Date at the top of this page.

X. Contact Us

Questions about this policy or data practices in the App can be directed to [email protected], orthobrain, Inc., 3404 Brecksville Rd, Ste 1, Richfield, OH 44286.