1. Who controls your information
Ortho Copilot is operated by Cubbing Solutions Private Limited (“Cubbing Solutions”, “we”, “us”). For clinical records, the hospital or healthcare provider that invited you generally determines why the information is processed. We operate the service on its instructions. Questions can be sent to support@orthoscribe.in.
2. Information we process
- Account, role, hospital, clinician, patient, and caregiver details.
- Appointment, visit, care-plan, medication-schedule, recovery, and other clinical information entered or approved by authorized users.
- Audio, transcripts, documents, images, and structured notes submitted for clinical documentation workflows.
- WhatsApp phone numbers, consent purposes, identity-verification status, message delivery metadata, and message content needed to provide opted-in patient communications.
- Security, audit, device, browser, network, and diagnostic information.
3. How we use information
We use information to authenticate users, enforce hospital boundaries, document encounters, support clinician-reviewed care, deliver opted-in reminders and visit notifications, operate patient portals, maintain audit trails, prevent abuse, troubleshoot the service, and meet legal or contractual obligations. We do not sell personal or health information or use it for third-party advertising.
4. AI-assisted processing
Some workflows use speech-to-text and language models to draft or organize information. Their output is assistive and may be incomplete or incorrect. Authorized clinicians remain responsible for reviewing and approving clinical content and decisions. WhatsApp automation does not diagnose, prescribe, change treatment, or provide emergency advice.
5. WhatsApp and patient communications
WhatsApp communication is optional and purpose-specific. A hospital records consent for care coordination, appointments, medication reminders, or recovery check-ins. You can withdraw a purpose at any time through the patient portal or hospital. Detailed clinical content is kept behind authenticated portal links whenever practical. Meta processes WhatsApp traffic under its own terms and privacy policies.
6. Service providers and disclosures
We disclose information only as needed to the inviting healthcare organization, authorized personnel, approved caregivers, infrastructure and security providers, transcription or AI providers configured for the service, Supabase, Google Cloud, Meta/WhatsApp, and other contracted processors. We may also disclose information when legally required or necessary to protect patients, users, the public, or the service.
7. Security and hospital isolation
We use role-based access controls, hospital scoping, authenticated patient access, encrypted transport, encrypted WhatsApp credentials and message payloads, signed webhook verification, audit records, and restricted production secrets. No internet service is perfectly secure; users must protect credentials and promptly report suspected misuse.
8. Retention and deletion
Information is retained for the period selected by the healthcare organization and as required for clinical, audit, security, contractual, and legal purposes. WhatsApp consent withdrawal stops future proactive messages for that purpose but does not erase required clinical or audit history. See our data-deletion instructions for requests.
9. Your choices and rights
Depending on your location and relationship with the hospital, you may request access, correction, export, restriction, objection, or deletion. Patients should normally contact their hospital first because it controls the clinical record. We may verify identity and consult the hospital before acting on a request.
10. Children, changes, and contact
Minors may use patient services only through an authorized healthcare organization and appropriate parent or guardian arrangements. We may update this policy as the service or law changes and will post the new effective date here. Contact support@orthoscribe.in for privacy questions or complaints.