Privacy Policy

SolvOS Med is practice-management software for doctors, operated by SolvOs(trading as SolvOS Med) at solvosmed.app. This policy explains what we collect, why, and the controls you have. It applies to the SolvOS Med web app and the SolvOS Med iOS and Android apps.

Who controls the data

You, the clinician or practice, are the data controller for the patient records you enter. SolvOs (trading as SolvOS Med) acts as yourdata processor for those records, and is the data controllerfor your own account, subscription and support data.

Payment data and our Merchant of Record

We share billing and payment data with Paddle.com Market Ltd, ourMerchant of Record and payment processor. Paddle receives your name, email, billing country, payment details, purchase and subscription information, and transaction history to process payments, manage subscriptions and renewals, handle refunds and customer billing enquiries, calculate and remit sales tax/VAT, and issue invoices. Card details are collected and stored by Paddle, never by us. See Paddle's privacy notice.

What we collect

• Account data: your name, email, phone number and currency preference — to create and secure your account (performance of our contract with you).
• Practice data you enter: patients, hospitals, appointments, clinical notes, intake responses, documents, invoices and payments — processed on your instructions to provide the service.
• Billing data: your subscription plan, status, renewal dates and transaction identifiers received from our payment provider — to manage your subscription, invoicing and tax compliance (contract and legal obligation). Card details are collected and stored by our payment provider, never by us.
• Technical data: authentication tokens, device type, IP address and error logs — for security, fraud prevention and keeping the app running (legitimate interests).
• Support messages: the content of bug reports and support requests — to answer you and fix issues (contract and legitimate interests).

Who we share data with

• Paddle.com Market Ltd — our Merchant of Record and payment provider. Paddle receives your billing and transaction data (name, email, billing country, payment details, purchase and subscription information) to process payments, manage subscriptions and renewals, handle refunds and customer billing enquiries, calculate and remit sales tax/VAT, and issue invoices. See Paddle's privacy notice.
• Service providers / subprocessors — hosting and database, email delivery, SMS delivery and error monitoring, acting only on our instructions.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where disclosure is required by law.

What we never do

• We do not sell, rent or share your data with advertisers or data brokers.
• We do not use patient data to train advertising or public AI models.
• We do not allow one account to read another account's records — every table and file is access-controlled per doctor at the database layer.

International transfers

Our hosting, email and payment providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Cookies

We use essential cookies and local storage for sign-in, session security and your currency preference. Our payment provider may set cookies during checkout to complete a transaction and prevent fraud. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.

Security

• Data is encrypted in transit (TLS) and at rest by our hosting provider.
• Row-level security scopes every record to the owning doctor's account.
• Uploaded documents live in a private bucket; patient-facing links are token-based, time-limited and revocable by you at any time.

Regulatory commitments

• HIPAA (US): SolvOS Med is built to support HIPAA-aligned workflows — access control, audit-friendly records and minimum necessary disclosure. If you are a covered entity, execute a Business Associate Agreement with us before entering protected health information.
• GDPR (EU/UK): we process on your instructions under a Data Processing Agreement. Lawful basis for patient records is normally the provision of healthcare (Art. 9(2)(h)).
• Philippine Data Privacy Act of 2012 (RA 10173): health information is sensitive personal information. You are the personal information controller and must obtain patient consent or rely on a lawful medical basis before recording it.

Retention and deletion

Deleted patients and hospitals stay recoverable for 30 days, then are permanently purged. You can export or request full deletion of your account data at any time; we complete verified deletion requests within 30 days, except where retention is legally required.

Your rights

You may access, correct, export or delete your data, withdraw consent, and object to processing. Patients should direct such requests to their treating doctor, who controls the record inside SolvOS Med.

Children

SolvOS Med accounts are for licensed healthcare professionals only. Paediatric patient records entered by a clinician are handled under the clinician's own legal basis and consent process.

Contact

Privacy questions, BAA/DPA requests or data-subject requests: support@solvosmed.app.