Privacy Policy

1. Information we collect

Account and pilot information. When you request a pilot, create an account or sign in, we collect your name, work email address, hospital or facility name, job title or role, and any phone number or message you choose to provide.

Delay report content. When a physician logs a throughput delay, OmniFlowED collects the zone and room, two stage timestamps, category and subtype, contributing factor, severity, a recurring-flow flag, and an optional free-text note. This note is checked as it is typed and flagged before submission if it resembles an age, date of birth or record number. Each report also carries the reporter's own choice, made per report, to be named or anonymous.

Usage data. Like most web services, our servers automatically log IP address, browser and device type, pages visited, referring page, and timestamps of activity. We use this only to operate, secure and troubleshoot the service, not to build advertising profiles.

Cookies. We use a session cookie to keep you signed in and to remember basic preferences. We do not use third-party advertising or cross-site tracking cookies.

Communications. If you email support@omniflowed.com or submit a form on this site, we keep that correspondence to respond to you and to keep a record of the request.

2. Information we do not collect

OmniFlowED is built so that no field anywhere in the product accepts a patient name, medical record number, date of birth, age, chief complaint, diagnosis or any other protected health information. A delay report is identified only by location and time. This is a data-model decision, not a setting, so there is no configuration that introduces these fields. Details are in Security & HIPAA.

3. How we use information

• To operate the service: authenticate accounts, save and display delay reports, and compute the aggregate dashboards and tracking board administrators use.
• To respond to pilot requests and support inquiries, and to send account, product and administrative email, such as sign-in and invite messages.
• To maintain the security, integrity and availability of the service, including detecting and preventing misuse.
• To understand aggregate usage of the site and product so we can improve it.
• To comply with legal obligations and enforce our terms.

4. Legal bases for processing

For users in jurisdictions that require a legal basis for processing, such as the UK and EU, we rely on: performance of a contract (to provide the service you or your facility requested), legitimate interests (to secure and improve the service), and consent (where you have given it, such as choosing to be named on a report). You may withdraw consent at any time by contacting us.

5. How we share information

We do not sell personal information, and we do not share it for third-party advertising.

• Service providers. We use Supabase for database, authentication and row-level access control, and Vercel to host the application, both under their standard processing terms. These providers process data only to deliver that infrastructure to us.
• Your facility. Administrators at your facility see the aggregate dashboard and tracking board for their own facility only, scoped by row-level security. A report is visible as attributed to you only if you chose to be named on that report; anonymous reports are never traced back to a reporter.
• Legal and safety. We may disclose information if required by law, subpoena or court order, or to protect the rights, property or safety of OmniFlowED, our users or the public.
• Business transfers. If OmniFlowED is involved in a merger, acquisition or asset sale, information may be transferred as part of that transaction, subject to this policy.

6. Data retention

We retain account and delay-report data for as long as your account or your facility's pilot is active, and as needed to provide the service, resolve disputes and meet legal obligations. Your facility's reports can be exported to CSV at any time, including if a pilot ends. If you close your account or your facility ends its pilot and requests deletion, we delete or de-identify the associated data within a reasonable period, except where retention is required by law.

7. Data security

Data is encrypted in transit with TLS and at rest on managed infrastructure. Access is enforced by row-level security at the database layer, scoped to a facility, and by role separation between physician and administrator views. A full account of these controls is in Security & HIPAA.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have similar rights under the CCPA, including the right to know what personal information is collected and to request its deletion; we do not sell personal information, so there is nothing to opt out of in that respect. To exercise any of these rights, email support@omniflowed.com. We will need to verify your identity before acting on a request.

9. Children's privacy

OmniFlowED is intended for use by healthcare professionals and administrators, not by children. We do not knowingly collect personal information from anyone under 18.

10. International users

OmniFlowED is operated from, and its data is stored and processed in, the United States. If you use the service from outside the United States, you understand that your information will be transferred to and processed in the United States.

11. Changes to this policy

We may update this policy as the product or our practices change. If we make a material change, we will update the effective date above and, where appropriate, notify facility administrators by email.

12. Contact us

Questions about this policy or your data can be sent to support@omniflowed.com. Security questionnaires and reviewer requests are welcome at the same address.