1 Scope
This Policy explains how we collect, use, disclose, retain, and protect personal information in connection with DocuHandsOn. It applies to visitors, account holders, and people whose permitted information appears in professional profiles or uploaded content. It is not a clinic's patient privacy notice or a substitute for a clinician's own obligations.
2 Information we process
Account information includes your name, email address, account identifier, authentication information, and account settings. Professional information may include practitioner or clinic name, credentials, business contact details, profile photographs, and other details you choose to provide.
Content includes technique descriptions, selected technique menus, charts, uploaded pictures, video frames, and related files or captions. Depending on the feature, content may remain in your browser or be transmitted to and stored by our service providers. Do not submit identifiable patient information.
Transaction information may include subscription status, transaction identifiers, invoices, billing details, and payment status. Payment card information submitted at checkout is handled by the payment processor; DocuHandsOn receives subscription and transaction status rather than your full payment card number or security code. Stripe handles your payment details.
Support information includes messages, requests, and information needed to resolve a problem. Usage and technical information may include IP address, browser and device information, access times, logs, and events such as sign-in, import, printing, or PDF creation. Usage statistics can be associated with an account identifier; guest statistics can use a browser identifier. They should not be described as fully anonymous merely because they omit names.
If you use a referral feature, we may process referral identifiers, eligibility information, and contact details submitted through that feature. Provide a colleague's email only where you have permission and a lawful basis to do so. The referral feature stores colleague email addresses you submit, invitation codes, registration and usage eligibility, and reward status. Its invitation text and links can be shared by you with your colleagues.
3 How we use information
We use information to create and authenticate accounts; provide editing, storage, export, and sharing functions; process subscriptions; communicate about the Service; answer requests; troubleshoot; measure product use; detect abuse; protect security; and comply with legal obligations.
We may send optional product or educational communications where permitted. You may unsubscribe from marketing messages; essential security, account, billing, and legal messages may still be sent. The optional product-updates checkbox is separate from account agreement. To withdraw that preference, email contact@docuhandson.com; you may also use an unsubscribe link when provided.
Where data protection law requires a legal basis, the basis may be performance of our agreement for account and service functions, compliance with legal obligations, appropriately balanced legitimate interests for security and service administration, or consent for activities that require it. We do not rely on acceptance of Terms as blanket consent to every processing activity.
4 Public profiles charts and shared media
Information you choose to publish in a professional profile or chart can become available to anyone with access to that page, including search engines. This can include the practitioner's displayed name, business details, technique descriptions, and authorized media. Public pages may be copied, indexed, or downloaded by others.
Content designated private is intended for the access scope of that feature. Public viewing permission and editing permission are separate. A password used for editing is not a promise that published content is private. Review the actual sharing screen before publication.
Unpublishing or deleting content does not guarantee removal from third-party websites, search caches, downloads, or printouts. These limits do not reduce our obligation to act on lawful deletion or restriction requests concerning information under our control.
5 Service providers and other disclosures
We disclose information to providers that perform functions for us, such as hosting, database storage, authentication, payment processing, email delivery, security, and support. The current technical setup includes Vercel for hosting and Supabase for database and authentication functions, with Stripe integration for paid services where enabled. Resend delivers account emails. Messages sent to our contact address are forwarded through Porkbun to our Google Gmail inbox. Supabase data is hosted in the United States; hosting, email, and payment providers may process information in other locations where they operate. Providers receive information needed for their functions under applicable agreements; their separate notices may govern interactions with their own services.
We may disclose information when legally required; to investigate fraud or protect rights and safety; at your direction; or in connection with a lawful merger, financing, acquisition, or transfer of business, subject to applicable protections and notice requirements.
User-uploaded media is provided for the selected Service functions and visibility settings. General-library contribution, promotional reuse, or AI-model training requires separate specific permission. The site does not include advertising pixels or a data-sale feature.
6 Cookies and browser storage
The Service uses browser storage and session technologies to maintain sign-in, remember settings, and store or restore work. Clearing browser data, changing devices, or using a shared browser can affect locally stored content. Sign out and protect devices used for professional work.
The current usage-statistics feature sets a guest usage cookie with a configured lifetime of approximately one year. It records a browser identifier used to recognize repeat activity. Session and authentication cookies may have different durations. Usage statistics are optional and start only after you choose Allow statistics in Privacy choices. Your choice is stored on this browser. Declining does not prevent chart creation. Consent records include the account or guest identifier, policy version, action, and acceptance time.
Optional usage statistics do not activate until you consent. You may change your choices through the Privacy choices button in the website footer. Browser settings can also control cookies, although disabling essential storage may affect the Service. This commitment must be matched by the deployed consent controls.
7 Retention and deletion
We keep information for the purposes described here and only as long as reasonably necessary, subject to applicable law. Account information and cloud charts are retained to provide account access and stored work until deletion or account closure is requested, subject to legal retention needs. Guest drafts remain on your device until you remove them, clear browser storage, or transfer them to your account. Support, security, usage, billing, referral, and consent records are retained as needed to administer the Service, resolve requests, prevent abuse, and meet legal obligations. Backup copies are removed through the applicable provider backup cycle; we do not promise an immediate deletion deadline for those copies.
You may request deletion or account closure through contact@docuhandson.com. We may retain limited information for legal obligations, security, fraud prevention, or disputes where permitted, and will explain relevant exceptions. Deletion from active systems may precede backup expiration. You are responsible for removing copies saved on your own devices and safeguarding records your practice must retain. We do not promise instant erasure of every copy worldwide.
8 Security and incident handling
We use reasonable technical and organizational safeguards appropriate to the information and risks. No online service can guarantee absolute security. Private chart requests require an authenticated account, and administrative functions are restricted to the authorized administrator. Authorized administration and support may require access to stored information. Public charts are deliberately accessible without sign-in.
If an incident triggers notification obligations, we will provide required notices to affected people and authorities within applicable deadlines. Our prohibition on patient information does not eliminate legal duties if such information is actually received. Report suspected exposure to contact@docuhandson.com without attaching sensitive content.
9 Your choices and applicable rights
Depending on applicable law, you may have rights to access, correct, delete, or receive a portable copy of personal information; restrict or object to processing; withdraw consent; and opt out of certain sales, sharing, or targeted advertising if those activities occur. Withdrawing consent does not invalidate lawful processing before withdrawal.
Send requests to contact@docuhandson.com. We will verify identity using information proportionate to the request, respond within legally required periods, and explain any lawful exception. Authorized-agent requests and appeals will be handled where applicable. You may complain to a competent privacy authority. We will not unlawfully discriminate against you for exercising rights.
10 International processing
Information may be processed in the United States and other countries where our confirmed providers operate. Those countries may have different data protection laws. Where an international transfer mechanism is required, we will use a valid mechanism appropriate to that transfer, such as applicable standard contractual clauses or an eligible adequacy arrangement. Contact us for information about the providers and safeguards applicable to your request. This Policy does not claim HIPAA certification or participation by DocuHandsOn in an international certification program.
11 Children and patient information
The Service is intended for adults and is not directed to children under 18. Users must not upload images of minors under these rules. If we learn that prohibited children's information has been collected, we will take appropriate steps consistent with applicable law.
DocuHandsOn is intended to describe professional techniques, not collect individual patient health information. A consent form does not change the permitted data scope. If a future approved patient-data workflow is introduced, its agreements, notices, safeguards, and legal responsibilities must be established before patient data is accepted.
12 Policy updates and contact
We may update this Policy to reflect accurate practices and legal requirements. We will publish the effective date and provide notice of material changes as required. If a new purpose requires consent, we will obtain it before beginning that processing. Questions and requests may be sent to contact@docuhandson.com.