Privacy policy

SynaptoFlow is provided by Dr. Shahbaz Waseem Gul, trading as SynaptoNex, Abbottabad, Khyber Pakhtunkhwa, Pakistan (“we”). SynaptoNex is a trading name and is not yet an incorporated company. Contact: synaptonex@gmail.com.

For patient information, the hospital or practice that enrols the patient decides what is collected and why. It is responsible for the record, as it is for its paper notes. We act only on its instructions, under a data processing agreement signed before any patient is added. For information about visitors to this website and people who contact us, we decide, and this policy covers that too.

As of the date above, Pakistan has no general data protection law in force; the Personal Data Protection Bill has not been enacted. The Prevention of Electronic Crimes Act 2016 applies to unauthorised access to and disclosure of data, the Electronic Transactions Ordinance 2002 to electronic records, and the Pakistan Medical and Dental Council's code of ethics to the confidentiality obligations of the clinicians who use SynaptoFlow. We hold ourselves to the commitments in this policy whether or not a statute requires them, and we will update it when a data protection law comes into force.

Entered by the surgical team:

• The patient’s name, date of birth, and hospital number (MRN) if given.
• Mobile number and email address, if given, to send the checklist link.
• The operation, its date, the team’s written instructions and any extra checklist items.
• Notes for the team, which the patient does not see.
• Clinicians’ decisions, reviews, case status changes and the WHO Surgical Safety Checklist record.

Entered by the patient, or by a family member on their behalf:

• Whether they consented, and if a relative filled in the form, the relative’s name and relationship, and their statement that the patient asked them to and agrees.
• Answers to the checklist: blood-thinning medicines and their names, the blood test, blood pressure readings, food and drink on the day, whether they are keeping a religious fast and the time of sehri, tobacco use, and any notes they type.
• After the operation: tasks done, symptoms ticked and any note.
• Their preferred language.

Recorded automatically: the time of every answer and change, a shortened form of the internet (IP) address it came from (the last part removed, so it points to a network, not a device), when the link was opened, and which staff account did what. This is the audit trail. Your language choice is also kept in your own browser so the page opens in the same language next time.

Not collected: payment card details, location, contacts, photos, camera or microphone access. There are no advertising or analytics trackers on SynaptoFlow.

• To show the patient their checklist and record their answers.
• To show the surgical team those answers, and to email the team when a patient reports something urgent.
• To send the patient their link and reminders, in their language.
• To keep the audit trail, so it can later be shown who recorded what and when.
• When a clinician asks for it, to draft checklist suggestions, translations or a phone script with AI (section 6).
• To answer support requests from the practice.

We do not sell any of it, use it for advertising, or use it to train or improve any AI model. Our staff look at patient records only when the practice asks for support or to investigate a security incident.

• The surgeon who enrolled the patient, and the care-team members that surgeon has added (other surgeons, anaesthetists, nurses, coordinators). The database enforces this: one practice cannot read another practice’s patients.
• The patient, or whoever holds their link. The link is personal: a replaced or switched-off link stops working at once.
• Our service providers, below, only to run the service.
• Anyone a court or a law-enforcement body is legally entitled to require it from. We will tell the practice unless the law forbids us.

• Supabase: the database and sign-in. Holds every record. Region set per deployment and named in the practice's agreement.
• Vercel: runs the website and server functions. Data passes through; it is not stored there.
• Resend (United States): sends emails. Receives the recipient's address and the message. Care-team alerts name no patient.
• Anthropic (United States): AI drafting, only when a clinician asks. Receives the procedure name and the team's instruction or checklist text, and, for a phone script, which questions the patient has not answered or has flagged, including any blood-thinner name they gave. SynaptoFlow never sends it the name, contact, MRN or date-of-birth fields; staff are asked not to type a patient's name into instructions or checklist text, which are sent as written. Under its commercial terms Anthropic does not train its models on this data.
• Twilio (United States): WhatsApp messages, only if the deployment switches WhatsApp on. Receives the mobile number and the message.

These providers are outside Pakistan, so using SynaptoFlow involves transferring data abroad. The current list and regions are on the compliance page. We give practices 30 days' notice before adding a provider.

• Everything travels over HTTPS and is encrypted at rest by the database provider.
• Patient links are long random tokens carried after the # in the address, so they are not sent to or logged by web servers. Links expire at the end of follow-up and can be switched off at any time.
• Staff accounts are by invitation only, and staff are signed out after 15 minutes without activity.
• Database rules, not just the app, decide who can read or change each record. Every change is written to an append-only audit trail whose entries are chained by cryptographic hash, so a removed or altered entry can be detected.

No system is perfectly secure. If we find that patient data has been accessed without authority, we will tell the affected practice within 72 hours of finding out, with what we know, so it can tell its patients, and we will report it to the National Cyber Crime Investigation Agency where an offence under the Prevention of Electronic Crimes Act 2016 may be involved.

While a practice uses SynaptoFlow, a patient's record is kept for seven years after the operation date, because a clinical record may be needed long after the event. After that, the name, date of birth, MRN, phone number, email, the name of any relative who answered, and notes the patient typed are erased. The audit trail is kept so the record of what happened still holds together. It holds no name, date of birth, MRN, full phone number or email from the record, and no note the patient typed. It does keep the answers, the time of each, the shortened internet address, and what staff wrote as part of the clinical record (instructions, decisions, theatre notes and call logs); staff are asked to write relationships there, not names or numbers.

When a practice stops using SynaptoFlow, it receives a full export of its records. Ninety days later we erase the identifying details of all its patients, as above, and close its accounts, unless it has agreed a paid archive with us or the law requires us to keep them. The audit trail, without those details, stays in the shared append-only record, because an entry cannot be removed without breaking the chain for every practice. From then on the practice keeps the full record under its own retention rules.

Messages sent through the website contact and design-partner forms are kept for two years after the last contact.

• A patient may say no on the first screen and be prepared by the surgical team in the usual way. Nothing more is collected through the link after that.
• A patient may ask to see or correct their information, through the practice or by emailing us. We pass requests to the practice, which decides, because the record is theirs.
• A patient may ask for their identifying details to be erased. Because the record may be part of a medical record the practice must keep, the practice decides; if it agrees, we erase the details listed in section 8, and the audit trail is kept as described there.
• If a relative fills in the form for an adult patient, they confirm that the patient asked them to and agrees, and the record shows that a relative answered.
• If the patient is under 18, a parent or guardian must give consent; the form will not accept consent from anyone else.

We will post any change here with a new effective date, and tell practices by email 30 days before a change that affects patient data. Patients asked to consent see the version current when they consent, and the version is recorded with their consent.

Complaints to synaptonex@gmail.com. We reply within 14 days.