Privacy Policy

1. Who we are

SynaptoNex (“we”, “us”, “our”) operates SynaptoFlow, a pre-operative patient compliance tracking service. This policy applies to the SynaptoFlow website (synaptoflow.vercel.app) and the underlying service. Contact: synaptonex@gmail.com.

2. Roles under data protection law

SynaptoFlow is offered to surgical practices in Pakistan. This policy is written to Pakistani law. Pakistan has no personal data protection statute in force as of this writing; the Personal Data Protection Bill remains in draft. We nonetheless apply the obligations set out below as binding on ourselves, and we will update this policy when the Bill is enacted.

The surgical practice determines what patient information is collected and why, and is therefore the controller. SynaptoNex acts only on the practice's instructions and is the processor. A written Data Processing Agreement between the practice and SynaptoNex governs this relationship and must be signed before any patient information is entered.

3. Data we collect

Surgeon-entered data:

• —Patient name. used to identify the patient on the dashboard and the patient checklist
• —Patient date of birth (DOB). used for identity verification when the patient opens the link
• —Patient medical record number (MRN, optional). links the SynaptoFlow record to the surgeon's own record system
• —Patient email and/or phone number (optional). used to send the checklist link and reminders
• —Scheduled surgery date and surgery type. used to drive the checklist and time-based prompts
• —Surgeon-provided pre-op instructions (free text, optional). shown to the patient on their checklist

Patient-entered data:

• —Checklist responses. six fixed clinical items (medication cessation, blood count, blood pressure, fasting, smoking, instructions read) plus any procedure-specific items generated for the patient
• —Blood pressure reading (when entered). numeric systolic/diastolic value, used to flag uncontrolled BP to the surgeon
• —Consent timestamp. records when the patient acknowledged this Privacy Policy

System-generated data:

• —Compliance percentage and clearance status. computed from the checklist responses
• —Audit log entries. every change is recorded with a timestamp and the actor type (surgeon or patient)
• —Last accessed timestamp. records when the patient last opened their checklist

We do not collect: insurance information, payment information, full clinical history, free-text clinical notes other than what the surgeon provides, location data, biometric data, or any data from cameras or microphones.

4. Permitted uses and disclosures

• —To perform the Service. creating, delivering and recording pre-operative checklists at the direction of the surgical practice
• —As required by law. including retention of the audit trail for the period the practice is required to keep medical records
• —For our own management and administration. and never in a way the practice itself could not
• —Never for anything else. we do not sell PHI, use it for marketing or fundraising, or use it to train, fine-tune or improve any machine learning model

5. How we use the data

• —Display the patient's pre-op compliance status to their enrolling surgeon and that surgeon's designated team
• —Send the patient their checklist access link and reminder emails
• —Calculate compliance and clearance status in real time
• —Generate procedure-specific checklist items via AI assistance (see Section 7)
• —Maintain an audit log so the surgeon can verify what was done and when
• —Provide technical support when requested by the surgeon
• —Improve the Service through aggregated, fully anonymised usage statistics

We do not use your information for advertising, marketing to third parties, or training third-party AI models on your data.

6. Who has access

• —The surgeon who enrolled the patient, and that surgeon's designated care team within their account
• —The patient themselves, via the link sent to them
• —SynaptoNex technical staff, on a least-privilege basis, only when necessary for support, debugging, or security incident response

Row-level security is enforced at the database layer: a surgeon's queries cannot return another surgeon's patients.

7. Sub-processors

SynaptoFlow uses the following third-party processors. Each receives only the data it needs for its specific function.

• —Supabase (database, authentication, storage). all primary patient and surgeon data; encrypted at rest. US regions; data residency configurable
• —Vercel (hosting and edge runtime). serves the application code; processes inbound requests; does not durably store patient data
• —Resend (transactional email delivery). recipient email address, patient first name, and the checklist link, when an invitation or reminder is sent
• —Anthropic (AI feature generation). patient first name (no surnames), surgery type, dates relative to surgery (e.g. "in 2 days"), and clinical compliance flags. We do not send dates of birth, MRNs, full names, contact details, or free-text clinical notes. Anthropic does not use API data to train its models

We will update this list when we change sub-processors. Material changes will be communicated to active surgeon accounts by email.

8. International transfers

Our infrastructure providers currently store and process data outside Pakistan. We do not knowingly transfer Protected Health Information to a jurisdiction without an equivalent safeguard in place, and we will notify each affected practice in advance if that changes.

9. Security

• —All transit is over HTTPS using TLS 1.2 or higher
• —Data at rest is encrypted by our database provider
• —Access is controlled via row-level security and per-account authentication
• —API endpoints are rate-limited to mitigate abuse and protect against brute-force attempts
• —Strict Content Security Policy and standard hardening headers are applied to every response
• —Audit logs record changes to patient records

No internet-connected service is perfectly secure. Where we discover a breach of unsecured Protected Health Information we will notify the affected covered entity without unreasonable delay and within the window set out in our Business Associate Agreement with that practice, so the practice can meet its obligations under the its own obligations to affected patients. There is no statutory breach notification deadline in Pakistan at present; we commit contractually to notifying the practice without unreasonable delay and in any event within 72 hours of discovery. We will notify the relevant data controller (the surgeon) without undue delay and within 72 hours where required by GDPR.

10. Retention

Patient records are retained for as long as the practice maintains an active account and for as long as the practice is required to keep medical records under Pakistan Medical Commission requirements and its own institutional policy. The audit trail and signed surgical safety checklists cannot be deleted, by anyone, including us. That is deliberate: a record its owner can erase after an adverse event is not a record. Where an entry was made in error it is voided with a written reason and both the original and the correction remain visible. Clinical detail on a patient record can be deleted by the practice from the dashboard, and the audit entry showing that a deletion occurred remains. On account closure, patient data is deleted within 30 days except the audit trail, which is retained for the statutory medical records period and isolated from active use.

11. Your rights

Subject to applicable law, you have the right to:

• —Access — request a copy of personal data we hold about you
• —Rectification — ask us to correct inaccurate or incomplete data
• —Erasure — ask us to delete your data
• —Restriction — ask us to limit how we use your data
• —Portability — receive your data in a machine-readable format
• —Objection — object to processing on legitimate-interest grounds
• —Withdrawal of consent — at any time, by stopping use of the Service or contacting us
• —Complaint — you may complain to us at synaptonex@gmail.com, to your surgical practice as the covered entity, or to the the National Commission for Personal Data Protection once it is operational, or to the Federal Investigation Agency Cybercrime Wing under the Prevention of Electronic Crimes Act 2016. We will not retaliate against anyone who files a complaint.

For patients: most rights are exercised through the surgeon (the data controller). For surgeons: contact us at synaptonex@gmail.com. We respond within 30 days.

12. Cookies and similar technologies

We use the minimum technical state required to keep you logged in (Supabase authentication tokens) and to remember consent within a browser session. We do not use advertising cookies, third-party analytics that build user profiles, marketing pixels, or cross-site tracking.

13. Children

SynaptoFlow may be used in paediatric surgical care. Where the patient is under 18, the surgical practice is responsible for obtaining consent from a parent or legal guardian and for complying with applicable state law on the confidentiality of minors' health information. We do not knowingly collect information directly from a child.

14. State privacy notice

The surgical practice is the controller of the patient information it enters. SynaptoNex processes that information only on the practice's instructions and only for the purposes set out in this policy.

15. Changes to this policy

We may update this Privacy Policy as the Service evolves. The effective date above will be updated. Material changes will be notified to active surgeon accounts by email. Continued use of the Service after changes constitutes acceptance.

16. Contact

Privacy questions, sub-processor list updates, and data subject requests: synaptonex@gmail.com
We aim to respond within 5 working days and complete formal requests within 30 days.