Privacy Policy

SupplyTag ("we", "us") is a Pennsylvania, USA business that provides subscription software for healthcare practices to reorder supplies using reorder tags. This policy explains what information we collect through our website and app (the "Service"), how we use it, and your choices.

• Account information: your name, email address and password (passwords are stored only in hashed form by our sign-in provider), and your role in your practice.
• Practice information: practice name, notification email, team members and invitations.
• Supply and ordering data: items, reorder tags, vendors, carts, purchase orders, delivery dates, invoice totals, internal order notes, Autopilot rules and an activity log.
• Billing information: your plan, billing status and billing history. Card details are collected and stored by Stripe, not by us.
• Messages you send us: for example through our contact form or by email.
• Technical information: basic logs such as IP address, browser type and error reports, used to keep the Service secure and working.

When you use the camera or "Scan from photo", the image is read on your device to find tag codes. We don't upload or keep those photos.

SupplyTag is built to manage supplies, not patients. It is not designed or intended to store protected health information (PHI) or any patient information. Please do not enter patient names, dates of birth, treatment details or other patient data in item names, order notes or any other field.

• to provide the Service — scanning, carts, purchase orders, Autopilot, order tracking and year-end reports;
• to manage your account, subscription, trial and billing;
• to send service messages, such as order summaries and billing notices;
• to answer support requests;
• to keep the Service secure, prevent abuse and fix problems; and
• to meet legal, tax and accounting obligations.

The supply, vendor and order data your practice enters belongs to your practice. We process it only to provide the Service to you. Owners and Admins can export year-end order data to a spreadsheet at any time.

We do not sell your personal data, and we do not share it for cross-site advertising. We share information only as described below.

We use a small number of trusted providers to run the Service. They may process data only on our behalf:

• Lovable and its cloud infrastructure partners — application hosting, database and sign-in.
• Stripe — payment processing, subscriptions, invoices and sales tax.
• An email delivery provider — only if and when we send emails such as order summaries.

Your vendors. When your practice places an order, the order details go to the vendor you choose. That vendor handles the information under its own privacy policy.

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or sale of the business (in which case this policy will continue to apply to your data).

Payments are processed securely by Stripe. SupplyTag never sees or stores your full card number. Stripe may share limited details with us, such as the card brand, last four digits and expiry date, so we can show your billing status. Stripe's use of your information is described in Stripe's privacy policy.

• Essential: we keep your sign-in session and your light/dark theme preference in your browser so the app works.
• Checkout: Stripe sets its own cookies on the payment form to process payments and prevent fraud.
• We don't use advertising cookies.

You can clear cookies and site data in your browser at any time; you'll then need to sign in again.

We keep your practice's data while your account is active. If your subscription ends, we keep the data for a limited time so you can come back, unless you ask us to delete it sooner. We keep billing records as long as tax and accounting laws require.

An Owner of your practice can ask us to delete the practice account and its data by emailing support@getsupplytag.com from the address on the account. Individual users can ask us to delete their own account the same way. We'll confirm the request and delete the data within 30 days, except for records we must keep by law (such as invoices). Deleted data may remain in encrypted backups for a short time until those backups expire.

Data is encrypted in transit. Each practice's data is kept separate from other practices', and access inside a practice is limited by role (Owner, Admin or Staff). No system is perfectly secure, but we work to protect your information and will notify affected practices of a security incident as required by law.

You can view and update your profile and practice details in the app. Depending on where you live, you may have the right to access, correct, export or delete your personal information. To make a request, email support@getsupplytag.com. We won't treat you differently for making a request.

The Service is for businesses and is not directed to children. We don't knowingly collect information from children under 16.

If we make material changes, we'll update the date above and let account Owners know by email or in the app before the changes take effect.

Questions about privacy? Email support@getsupplytag.com or use our contact form.