Effective 17 August 2026
This privacy policy explains how RepCase ("RepCase", "we", "us" or "our") collects, uses, stores and protects your information when you use our mobile application (the "App"). RepCase is a tool for medical device sales representatives to track product usage, bill sheets, inventory, pricing and commissions.
It describes our practices toward the people who use the App. If you are a patient whose information may appear on a document a representative handles, section 7 and our consumer health data policy are the relevant parts.
Account information. When you create an account we collect your name, email address, password (stored in hashed form) and company name. You may optionally add a profile photo. If you set an in-app PIN, only a cryptographic hash of it is stored, never the PIN itself.
Information you enter in the App. This includes product usage entries (case references, dates of surgery, facilities, surgeon references, products, quantities, costs, and lot or serial numbers), vendor price sheets and catalogs, inventory records, scheduled cases, sales visit records, commission information, and vendor contact details such as vendor names and email addresses that you choose to add.
Bill sheet images. When you scan or import a bill sheet, the App analyses the image on your device and applies black-box redaction over patient-identifying information it detects, before the image leaves your device. Only the redacted image is uploaded and stored. Section 7 explains the limits of that redaction plainly, and you should read it.
Usage information. We count how many AI bill sheet scans your account performs, so that we can enforce plan limits and prevent abuse. We record delivery information for emails you send through the App — recipient addresses, subject, and whether the message was accepted and delivered. We store your subscription status.
We do not use third-party advertising or analytics trackers in the App, we do not sell your data, and we do not track you across other companies' apps or websites.
Your account information, entries and redacted bill sheet images are stored in a cloud database and file storage hosted by Supabase, our backend infrastructure provider, on servers in the United States. Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our hosting provider. Access is restricted by per-user and per-company access rules enforced in the database, so your data is available only to you and, where your company account is configured for it, to others in your company.
We share information only with the providers needed to operate the App, and only for that purpose:
We do not sell your information, and we do not share it with advertisers or data brokers.
We use your information solely to provide the App's features: syncing your data across devices, extracting line items from bill sheets, sending vendor emails you initiate, managing your account and company access, enforcing plan limits, and providing support.
The vendor email feature only sends email when you tap Send, and only to the vendor contacts you name for that send. Each email includes the case's product line items and any redacted bill sheet images on file. A copy to yourself is optional and goes only to your own sign-in address.
You are responsible for the accuracy of the vendor email addresses you add. Please check them before sending: email cannot be recalled once it has been delivered, and a mistyped address sends the document to the wrong person permanently.
RepCase is built to keep patient-identifying information out of the system. Bill sheet images are redacted on your device before upload, and the App never asks you for patient names, dates of birth or medical record numbers.
We want to be straightforward about the limits of the redaction. It is automatic detection, not a guarantee. It is tuned to find printed patient labels and labelled fields; handwriting, an unusual layout or a poor-quality photo can defeat it. If the App cannot analyse a page, or detects a patient label it cannot cleanly cover, it refuses that page rather than uploading it — but no automatic system catches everything.
So please look at the redacted image before you send it, and do not type patient identifiers into free-text fields such as case labels or notes. If you think a bill sheet containing patient information was uploaded, contact us at the address in section 15 and we will remove it.
Separately, you should know what a saved case record contains even when no patient information is present: the date of surgery, the facility, a surgeon reference, and the lot or serial numbers of the products used. We do not hold anything that names a patient, and we do not attempt to re-identify any individual from this information, and we require the providers listed in section 4 not to do so either. We nonetheless treat these records as sensitive and protect them accordingly.
The App is a sales-tracking tool. It is not intended to be a system of record for protected health information, and it should not be used as one.
We keep your information for as long as your account is active, so that it stays available across your devices. You can delete individual entries, images and vendor contacts in the App at any time, and those are removed when you do.
When you delete your account, your data is deleted immediately — see section 9. We do not keep a copy after that. Two things survive, and we would rather say so than imply otherwise: copies may persist for a short time in our hosting provider's encrypted backups until those backups expire on their normal schedule, and any bill sheet you have already emailed to a vendor remains in that vendor's inbox, which we cannot reach.
Email delivery records and scan counts are kept while the account exists and are deleted with it.
You can delete your entire account from inside the App: open Settings and choose Delete Account. Deletion is immediate and permanent. It removes your profile, your profile photo, your PIN, your cases and their line items, your bill sheet images, your inventory items, locations and movement history, your price sheets, scheduled cases, sales accounts and visits, vendor contacts, health systems, facilities and surgeons, and the delivery records for emails you have sent.
If your company account has other members and you are its only administrator, the App will ask you to make someone else an administrator first, so your colleagues are not left without one. If you would rather we deleted your account for you, contact us at the address in section 15.
We use encryption in transit, database access rules that isolate each user's and each company's data, hashed credentials, and an optional in-app PIN lock with inactivity timeout. No method of transmission or storage is completely secure, so we also recommend using device-level security such as Face ID, Touch ID or a strong passcode alongside the App's lock screen.
Wherever you live, you can access and correct most of your information directly in the App, and you can delete your account and its data at any time (section 9). For anything you cannot do in the App, contact us at the address in section 15 and we will respond within the time your local law allows.
If you are in the European Economic Area or the United Kingdom, you have the right to access your personal data, to have it corrected or erased, to restrict or object to how we process it, to receive a portable copy, and to withdraw consent where our processing relies on it. We process your data to perform our contract with you (providing the App), to meet our legal obligations, and for the limited legitimate interests of keeping the service secure and preventing abuse. Our servers are in the United States; where we transfer personal data out of the EEA or UK we rely on the European Commission's standard contractual clauses. You also have the right to complain to your local data protection authority.
If you are a California resident, you have the right to know what personal information we collect and why, to request a copy of it, to request correction or deletion, and not to be discriminated against for exercising those rights. In the past twelve months we have collected the categories described in section 2: identifiers (name, email), commercial information (the case and product records you enter), visual information (redacted bill sheet images), and internet activity limited to your own usage of the App.
We do not sell or share your personal information as those terms are defined under California law, and we do not use it for cross-context behavioural advertising. To make a request, use Delete Account in the App or contact us at the address in section 15.
Washington and Nevada have laws covering health-related data held by companies that are not hospitals or insurers. Our consumer health data privacy policy explains what we collect that may fall within those laws, who we share it with, and how to exercise the rights they give you, including the right to withdraw consent and to have that data deleted.
The App is intended for professional use and is not directed at children under 13. We do not knowingly collect information from children.
If you have any questions about this privacy policy, want to exercise any of the rights above, or would rather we deleted your account for you, contact us at support@repcase.io.
We may update this privacy policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the effective date above.