Creative AI Solutions, LLC
Privacy Policy
Effective
This policy covers the public Drain Log website, the patient recording app at /app/, patient approval pages, and Drain Log Administration at /admin. Patient tracking history stays in the patient's browser. Staff accounts, organization settings, approval administration, and approval emails involve separate server processing described below.
1. Patient readings and local settings
No patient account, username, or password is required to record drain readings. Readings, observations, dates, notes, patient details supplied by the clinic or restored from a backup, and report contents are stored locally in browser storage. Report previews, PDFs, and JSON backups are created locally. If you choose Email to staff, the selected report is temporarily processed by the Drain Log email service and Resend as described below.
Your local data lets you view readings, calculate totals, prepare reports, and export files. Report previews and emailing PDFs to staff require active staff approval; recording, viewing saved readings, and JSON backup/restore remain available without approval. We do not use your local tracking data for advertising or sell it. The public sample report uses invented information and does not read your saved data.
2. Staff accounts and sign-in
A prospective staff member can select Request an invitation on admin sign-in and supply a full name, email, and organization. Send processes these fields temporarily through the Drain Log email service and Resend, delivering the request to cdalesch@caisolutionsllc.com with the supplied email as Reply-To. It does not create an Auth account, send an account invitation, or assign organization access. The name, email, and organization are not saved in the Drain Log database, application logs, or browser storage; the provider and recipient mailbox may retain the message. The form clears on successful submission, Cancel, navigation away from the form, or reload. Failed submissions retain the draft for retry. A separate opaque shared rate-limit counter limits public request email volume without storing contact details. Temporary rate-limit records older than one day are cleared by daily cleanup.
Staff use their own invited account and sign in at admin home. Supabase Auth processes account email, password authentication, authenticator enrollment and verification, and invitation or reset links. Staff enter their full name when completing an account invitation; it is saved in Auth account metadata and used for the Requests greeting, staff directory, and setting-change attribution. Password reset preserves that name. The admin Settings page has no personal-name editor.
Drain Log stores roles, organization assignments, invitation and acceptance status, and administrative history separately from display names. Names do not grant permissions. The admin browser stores its authentication session in session storage and temporary account-setup state in the tab. Sign out when finished on a shared device.
3. Organization settings and staff visibility
Physician names and optional contact phone numbers, the Patient Approval Email CC List, and the approval review window are shared settings for one organization. All active, authorized staff in that organization can view and change them. Other organizations' settings are separate. Platform owners have broader organization and staff-management access; each change still targets the relevant organization.
Settings shows active staff names and emails for that organization's CC selector. Saved CC lists can contain up to 20 addresses. Selecting or entering an address does not create an account or grant access. Administrative audit records associate setting changes with an organization, time, and acting account. Settings displays the last update and the actor's currently saved name and email when available, including individual physician updates. Removed physicians are hidden from the active directory and retained for administrative history.
4. Patient approval links and request records
Opening the staff link form generates and displays a random Clinic Patient ID (GUID). Generating the link saves that ID, organization, issuing staff account, link-secret fingerprint, expiry, and a care-team setup snapshot: selected physician, organization clinic name, saved physician contact phone, and one to four ports. The clinic keeps the mapping between this GUID and the patient's identity in its own system. The GUID is included in the approval email and authorized staff request list; it is excluded from readable URL fields, patient status responses, signed report credentials, and audit details. An encrypted URL fragment contains a binding to this GUID and organization alongside the patient name and surgery date; it is not saved in the database.
Opening a patient link alone does not submit a request. Selecting Submit approval request sends a random browser installation identifier, the link secret, and a private request credential separately from readings. The approval service stores secret/credential fingerprints, the organization, Clinic Patient ID, care-team snapshot, a DL Reference ID, submission and deadline timestamps, decision status, staff decisions, and audit records in Supabase. The hosting platform supplies the public requester IP address when available for staff review and abuse detection. An IP address is not proof of identity, and shared IP addresses are not blocked.
Each link can create one request, tied to the submitting browser's installation identifier and private credential. This is not hardware identification. An unused forwarded link can be submitted by whoever receives it first; staff must verify the patient through their organization's process and match the reference on the patient's device before approval.
Unused links expire 30 minutes after generation. The review window starts at submission, defaults to 48 hours, and can be set to 1–720 whole hours by authorized staff of that organization. Changes also recalculate that organization's active pending deadlines from original submission times; they do not reopen already-expired or overdue requests or change approved access. Report access lasts 28 days from staff approval.
The requesting browser saves its installation identifier and private credential locally, separately from readings backups. It can retrieve its saved setup while the request is available and pending or approved. The patient name and surgery date are carried in an authenticated encrypted URL fragment. Fragments are not part of HTTP page requests and are removed from the address bar by the tracking or approval page. Submission and status checks send the encrypted fragment in the POST body. The server decrypts it temporarily, verifies its organization and Clinic Patient ID against the link or credential-bound request, and returns those details with the saved care-team setup. The name and surgery date are not written to the database, Auth metadata, or application logs. The patient browser saves the encrypted fragment with its local request credential. After submission, clinic-supplied patient name, surgery date, physician, clinic, phone, and port count fill local settings and are read-only in the patient app. Settings presents these details in a compact summary; patient name and surgery date are always read-only there. They replace different saved values; readings and optional drain locations are preserved. Settings saves and backup restores preserve an existing clinic profile. Backups include local patient details and any read-only clinic profile, so keep backup files private. Neither submission nor status checks send readings, notes, or report contents.
5. Patient approval email
Staff must enter a patient name, surgery date, and valid patient email before generating a link. These fields remain temporarily in the admin form for checking, correction, and emailing. They are not saved in the Drain Log database, Auth metadata, application logs, or admin browser storage. Name and surgery date are encrypted into the link and later saved on the patient's device as described above. Cancel, Close, organization changes, sign-out, or page reload discard the contact draft. Closing the panel does not revoke an issued link.
Email Patient temporarily processes the name and email through the Drain Log email service and Resend. The message includes the patient name, surgery date, approval link, Clinic Patient ID, physician, clinic, contact phone, port count, and expiry. It goes to the entered patient address and copies the signed-in staff member plus the organization's current saved CC list, with duplicates removed and the patient excluded from CC. All recipients can see the message details and other copied addresses. The provider and recipient mailboxes may retain the email under their own retention practices. Provider submission does not confirm inbox delivery, submit an approval request, or approve report access.
The staff-entered name and surgery date populate the patient's local tracking settings after submission. Only the issuing staff member can email or change an available, unused, unexpired link. Back and Continue retain the same link, GUID, and expiry; care-team corrections save to that existing link, while name and surgery-date corrections refresh its encrypted fragment and email corrections remain temporary. Email the updated link after corrections; an earlier email cannot be changed. Once submitted, contact the care team for a new link if patient settings need correction.
6. Report access and offline use
The app header shows the latest request status and links to Patient approval. Pending status updates automatically while tracking or Patient approval is open online in the original browser. The report screen also checks access when opened. The app saves a signed report-access credential and verifies it locally for report previews until expiration. Report previews can then work offline while access remains valid; emailing a PDF requires internet. A successful online check applies revocation, expiry, or unavailable organization status. Online checks send installation/request identifiers and the private credential, not readings or report contents.
Approval alone does not send patient reports, create a patient account, or provide clinical monitoring. Choosing Email to staff sends the locally generated PDF, including patient details, surgery date, selected readings, and observations, to the confirmed account email of the staff member who approved that request. The recipient is shown before sending. The server rechecks active approval and staff access and does not accept an arbitrary recipient or copy the approval-email CC list. The PDF and recipient are processed temporarily by Drain Log and Resend, without being saved in the Drain Log database or application logs. The provider and recipient mailbox may retain the email and attachment. Email submission does not confirm inbox delivery or staff review. Reports are not monitored for emergencies; call your care team for urgent concerns. You can also print a prepared report through the browser. Installing the admin app does not change staff permissions or make administration available offline; its service worker does not cache private admin pages or API responses.
7. Retention, backups, and deletion
Requester IP addresses are cleared after 30 days by daily cleanup, allowing up to the next daily run. Temporary rate-limit metadata is removed after one day by that cleanup. Clinic Patient IDs, link and request references, care-team snapshots, decisions, organization settings, staff assignment history, and administrative audit records are retained to operate and investigate access; expiry of a link or approval does not delete those records.
Use the patient app's Settings to export a JSON backup, restore a backup, or delete all readings. Import replaces local readings and settings; it does not merge histories. Delete all readings removes measurements but keeps settings separately. Clearing site data, private browsing, browser cleanup, or uninstalling can remove local readings, settings, and approval credentials. Drain Log has no server backup of readings. A previously exported JSON backup can restore readings and settings, but does not restore or transfer approval. A different browser, device, or website has separate storage.
If you previously purchased access, any retained transaction records are separate from local readings and do not replace the current approval requirement. This policy does not promise deletion of provider-held emails or earlier transaction records when browser data is cleared.
8. Hosting and service providers
Vercel hosts the website and API; Supabase provides staff authentication and administrative database storage; Resend handles approval-link email and patient-requested report email. These services necessarily process connection and operational information for their functions. Drain Log does not include third-party advertising SDKs, marketing trackers, or social-media pixels, and does not share local tracking history with data brokers.
9. Care-team use
Organizations select staff access, verify patients, maintain contact details and CC recipients, and handle the patient-to-GUID mapping in their own systems. Their handling of patient records and received emails is separate from storage in the Drain Log patient app. Ask your organization about its own privacy practices and contact Creative AI Solutions, LLC with questions about the processing described here.
10. Changes and contact
We may update this policy as the application or its data practices change. The effective date above identifies this version. Questions may be directed to Creative AI Solutions, LLC through caisolutionsllc.com.