1. Who we are
DropRecs™ is a product of DropCharge LLC (the "Company"), a New York limited liability company. This Privacy Policy describes how we handle data when you use the DropRecs iOS application or the web application at droprecs.app (together, the "Service").
2. Data we collect and where it lives
On your device
- Patient first name — you type it locally for the greeting on the final recs PDF. It is not sent to the AI. If you share a visit by link, it travels inside that PDF, which is available for 24 hours, then deleted.
- Doctor signature — the name and credentials you enter in Settings appear on the PDF the patient receives. Stored in your browser's local storage.
- Saved templates — reusable rec templates you create in the Library. Stored in your browser's local storage.
- Recents log — the Recents tab stores the timestamp of each share action, optionally a single-letter patient initial, and the de-identified rec content (the recommendations you generated, with no patient name or other identifiers). The rec content is kept on-device so you can reopen a past rec, AirDrop it again, or save it as a reusable template — same on-device-only treatment as saved templates.
- Preferences — your theme (light/dark), patient language (English/Spanish), auto-lock mode, biometric-lock flag.
Sent to us (servers we operate)
- Access code — during closed beta we verify a per-physician access code on each API request. The code is not personally identifying.
- De-identified clinical transcript — the recording is transcribed on-device on the physician's iPhone (audio never leaves the device). The resulting transcript, which contains clinical recommendations without patient identifiers, is sent to a HIPAA-eligible cloud AI provider via our API for rewriting into patient-friendly language. The cloud provider processes the transcript under DropCharge LLC's signed HIPAA Business Associate Agreement (BAA). The transcript is not stored after processing; the recs are passed back to the physician's device.
- Patient mobile number (only if you ask for a text): if you ask your doctor to text you your recommendations, your doctor types your mobile number into DropRecs. Our server uses it once, to send you one text message with a link to your visit, and then discards it. We do not save it, write it to our logs, or use it for anything else.
What we do NOT collect
- No patient full names, MRNs, dates of birth, or addresses. We do not store patient phone numbers (see "Text messages" below).
- No third-party analytics trackers, advertising identifiers, or behavioral tracking.
- No device location data.
- No photos or contacts.
3. Text messages (SMS)
When you ask your doctor for a text, DropRecs sends one message from our toll-free number, (844) 605-1640. The message contains a link to your visit recommendations. The link works for up to 24 hours, and stops working soon after you open or save it. The message does not include your name or any medical details.
- How often: one message per visit, only when you ask for it or agree to it. We never send marketing texts.
- Cost: message and data rates may apply.
- Opt out: reply STOP at any time. You will not receive further messages from this number. Reply HELP for help.
- Replies: this number does not receive other replies. For questions about your visit, contact your doctor's office. For help with DropRecs, email support@droprecs.app.
- Sharing: no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging opt-in data and consent will not be shared with any third parties.
- What our provider keeps: our text-messaging provider (our HIPAA-eligible cloud provider, under our Business Associate Agreement) keeps delivery records. If you reply STOP, it keeps your number on an opt-out list so that no DropRecs text is sent to it again.
- We keep a record that you agreed to the text (the time, your doctor's DropRecs account and the message ID), but not your phone number.
- Wireless carriers are not liable for delayed or undelivered messages.
4. Third-party processors
DropRecs uses the following processors to deliver its core functionality:
- HIPAA-eligible US cloud infrastructure provider — hosts the API and executes the AI rewrite of clinical transcripts into patient-friendly recommendations. DropCharge LLC has signed a Business Associate Agreement (BAA) with this provider. Inference runs in US regions only — data does not leave the United States. The provider does not log, retain, or use the request content for model training. A current list of named subprocessors is available on request to privacy@droprecs.app. It also sends the text messages described in "Text messages (SMS)".
- Static site host — hosts the marketing pages and the patient-facing install landing. No PHI is transmitted to this host; it serves only static HTML and the iOS install redirect.
We instruct the AI model to omit proper names and absolute dates from its output.
5. iOS permissions
- Microphone — used only when you tap Record. Captured audio is transcribed on-device on your iPhone and never leaves the device.
- Speech Recognition — used by iOS's on-device speech recognizer to convert your dictation to text without sending audio off the device.
- Face ID / Touch ID — used locally to unlock the app. Biometric templates never leave Apple's Secure Enclave; we receive only a pass/fail signal.
6. Retention and deletion
Content you create (recordings, recs, templates, recents log) lives on your device. If you share a visit by link, the PDF is available for 24 hours, then deleted. Deleting the app from your iPhone, or clearing your browser's local storage, erases everything DropRecs has stored about you.
We retain server-side request logs for 30 days for operational purposes (rate limiting, abuse prevention). Logs include request timestamps, HTTP status codes, and your access code; they do not include transcript or rec text.
We do not retain patient phone numbers. Our text-messaging provider keeps delivery records and the STOP opt-out list described above.
7. Children
DropRecs is for use by licensed clinicians and their adult patients. It is not directed at children under 13 and we do not knowingly collect data from them.
8. Your rights
Because your DropRecs content lives on your device, you can delete all of it any time by uninstalling the app or clearing your browser's local storage.
You may contact us about any data we hold at the address below.
9. Changes
We may update this Privacy Policy as the product evolves. Material changes will be announced inside the app; the "Last updated" date above will also be bumped.
10. Contact
Questions or concerns: privacy@droprecs.app
DropCharge LLC · New York, USA