Privacy Policy

retinaflow is a Chrome extension and account-management webapp that helps ophthalmologists automate chart entry inside their EMR. We are currently in closed beta. This Privacy Policy explains what we collect, how we use it, who else processes it, and your rights.

By using retinaflow you agree to this Policy. If you do not agree, do not use the service and contact us at dundysm@gmail.com so we can delete any account you may have created.

• Account information via Clerk (our identity provider): your email address, name, and any OAuth provider profile fields (Google, etc.) you choose to authenticate with.
• Usage metadata generated when you use the extension: timestamps, token counts, request durations, and the type of action performed. This lets us debug issues, enforce per-account rate limits, and surface activity history on your dashboard. We do not store the text of your dictations or the action plan by default.
• Optional dictation context for implicit learning. When you turn on "Help retinaflow learn my style" on the dashboard, retinaflow stores your last 20 dictations and the action plans they produced, and prepends the most recent few to the next parse as few-shot context. Off by default. Turn off anytime; existing entries stay until you delete the account.
• No PHI during beta. Beta access is restricted to the chart(s) you have been authorized to test against. Using retinaflow with real patient data is prohibited until paid-tier launch with a Business Associate Agreement in place. See section 7.
• No third-party analytics, no advertising cookies, no fingerprinting.

• To provide the AI-charting service you signed up for.
• To improve the parser's accuracy on ophthalmology vocabulary.
• To enforce per-account rate limits and detect abuse.
• To respond to your support requests.

We do not sell your data, share it with advertisers, or use it to train third-party AI models beyond the per-request processing described below.

retinaflow runs on a small set of well-known cloud providers. By using the service you authorize us to route your data through them as required to operate.

• Anthropic, PBC — receives the cleaned dictation text and returns the structured action plan. Dictations are processed per request and not used to train Claude when sent via the API (see Anthropic's policy below). Anthropic Privacy Policy
• Clerk, Inc. — handles authentication, password storage, OAuth, and session tokens. We never see or store your password. Clerk Privacy Policy
• Cloudflare, Inc. — hosts the backend Worker that proxies AI calls and stores the allowlist + usage log in Cloudflare D1. Cloudflare Privacy Policy
• Vercel Inc. — hosts this account-management webapp. Vercel Privacy Policy

• Account record: retained until you request deletion. Email dundysm@gmail.com and we will delete it within 7 days.
• Usage logs (endpoint, status, latency, token counts): retained for 90 days, then either purged or anonymized for parser-quality analysis.
• Dictation text: pass-through to Anthropic per request. We do not keep a long-term copy of your dictations after the API call completes. Drafts that you save locally live in chrome.storage.local on your device and never reach our servers unless you click Initiate flow.

You can:

• Access the data we hold about you — email dundysm@gmail.com.
• Correct account information by opening the avatar menu in the dashboard header (Clerk manages identity fields directly).
• Delete your account and all associated data — email dundysm@gmail.com.
• Export your usage history on request.

retinaflow is not a HIPAA-compliant business associate during the closed beta. You must not use the service with any real patient Protected Health Information (PHI). Beta access is restricted to the chart(s) you have been authorized to test against during your beta onboarding.

Business Associate Agreements (BAAs) will be available alongside a formal compliance posture (encryption at rest, audit logging, signed BAAs with Anthropic, Cloudflare, Vercel, and Clerk). We'll reach out to current beta accounts when that lands.

• All traffic is HTTPS.
• Authentication is handled by Clerk; we never see your password.
• The Anthropic API key lives only as a Cloudflare Worker secret. It is never shipped to the browser, never written to D1, and never logged.
• Session JWTs are short-lived and stored in browser session storage only.
• Beta-stage security is intentionally lighter than the eventual paid-tier posture. See section 7.

retinaflow is intended for licensed healthcare professionals aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact dundysm@gmail.com and we will delete it.

We may update this Policy as the product evolves. For material changes (new subprocessor, change in data use, retention changes), we will email all active accounts at least 14 days before the change takes effect.

Questions, deletion requests, or anything else: dundysm@gmail.com.