Privacy policy

Effective date: 2026-09-17. Plain language, no surprises: we load nothing that tracks you until you say yes, the public demo holds fictional patients only, and hospitals that run OrthoSuite own their data.

1. Who we are

Medveon builds hospital and clinic software, including OrthoSuite. Operator: Medveon, Karachi, Pakistan. Contact: support@medveon.com.

2. What this covers

medveon.com and os.medveon.com; the public demo at suite-demo.medveon.com; conversations with us by WhatsApp or email; and how we handle data when we host OrthoSuite for a hospital or clinic (section 7).

3. Visiting our websites

• Without your consent we load no analytics or advertising tools.
• Our host, Vercel, processes technical request data (such as IP address and browser type) to deliver and protect the sites.
• If you choose Accept, we load Google Analytics 4 to understand visits and the Meta Pixel to measure our advertising. Both set cookies or similar identifiers.
• You can change your choice any time with Cookie settings at the bottom of each page.
• These tools never run inside the demo app or customer deployments.

4. When you contact us

• We receive your name, number or email address and what you write, and use them to reply, arrange demos and follow up on your enquiry.
• WhatsApp messages are also subject to WhatsApp's own terms.
• We keep enquiry records for up to 24 months after our last contact, unless you ask us to delete them sooner.

5. The public demo

• It contains fictional patients only. Please don't enter real patient information.
• Demo accounts are shared and demo data is reset every night.
• We keep short-lived security logs (for example sign-in attempts and error reports).

6. Your choices

You can ask to access, correct or delete personal data we hold about you, or withdraw consent, by writing to support@medveon.com. We aim to reply within 30 days.

7. Data in OrthoSuite deployments

• Roles: the hospital or clinic decides what patient data is recorded and why. When we host OrthoSuite for them, we process that data on their instructions under our agreement. When a customer runs it on its own cloud or on-premise servers, we have no access unless they grant it for support.
• Where it's hosted: our managed-cloud databases run on Supabase in the AWS Asia Pacific (Mumbai, India) region, and the web app is delivered by Vercel. Organisations that must keep data in their own country or building can use their own cloud or on-premise hosting.
• Service providers (managed cloud): Supabase (database, sign-in, file storage, server functions) and Vercel (web delivery).
• Only where the customer enables the feature: an AI model provider (AI features are off by default); Cloudflare R2 or Bunny Stream (clinical video storage); browser push services (notifications); Safepay (online subscription payments in Pakistan); NCBI (literature search; no patient records are sent).
• WhatsApp: where an administrator allows WhatsApp sharing, it opens WhatsApp on the user's own device, and messages then leave under WhatsApp's terms.
• Security: row-level security on every database table; role-based permissions; encryption in transit, and at rest by the hosting platform; hashed patient-portal PINs with lockout; idle auto-lock; removal of cached patient data from the device at sign-out; an audit log of key actions.
• Retention and deletion: customers decide how long clinical records are kept. A built-in erasure function removes a patient's record and linked data, keeping only a non-identifying audit entry. System logs are cleaned automatically: client error logs are deleted after 90 days, voice-dictation transcripts are erased after 30 days, and expired or revoked patient-portal links are deleted after 30 days.
• Export: customers can export their data, including in FHIR R4 format.
• We don't sell personal data. We don't use customer patient data to train AI models.
• Incidents: if we become aware of a security incident affecting customer data we host, we notify the affected customer without undue delay.

8. Law and certifications

We design our software to support customers' legal obligations. We don't hold certifications such as ISO 27001, and we don't claim HIPAA or GDPR certification. We'll update this policy when laws that apply to us change.

9. Children

Our sites are for healthcare professionals and organisations.

10. Changes

We post changes here with a new effective date.

← Back to Medveon  ·  Terms of use →