Home / Privacy Policy

Legal

Privacy Policy

Effective date: 23 August 2026. Operator: MedDesk Flow, offered at stubclaw.com ("MedDesk Flow," "we," "us"). Contact: hello@stubclaw.com.

This Privacy Policy explains how we collect, use, disclose, and retain information when you visit stubclaw.com, request a demo, subscribe to MedDesk Flow, purchase a one-time service, or otherwise deal with us as a business customer or website visitor. It is written for a B2B administrative software product used by doctors and clinic owners. It is not medical advice and it is not a Business Associate Agreement.

We do not sell PHI. The customer configures what data they put in the system. Card payments are processed by Stripe, Inc. We never store full card numbers.

1. Who we are and who this policy covers

MedDesk Flow is clinic operations software: appointment booking, calendar syncing, automated SMS reminders, digital intake, staff shift scheduling, a non-pharmaceutical supply ledger, optional transcription assistance, and related professional services. We sell to organizations, not to patients as consumers of care.

This policy has two audiences:

  • Website visitors and account holders (people who browse stubclaw.com, fill in a form, or hold a login to administer a clinic tenant). For this information we generally act as an independent business (a "controller" in GDPR language).
  • Individuals whose data appears inside a customer's tenant (patients, staff, and other people whose information a clinic places in MedDesk Flow). For that information we act on the customer's instructions (a "processor"). The clinic is responsible for its own notices to patients and staff. The clinic remains the covered entity when HIPAA applies.

If you are a patient of a clinic that uses MedDesk Flow, please contact that clinic about access, correction, or deletion of your clinical or scheduling information. We cannot fulfill those requests directly without the customer's authorization, except where law requires us to do so.

2. Information we collect

2.1 Account and billing data

When a clinic buys software or a service we collect business contact details (name, role, work email, phone if offered, clinic name, location count), plan selections, add-on modules, quantity, notes, and billing metadata.

2.2 Payments and Stripe

Payment card numbers are collected and processed by Stripe, Inc. Stripe is our payment processor and an independent controller of card data. We never see full card numbers and we do not store card numbers on MedDesk Flow servers. Stripe may provide us with a token, last four digits, expiry month and year, and payment status. Stripe's Privacy Policy is at https://stripe.com/privacy.

2.3 Website and communications data

If you write to hello@stubclaw.com or submit the contact or checkout form, we receive the fields you enter (name, email, clinic, product, quantity, notes, message) plus routine transmission data. FormSubmit.co may process that submission as an email relay. We keep correspondence as needed to answer you and to keep a record of what was agreed.

2.4 Clinic and patient data processed on behalf of customers

Depending on the modules a customer enables, a tenant may contain:

  • Appointment times, visit types, rooms, providers, and booking status
  • Patient demographic and contact fields the clinic chooses to store in order to book and remind
  • Digital intake form responses
  • Staff names, shifts, and coverage notes
  • Non-pharmaceutical supply counts and ledger entries (gloves, syringes, bandages, and similar)
  • If the transcription add-on is enabled: audio captures of clinic conversations and draft clinical notes produced from them
  • Audit logs of staff actions inside the product

The customer configures what data they put in the system. We do not require clinics to store diagnoses, prescriptions, or images in MedDesk Flow. The product is not an EHR of record unless the customer connects one through an agreed integration. We do not use customer patient content to train public foundation models. We do not sell patient lists. We do not sell PHI.

2.5 Cookies and analytics

The public marketing site uses cookies or local storage that are strictly useful to run the site (for example, remembering that a form was sent). We do not run a third-party advertising pixel on stubclaw.com as of the effective date. If that changes, we will update this policy and, where required, offer a choice. Embedded fonts are requested from Google Fonts. Google may see your IP address as part of serving those files. The product application, when provisioned, may use a session cookie or equivalent to keep a staff member signed in and to store display preferences.

2.6 SMS

If a clinic uses automated SMS reminders, the customer sends those messages to their patients. We and our SMS subprocessor process destination numbers, message body, delivery status, and inbound replies such as confirm or reschedule. Clinics should keep reminder copy operational (time, place, how to change the visit) and should have their own patient authorization to text.

2.7 Technical logs

Servers and security tools collect IP address, user-agent, timestamps, and coarse diagnostic data. We use this to operate, debug, and protect the service. We do not use it to build a consumer profile.

3. How we use information

We use controller-side information to:

  • Respond to demo, sales, and order inquiries
  • Create and administer customer accounts
  • Bill subscriptions and one-time services and detect failed payments or abuse
  • Provide support, training, migration, audits, and integrations the customer purchased
  • Send service notices (outages, material terms changes, security notices)
  • Improve the product using aggregated or de-identified operational metrics
  • Comply with law, enforce our Terms, and protect people and the service

We use processor-side tenant data only to provide the services the customer has selected, to prevent or address technical or security issues, and to follow documented instructions (including a Business Associate Agreement where one is in place). We do not use tenant patient content for unrelated marketing.

4. Legal bases (for visitors in the EEA, UK, or similar regimes)

Where those laws apply, we rely on: performance of a contract (to deliver software or a scoped service); legitimate interests in running a B2B site, securing systems, and answering business inquiries; consent where we actually ask for it; and legal obligation when we must keep records or respond to a lawful request. Clinics that place EU or UK personal data in the product are responsible for their own legal basis with respect to patients and staff.

5. When we share information

We share information with:

  • Service providers / subprocessors who host infrastructure, send email or SMS, process payments, relay forms, or help us provide support, under contracts that restrict their use of the data.
  • Stripe, Inc. for payment processing, as described above.
  • The customer's own users. Staff with a login see what their role permits inside the tenant.
  • Professional advisors (legal, accounting) under confidentiality.
  • Authorities when the law requires it or to protect rights, safety, and the service.
  • A buyer or successor if we sell or reorganize the business, with notice where the law expects it.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising. We do not sell PHI.

6. Subprocessors we rely on

The exact stack can change as we grow. As of the effective date, categories and typical providers include:

  • Payments: Stripe, Inc., for subscription and invoice card processing. See stripe.com/privacy.
  • Website forms: FormSubmit or a comparable form-to-email relay for hello@stubclaw.com.
  • Email: a business email host for correspondence with customers.
  • SMS: a transactional SMS gateway for reminder delivery and inbound keywords.
  • Hosting / storage: cloud infrastructure in the United States unless a written order says otherwise.
  • Transcription (optional module): a speech-to-text and drafting vendor bound to process audio and text only to produce the note the clinician reviews.
  • Fonts / public site: Google Fonts on the marketing site.

Customers who need a current named list for a security review should email hello@stubclaw.com. We will not hide a subprocessor that can see patient content. BAAs are available on request if we process PHI on behalf of a covered entity.

7. Retention

Website inquiries and order requests are kept as long as needed to handle the request and for a reasonable business record (typically up to 24 months unless a conversation becomes a customer file). Account and billing records are kept for the life of the subscription and for the period tax and accounting rules require after it ends, often seven years for invoice data.

Tenant data is retained for the life of the customer account plus a short wind-down window after cancellation so the clinic can export what it still needs. After that window we delete or de-identify tenant content from active systems, except copies that linger in encrypted backups until those backups rotate, or records we must keep to resolve a dispute or legal hold. Clinics choose what they enter. They should not treat MedDesk Flow as their only archive.

SMS logs are kept long enough to debug delivery and abuse, then reduced to aggregates. Transcription audio, if stored, follows the tenant retention the customer configures. Default is the shorter of the customer's setting or our backup rotation.

8. Security

We use TLS in transit, encryption at rest for stored customer data, role-based access, and least-privilege production access. No method of transmission or storage is perfect. Our Security page describes posture in product language. A Business Associate Agreement, where executed, adds contractual duties around protected health information. Our optional HIPAA Compliance Server Audit is a configuration review, not a representation that your clinic is HIPAA certified or HIPAA compliant.

9. International transfers

We are oriented to customers in the United States. Data is hosted in the U.S. unless an order form says otherwise. If you access the service from another country, you understand information may be processed in the United States, which may have different data-protection rules than your home jurisdiction.

10. Your rights

Website visitors and account contacts. Subject to applicable law (including, where they apply, GDPR, UK GDPR, and U.S. state privacy laws such as the CCPA), you may request access, correction, deletion, or a copy of personal information we hold as a controller; object to or restrict certain processing; and withdraw consent where processing was based on consent. You may also appeal a denial where state law provides an appeal. We will not retaliate against an employee of a customer for exercising a privacy right.

California and similar U.S. state notices. We collect identifiers (name, email, clinic), commercial information (plans purchased), internet activity on our site (logs), and professional information (role). We collect this for the purposes in Section 3. We do not sell or share that information for targeted advertising as those terms are commonly defined. Authorized agents may submit requests as the relevant statute allows, with proof of authority.

Patients and clinic staff inside a tenant. Direct those requests to the clinic. We will assist the clinic as a processor when they instruct us in writing.

To make a controller-side request, email hello@stubclaw.com with the subject line "Privacy request." We will verify the request is about the right person before we act.

11. Children

The marketing site and the software accounts are for adult business users. B2B accounts must be opened by someone 18 or older. We do not offer MedDesk Flow as a consumer product for patients under 18. A clinic may store information about minor patients in its tenant under the clinic's own legal obligations. That is the clinic's processing, not a children's consumer service we offer.

12. Automated decisions

We do not use automated decision-making that produces legal or similarly significant effects about website visitors. Scheduling rules, reminder timing, and transcription drafts are tools the clinic configures and reviews. Transcription output is a draft for a human clinician. It does not diagnose.

13. Changes

We may update this policy. The effective date at the top will change. Material changes will be announced by email to account contacts or by a notice on stubclaw.com. Continued use of the public site after the new date means you have seen the update. Customer contracts and BAAs control if they conflict with marketing-site language.

14. Contact

Privacy and data-protection questions: hello@stubclaw.com. Hours: Monday to Friday, 9:00 to 17:00 Eastern. We do not publish a walk-in address. MedDesk Flow is offered at stubclaw.com.

If you are in the EEA or UK and believe we have not resolved a concern, you may contact your local supervisory authority. U.S. state residents may have a right to contact their attorney general.