Privacy Policy

The one thing to know first

Information we collect

Account & billing

• Your email address and display name.
• Your training context — post-graduate year (PGY), specialty, and the names of your attendings and hospital locations. These are procedure-level metadata you enter to organize your own case log; they are not patient data.
• A Stripe customer identifier and subscription status. Your card details are handled entirely by Stripe — Tomo never sees or stores them.

Usage analytics

We record privacy-preserving, count-only events (for example, that a brief was opened or a review was completed) to understand product usage. These events never contain your Notion content, patient data, or the text of anything you capture.

What we do NOT collect

• No patient identifiers of any kind — in any field, form, upload, or prompt.
• No copies of your Notion case content. Reads flow through a pass-through proxy that never logs, caches, or persists them (see Security).
• No card or bank details (handled by Stripe).

How your Notion content flows

When the app reads from your Notion workspace, the request passes through a Tomo proxy that forwards the bytes from Notion back to your browser and never logs, caches, or stores the response. A small, allow-listed set of write operations create or refresh structural and procedure-level content in your own workspace (your case-log setup, a procedure template, your settings-derived configuration). We do not read your case content on the server for any other purpose.

AI features

A closed set of optional, procedure-level workflows can send de-identified text to our AI provider (Anthropic) to help draft templates and structure your own notes. Every such call runs through an automated redaction step first, is gated behind a feature flag, and writes only a metadata-only audit record (token counts and timing) — never the prompt or response content, and never patient data.

Sub-processors

We rely on these vendors to operate Tomo:

• Supabase — authentication and our application database.
• Vercel — application hosting.
• Stripe — subscription billing and payment processing.
• Resend — transactional and opt-in email.
• PostHog — product analytics (count-only events).
• Anthropic — the AI provider for the de-identified workflows above.
• Notion — your own workspace, connected by you, where your case log lives.

Data retention

We keep your account and subscription records for as long as your account is active. Your case content is retained in your Notion, under your control — not ours. When you close your account we cancel your subscription and delete or anonymize your Tomo records; your Notion workspace and its contents remain yours.

Your choices & rights

• Access & export. Your case log already lives in your own Notion — you own it, can export it, and keep it forever, independent of Tomo.
• Deletion. You can request deletion of your Tomo account and associated records at any time (see contact below).
• Email. Every non-essential email has one-click unsubscribe, and you can manage all notification preferences in Settings.

Cookies

We use essential cookies for authentication and to remember your timezone, plus privacy-preserving analytics. We do not sell your data or use third-party advertising trackers.

Changes

We may update this policy as the product evolves. Material changes will be reflected by the “last updated” date above.

Contact

Questions about privacy or a data request? Email rserbin15@gmail.com.