Privacy Policy

This Privacy Policy applies to ScoliBase websites, portals, mobile applications, including ScoliBase Connect, patient and guardian registration, secure workflows, support interactions, and related services that refer to this policy.

ScoliBase supports intake, care coordination, appointment workflows, uploaded documents and imaging, secure messaging, brace wear tracking, and related scoliosis care operations.

ScoliBase Connect is a mobile application that allows authorized users to track brace wear, record wear sessions, review brace wear history and progress, and access brace-tracking information associated with their ScoliBase account.

We may collect account information such as name, email address, phone number, guardian information, and login credentials.

We may collect health-related information and protected health information (PHI), including intake forms, uploaded imaging, treatment or care-coordination data, messaging data, brace tracking data, and appointment details.

When using ScoliBase Connect, information collected or processed may include account identifiers, patient or guardian associations, brace wear start and stop times, manually entered wear time, brace wear history and progress, and notes entered by the user.

We may also collect technical information such as IP address, browser or device information, session state, login activity, and error or security logs.

Usage and operational analytics may include page or screen interactions, feature usage, workflow completion patterns, and platform performance metrics where such analytics are enabled.

Information may be used for healthcare operations, care coordination, scheduling, patient and guardian communications, security monitoring, platform improvement, analytics, and legal or regulatory compliance.

Information processed through ScoliBase Connect may also be used to authenticate users, associate brace tracking information with the appropriate ScoliBase account, record brace wear activity, display brace wear history and progress, maintain application security, and troubleshoot application performance.

ScoliBase and ScoliBase Connect are designed to support reasonable administrative, technical, and physical safeguards for PHI where HIPAA applies. PHI handling may also be governed by the applicable Notice of Privacy Practices.

Information may be shared with authorized staff, providers, and guardians, with vendors supporting the service under appropriate agreements where applicable, to satisfy legal requirements, or in limited emergency and safety situations as permitted by law.

ScoliBase web services may use authentication and session cookies, security and CSRF-related cookies, preference cookies, and analytics or performance cookies where enabled.

ScoliBase Connect may use application storage, authentication tokens, device or session information, and similar technologies necessary to maintain authenticated sessions, provide application functionality, support security, and improve reliability.

Analytics or performance technologies may be used where enabled to understand application performance, diagnose errors, and improve product reliability.

Security controls may include encryption, access controls, monitoring and logging, session protections, and MFA-related safeguards where enabled. No internet-based service can guarantee absolute security or uninterrupted availability.

Depending on applicable law and workflow context, users may request access to certain information, request corrections, manage communication preferences, or request account deletion subject to retention and legal obligations. HIPAA-related rights may also apply.

Information is retained for as long as reasonably necessary for account administration, care coordination, security, compliance, audit, backup, dispute resolution, and legal obligations. Retention schedules may differ by record type.

ScoliBase and ScoliBase Connect may support guardian-managed access for minors. Guardians may be able to access or manage information associated with a child's account, subject to applicable consent, authorization, platform requirements, and law.

Marketing communications, if used, are separate from healthcare-operational or security communications. Users may opt out of marketing messages where applicable.

Privacy, security, and support questions regarding ScoliBase or ScoliBase Connect should be directed to the designated ScoliBase contact channels published by the organization.