Privacy Policy

PostOp Genius LLC

Effective: 31 October 2026 · Version 2

PostOp Genius provides a web application that presents the pre-operative and post-operative instructions your surgical practice already gives you, arranged as a day-by-day plan keyed to your surgery date.

This policy explains what we collect, why, and who else sees it. It is written to describe what the software actually does.

1. Who we are, and whose information this is

Your surgical practice is responsible for your medical care and for your medical record. We provide software to that practice. Under the Health Insurance Portability and Accountability Act ("HIPAA") we act as a business associate of your practice, which means we handle health information on their behalf and under a written agreement with them, not for our own purposes.

Your practice's own Notice of Privacy Practices governs your care record. This policy covers what happens inside our software.

2. What we collect

Your mobile phone number. You enter it to sign in. It is how we recognise you on your next visit. It is the only contact detail we hold.

The practice code you arrived on. The link or QR code your practice gave you carries a code identifying that practice. We record which code admitted you.

Your surgery date, as you enter it.

Which procedures you selected, by title, from the list your practice publishes.

Your answers to the plan's questions. Your plan may ask, for example, whether you are having anesthesia or whether you smoke, because the answer decides which instructions apply to you. We store your answer.

What you ticked off, if you used an earlier version of the app. Earlier versions let you mark instructions done. If you did, we still hold which ones and when. The app no longer collects this.

A copy of your plan. The instruction text as it stood the day your plan was created, so later edits by your practice cannot change what you were told.

Your text message choice, if you make one. Morning texts are optional and off unless you turn them on. If you do, we record when you agreed, the wording you agreed to, and your time zone, so a text meant for 8am arrives at 8am where you are. If you turn them off, we record when. If you choose "Not now" when we offer them, we record when, so that we ask at most once more.

A record of each text we send you. The day of your plan it was for, when it was sent, and whether your carrier reported it delivered.

When you open the app. The time, and nothing about what you read or type. It is how the app shows what is new since your last visit, and how we see how much the app is used.

Sign-in records. The time of each sign-in code request, alongside the phone number it was for, so that nobody can request unlimited text messages. A session identifier and its expiry.

3. What we do not collect

We want to be specific, because this is unusual:

• No name. We never ask for it and there is no field for it.
• No email address.
• No date of birth, home address, or payment details.
• No photographs.
• No location data.
• No third-party analytics. There is no analytics service, no advertising

identifier, and no third-party script of any kind on the page.

• No crash or diagnostic reporting.
• No readable sign-in codes. We never keep the six digit code texted to

you. At most we hold a scrambled copy of it for ten minutes, to check what you type.

We do not sell your information. We do not share it with advertisers. We do not use it to build a profile of you.

4. How we use it

Only to run the service:

• To sign you in and keep you signed in.
• To build your plan and show you the right instructions on the right day.
• To show what is new since your last visit, and to see how much the app is

used.

• To send you the morning texts you asked for, and only if you asked.
• To limit how many text messages can be requested for one number.
• To keep the service working, secure, and free of misuse.

We do not use your information to market anything to you.

We perform no automated analysis, profiling, or machine learning on your information. We do not use it to train artificial intelligence systems, and we do not give it to anyone else to do so.

5. Who else sees it

Your surgical practice. The plan is theirs. Today the app has no staff-facing view, so nobody at the practice can see your progress through it. If that changes we will update this policy and ask you to review it before it takes effect.

Our text messaging providers (Amazon Web Services and Twilio). To text you, we give them your phone number and the words of the message. A sign-in code is sent by either, and says nothing but the code. Morning texts, if you turned them on, are sent by Amazon Web Services under a business associate agreement with us. A morning text says your plan has something new, and may say what, such as an instruction that starts that day. It links to the app, where your whole plan is. Text messages are not encrypted: they pass through your mobile carrier, and may show on your phone's lock screen.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your text message opt-in and consent are not shared with any third party. Our text messaging providers receive your number only to deliver the messages described above.

Our hosting provider (Amazon Web Services). The application and its database run on Amazon Web Services, which stores the data on our behalf under a business associate agreement with us.

Nobody else. We have no other integrations, no data brokers, and no advertising partners.

We may disclose information if we are legally required to, for example by a court order or a lawful request from a regulator. We will not do so voluntarily.

6. What is stored on your device

Your browser stores two things for this site:

• A session token, so you stay signed in for up to 30 days from your last

visit.

• The practice code from your invitation link, so a reload does not send you

back to find the paperwork.

Neither contains anything about your health. There are no cookies and no tracking technologies. Signing out removes the session token.

7. How long we keep it

We keep your plan for 90 days after the last day it covers, and then we delete it, along with your answers, anything you ticked off, the copy of your instructions, your text message choice, the record of texts we sent, and the record of when you opened the app. For a plan that runs to four weeks after surgery, that is about four months from your operation.

If you signed in but never created a plan, we delete your phone number 90 days after you signed in.

You may ask us to delete your information sooner, by writing to the address in section 12. We will delete it unless we are required to retain it by law.

8. Security

Traffic between your browser and the service is encrypted, and traffic between the service and its database is encrypted. Your plan is reachable only through your signed-in session. Sign-in requires a code texted to your phone, and we set no password for you to lose.

No system is perfectly secure, and we do not claim ours is.

9. Your choices and rights

• See your information. Everything we hold about you is visible in the app

itself, other than internal timestamps.

• Correct it. You can change your answers and your surgery date in the app.
• Delete it. Write to us and we will delete your account and your plan.
• Stop the morning texts. Reply STOP to any of them, or turn them off in

the app's menu. Either takes effect at once. A STOP reply gets one message confirming it, and nothing after. Reply HELP for help.

• Do nothing. It is deleted on the schedule in section 7 either way.
• Stop using the service. Sign out and stop. There is nothing to cancel and

nothing to pay.

Depending on where you live you may have further rights over your personal information. Write to us and we will honour them.

10. Age

This service is intended for people aged 18 or over. We do not knowingly collect information from anyone under 18. If you believe a minor has provided information to us, write to us and we will delete it.

11. Changes

If we change this policy we will publish the new version with a new effective date, and you will be asked to review it the next time you sign in. We keep a record of which version you were shown and when.

12. Contact us

PostOp Genius LLC c/o Cogency Global Inc. 406 N Main St Ste B Rolla, MO 65401-3154

support@postopgenius.com

This policy is available at `/legal/privacy` within the app, and the End User License Agreement at `/legal/terms`.