Privacy Policy — RevCELL AI

RevCELL AI ("RevCELL", "we", "us") builds and operates marketing, sales, and operations systems for regenerative medicine clinics. This policy explains what information we collect, how we use it, and the choices you have. It covers revcell.ai and the private client dashboards we operate for our clinic partners (each a "RevCELL HQ", for example ak-hq.revcell.ai).

1. Who this policy is for

Two different groups of people interact with us, and they are treated differently:

Website visitors. Anyone browsing revcell.ai, reading the blog, or booking a strategy call.
HQ users. Staff at a partner clinic who sign in to that clinic's private dashboard. Each clinic's HQ is isolated: its users, its data, and its connected accounts are stored separately from every other clinic's, and are never combined, cross-referenced, or used to serve another client.

2. Information we collect

Information you give us

Contact details you submit through a form or booking page: name, email, phone, clinic name, and anything you type into a message field.
Account details for HQ users: name, email address, role, and a password that is stored only as a salted scrypt hash. We never store or have access to your plaintext password.

Information from accounts you connect

An HQ user with the right permissions can connect third-party accounts to their dashboard, such as Google or a CRM. We only receive data from an account after someone at your clinic explicitly connects it and grants permission, and only the categories of data described below. Connecting is always optional, and can be undone at any time.

Information collected automatically

Standard server logs (IP address, browser type, pages requested, timestamps), used for security and troubleshooting.
Analytics on the public website via Google Analytics and Dub Analytics, used to understand which pages and articles perform well. We do not run advertising or cross-site tracking cookies on the private dashboards.
A signed session cookie on the dashboards so you stay logged in. It contains an identifier and a signature, not your password.

3. Google user data

If you connect a Google account to your RevCELL HQ, we request a deliberately narrow, read-only set of permissions. We request no permission to create, edit, or delete anything in your Google account, and we request no access to Gmail, Drive files, or recording media.

Permission requested	What we read	Why
`calendar.readonly`	Event times, titles, and attendees on the connected calendar	To show your team's consultations on the dashboard's daily brief and calendar views, and to match calls to the right patient record
`meetings.space.readonly`	Google Meet conference records, participant lists, and meeting transcripts	To generate written call notes and sales coaching feedback from consultations your team held on Google Meet
`openid`, `userinfo.email`	The email address of the account being connected	To show which account is connected and to make sure it is linked to the right dashboard user

How we store it

When you connect Google, we store a refresh token so the dashboard can keep working without asking you to sign in again each day. That token is encrypted with AES-256-GCM before it is written, and is held in a private data repository dedicated to your clinic alone. Calendar events and meeting transcripts are fetched from Google when a dashboard page or a scheduled job needs them. Derived output that your team relies on, such as a written call note, is saved to your clinic's private data repository so it remains available in the dashboard.

How we share it

We do not sell Google user data, we do not use it for advertising, and we do not use it to build profiles for any purpose unrelated to the feature you connected it for. It is shared only in these situations:

AI processing. To turn a meeting transcript into a written summary or coaching feedback, the relevant text is sent to a third-party large language model provider through our AI gateway, solely to produce that output and return it to your dashboard. RevCELL does not use your data to train any model.
Infrastructure providers. Vercel (application hosting) and GitHub (private encrypted data storage) process data on our behalf as service providers.
Legal requirements. If we are legally compelled to disclose data, or must do so to investigate a security incident.

Limited Use disclosure. RevCELL AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect

You can revoke our access at any time, in either of two places:

Click Disconnect on the Google connection card inside your dashboard. This deletes the stored refresh token immediately.
Remove "RevCELL HQ" at myaccount.google.com/permissions, which revokes access from Google's side.

After you disconnect, we stop retrieving anything from Google. To also delete previously generated content such as saved call notes, email us and we will remove it.

4. How we use information

To operate, secure, and support your dashboard and the features you turn on.
To respond to inquiries and schedule calls you request.
To generate the reports, briefs, notes, and coaching output the dashboard exists to produce.
To improve our own services in aggregate, using operational metrics rather than the contents of your customer or meeting data.

We do not sell personal information, and we do not share it with third parties for their own marketing.

5. Security

All traffic is served over HTTPS.
Third-party credentials and tokens are encrypted at rest with AES-256-GCM using a key unique to each client dashboard.
Passwords are stored only as salted scrypt hashes.
Each client's data lives in its own private repository with its own access credentials, so one clinic's dashboard cannot read another's.
Dashboard access is role-based, and sessions can be revoked centrally.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you promptly.

6. Data retention

We keep information for as long as your clinic has an active engagement with us, and afterwards only as long as needed for legal, accounting, or dispute resolution purposes. On request, or within a reasonable period after an engagement ends, we delete the client's data repository and revoke its connected credentials.

7. Your choices and rights

Ask us what personal information we hold about you, and request a copy.
Ask us to correct or delete it.
Disconnect any connected third-party account at any time.
Unsubscribe from marketing email using the link in any such message.

Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA. Email us and we will honor them.

8. A note on health information

Our clinic partners operate in healthcare. Where our systems touch information that a partner treats as protected health information, we handle it under the terms of our agreement with that partner, including a Business Associate Agreement where one is required. Patients of a partner clinic should direct privacy requests to that clinic, which controls the data.

9. Children

Our services are for businesses. We do not knowingly collect information from anyone under 18.

10. Changes to this policy

If we make a material change, we will update the date at the top of this page and, where the change affects connected accounts, notify affected dashboard users.

11. Contact

Questions, requests, or concerns: brock@revcell.ai
RevCELL AI · 7901 4th St N, STE 300, St. Petersburg, FL 33702