Privacy Policy

TrackDME is operated by Willow Glen Equity LLC (“we,” “us,” or “our”). We provide cloud-based equipment tracking software for durable medical equipment (DME) providers and similar businesses. This policy explains what data we collect, how we use it, and your rights regarding that data.

Questions about this policy? Email us at legal@trackdme.com.

Account information: When you sign up, we collect your name, email address, and authentication credentials (managed through our authentication provider, WorkOS). We also collect your organization name and website.

Inventory and operational data: Equipment records, barcodes, serial numbers, product categories, location data, and check-in/check-out history that you create in the Service.

Customer (facility) records: Names, addresses, and contact information for the businesses and facilities you deliver equipment to. This is your business contact data, not individual patient information. We do not collect or store patient identifiers, diagnosis codes, or other protected health information.

Team members: Email addresses and role assignments for colleagues you invite to your workspace.

Product images: Photos you upload or that are imported from your website during catalog setup. These are stored in our cloud storage (Vercel Blob).

Usage data: Standard server logs, including IP addresses, browser type, pages visited, and actions taken within the Service. We use this to maintain and improve the platform.

• To provide, operate, and improve the Service.
• To authenticate users and manage workspace access (via WorkOS).
• To crawl your company website (at your request) to pre-populate your equipment catalog using AI.
• To send transactional communications such as account setup confirmations and security notices.
• To diagnose technical issues and improve reliability.
• To comply with legal obligations.

We do not sell your data to third parties. We do not use your inventory or customer data to train AI models.

We use the following sub-processors to deliver the Service:

• WorkOS: user authentication, organization management, and team invitations.
• Neon (AWS): PostgreSQL database hosting. Your operational data is stored in Neon’s cloud infrastructure.
• Vercel: application hosting, image/file storage (Vercel Blob), and serverless function execution.
• OpenAI / AI Gateway: used to analyze your website content (at your explicit request) during catalog setup. Page text is sent to the model to extract product categories; your data is not used to train OpenAI models under our business agreement.
• Intuit QuickBooks (optional). If you connect the integration, TrackDME reads customer and product catalog records using OAuth tokens you authorize. TrackDME does not create or change records in QuickBooks. You can disconnect this integration at any time.

Each of these providers has its own privacy policy and security practices. We select sub-processors that meet industry-standard security requirements.

TrackDME is designed to track equipment and facilities, not individual patients. We intentionally do not provide fields for patient names, dates of birth, diagnoses, insurance information, or other personal health identifiers.

You should not enter protected health information (PHI) into TrackDME. If your workflows require linking equipment to individual patients, that linkage should be managed in your existing EHR or patient management system, which is subject to your own HIPAA obligations.

TrackDME is not a HIPAA Business Associate and does not execute Business Associate Agreements (BAAs) at this time.

We retain workspace records while the business workspace is active. If a business workspace is terminated, we make its data available for export for 30 days before deleting it, subject to legal retention requirements.

A person can request deletion of their own login and personal data without automatically deleting shared equipment, rental, customer, or billing records used by the business. We review those records and remove or de-identify personal details that are no longer required. Account deletion requests are processed within 30 days, with confirmation sent to the account email.

Certain data (such as authentication logs and billing records) may be retained for longer periods as required by law.

We use industry-standard measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no system is completely secure. We encourage you to use a strong, unique password and enable multi-factor authentication.

If you discover a security vulnerability, please report it responsibly to legal@trackdme.com.

You have the right to access, correct, export, or delete your data. In the iPhone app, open Account and choose Request account deletion. This starts the request in the app and gives you a case reference. You do not need to email or call us to initiate deletion. For a full data export or questions about a request, email us at legal@trackdme.com.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we have collected and the right to request deletion. We do not sell personal information.

We use cookies and similar technologies to maintain your session and preferences. We do not use advertising or tracking cookies. You can configure your browser to refuse cookies, but doing so may prevent the Service from functioning correctly.

We may update this policy from time to time. We will notify you of material changes via email or through the Service. Continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

For privacy-related questions or requests, contact us at legal@trackdme.com.