Privacy Policy

Effective Date: September 1, 2026

PaperFree Case Sheet and its OdioPapeleo mobile app (together, the "Service") are business operations software operated by Empire Extremity ("we," "our," or "us") and licensed exclusively to verified medical-device distributor organizations. The distributor organization is the customer and controls its workspace. This Privacy Policy describes how we collect, use, and protect information about its authorized employees and contractors.

1. Information We Collect

We collect the following types of information to provide and improve our services:

• Account Information: Your name, email address, organization, and role when an organization administrator provisions or invites you.
• Order Data: Surgical supply order details, inventory records, scheduling information, and commission data that you enter into the App.
• Camera and Photos: The App requests camera access to allow you to photograph surgical setup trays and equipment for order documentation. Photos are uploaded to our secure servers and associated with the relevant order records. Camera access is only used when you explicitly choose to take or attach a photo.
• Device Information: Basic device identifiers and platform information necessary for the App to function properly.

2. How We Use Your Information

• To provide and maintain the order management service
• To authenticate your identity and manage your account
• To store and display your order records, inventory, and commission data
• To generate PDF reports and documentation for your orders
• To enable photo documentation of surgical setups
• To send notifications related to your orders and schedules

The Service does not offer public or in-app registration. Your distributor organization manages workspace membership and may access, correct, retain, or delete business records in accordance with its policies and legal obligations.

3. Data Storage and Security

Your data is stored on secure servers with industry-standard encryption. We use HTTPS for all data transmission between the App and our servers. Access to your data is restricted to authorized personnel only.

Photos taken through the App are stored securely in cloud storage and are only accessible to authorized users associated with the relevant order.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following circumstances:

• With other authorized users within your organization as required for order management workflows
• When required by law, regulation, or legal process
• To protect the rights, safety, or property of our users or the public

5. Google User Data and Google API Services

OdioPapeleo offers an optional Google Calendar integration so that scheduled surgical cases can appear on your Google Calendar and stay in sync with your team. This section describes how the App accesses, uses, stores, and shares data obtained through Google API Services.

Google Calendar permissions we request and why. When you choose to connect your Google account, we request access to the Google Calendar scope that allows the App to view, create, and update calendar events (https://www.googleapis.com/auth/calendar.events). We use this access solely to create and update calendar events that correspond to scheduled surgical cases, so that you and your team can see upcoming cases, changes, and cancellations on your calendar. We do not request access to your Gmail, contacts, or any other Google service.

How we access this data. Access to Google Calendar occurs only after you explicitly authorize the connection through Google's standard OAuth consent screen. You may decline, and the rest of the App continues to work without the calendar integration.

How we use this data. We use your Google Calendar access exclusively to create, update, and remove calendar events that represent scheduled surgical cases within the App. We do not use Google user data for any other purpose.

How we store this data. To keep your calendar in sync without asking you to sign in repeatedly, we securely store the OAuth access and refresh tokens issued by Google, along with the identifiers of the calendar events the App creates. These tokens are stored encrypted on our secure servers and are used only to perform calendar operations you have initiated or that result from changes to your scheduled cases. We do not store the full contents of your Google Calendar.

How we share this data. We do not sell your Google user data, and we do not use it for advertising or to build advertising profiles. We do not transfer Google user data to third parties except as necessary to provide the calendar feature (for example, transmitting requests to Google's own APIs), to comply with applicable law, or as part of a merger or acquisition in which the successor entity is bound by this Privacy Policy.

Limited Use disclosure. OdioPapeleo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

No AI/ML model training. We do not use Google user data — including any data obtained through the Google Calendar API — to develop, train, or improve any artificial intelligence or machine learning models, whether generalized or personalized. Google user data is never provided as input to AI models, including the AI-assisted features within the App, and is never transferred to any third-party AI or machine-learning tools.

Disconnecting Google Calendar. You can disconnect Google Calendar at any time from within the App, or by revoking the App's access from your Google Account permissions page. When you disconnect, we delete the stored Google OAuth access and refresh tokens from our servers and stop making any calendar requests on your behalf. Calendar events previously created in your Google Calendar remain under your control and can be edited or deleted directly in Google Calendar.

6. Advertising

OdioPapeleo does not display advertisements and does not use advertising IDs or tracking technologies for advertising purposes.

7. Data Retention

We retain data while your organization maintains the Service or as needed for legitimate business, record-keeping, legal, and compliance purposes. Google OAuth tokens are retained only while your Google Calendar connection is active and are deleted when you disconnect. Account deletion requests may be coordinated with the organization that owns the workspace because it may control business records associated with your account.

8. Your Rights

You have the right to:

• Access and view your personal data stored in the App
• Request correction of inaccurate data
• Request deletion of your account and data
• Disconnect Google Calendar and revoke Google access at any time
• Withdraw camera permissions at any time through your device settings

9. Eligibility

The Service is for authorized personnel of verified medical-device distributor organizations. It is not offered to patients, families, consumers, clinicians acting independently, general medical professionals, independent representatives, individual app subscribers, or children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy within the App or by other appropriate means.

11. Permissions Summary

Android permissions:

• INTERNET: Required to communicate with our servers for data synchronization.
• CAMERA: Used to photograph surgical setup trays for order documentation. Only activated when you choose to take a photo.
• READ/WRITE EXTERNAL STORAGE: Used to save and access photos and generated PDF documents on your device.
• VIBRATE: Used for haptic feedback on button presses and notifications.

iOS permissions:

• Camera (NSCameraUsageDescription): Used to photograph surgical setup trays and patient ID stickers for order documentation. Only activated when you choose to take a photo.
• Photo Library (NSPhotoLibraryUsageDescription): Used to attach photos of surgical setup trays and patient ID stickers from your photo library to order records.
• Microphone (NSMicrophoneUsageDescription): Used to record voice input for hands-free order entry and field notes.
• Calendars (NSCalendarsUsageDescription): Used to create and update calendar events for scheduled surgical cases so your team stays informed.
• Location When In Use (NSLocationWhenInUseUsageDescription): Used to assist with locating surgical facilities when creating or scheduling orders.