Privacy Policy
Effective July 5, 2026
RecordFlow ("RecordFlow," "we," "us") is a service operated by S2Reason LLC that helps law firms organize medical records. This policy explains what information we collect, how we use and protect it, and how long we keep it. RecordFlow is a business tool used by law firms and their staff; we do not knowingly offer the service to consumers or collect information from anyone under 18.
Information we collect
- Account information. The email address you use to sign up, and authentication data needed to keep your account secure.
- Records you upload. The medical records (PDFs and ZIP files) you submit for processing. These may contain protected health information (PHI) about the patients whose records you handle.
- Billing information. When you purchase credits, our payment processor (Stripe) handles your card details. We receive only your email and the amount — never your card number, and never any of your uploaded records.
- Basic usage and security logs. Limited technical logs (such as sign-in events and error reports) used to operate and secure the service. We do not put patient names or record content into these logs.
How we use information
- To process the records you upload — reading, sorting, and organizing them — and to return the organized output to you.
- To operate your account, process payments, provide support, and secure the service against abuse.
- We do not sell your information, and we do not use your uploaded records to train artificial-intelligence models.
How we protect information
- Encryption. Records are encrypted in transit (TLS) and at rest using managed encryption keys.
- HIPAA safeguards. Uploaded records are processed only on cloud infrastructure operating under Business Associate Agreements (BAAs) — including our cloud hosting and the AI/OCR services used to read records. We do not send records to any service that is not covered by a BAA.
- Access controls. Your cases are isolated to your account; another customer cannot access records you upload.
How long we keep records
Uploaded records and the organized output we generate are automatically and permanently deleted 30 days after processing. Account and billing records are retained only as long as needed to operate your account and meet legal and accounting obligations.
Sharing
We share information only with the service providers that make RecordFlow work (cloud hosting, AI/OCR processing, and payment processing), each under contractual and, where PHI is involved, HIPAA obligations. We may disclose information if required by law. We do not sell or rent your information to anyone.
Your choices
You may request access to, correction of, or deletion of your account information, and you may delete cases from your account. To make a request, email support@s2reason.com.
Changes
We may update this policy as the service evolves. Material changes will be reflected by an updated effective date on this page.
Contact
S2Reason LLC · support@s2reason.com