Privacy Policy

This Privacy Policy explains how XRAPY SARL, operating Rcovr AI ("Rcovr AI", "we", "us", "our"), collects, uses, and protects information in connection with the Rcovr AI platform. It applies to practitioners and organization members who hold an account with us ("you"), and describes how we handle information you upload about your own clients on your behalf.

1. Information we collect

Account information you provide: name, email address, and organization/practice details when you sign up.

Payment information: subscription and purchase details. Card and payment details are handled by Paddle.com, our payment processor — we do not store your full payment card details.

Session and client content you upload: audio recordings, AI-generated transcripts and analysis, clinical notes, applied scales, appointment records, and client demographic information you enter. This is content about your own clients that you provide to us for processing — see Section 3.

Technical data: IP address, browser/device information, and basic usage logs, for security and reliability purposes.

2. How we use information

• To provide the service: transcription, analysis, report generation, and record-keeping;
• To manage your account, subscription, and billing;
• To communicate with you about your account or support requests;
• To maintain the security, integrity, and reliability of the platform;
• To comply with applicable legal obligations.

3. Your clients' information

Session audio, transcripts, notes, and demographic details you upload about your clients are provided by you, for you, so that Rcovr AI can process them on your instructions. We do not independently collect information from or about your clients, and we have no direct relationship with them. As between you and Rcovr AI, you are responsible for the lawfulness of that data — including any consent needed from your client — and we act as your processor for it.

If you use Rcovr AI's organization or sharing features, other members of your organization that you (or your organization's admin) grant access to may be able to view client records, notes, or reports you've shared, according to the roles and permissions configured for your organization.

4. How we protect information

Clinical content — audio, transcripts, notes, and other client-identifying fields — is encrypted at rest. Data in transit is encrypted (HTTPS/TLS). Access to the platform requires authentication, and access to a client's records is scoped to the practitioner it belongs to (and, where enabled, the organization members you've explicitly shared it with). That said, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. How long we keep information

We retain your account information and the client data you've uploaded for as long as your account is active. If you delete a specific client record, or close your account, we delete or de-identify the associated data within a reasonable period afterward, subject to residual copies in backups, which are cycled out over time.

6. Who we share information with

We don't sell your data. We share it only with:

• Infrastructure and sub-processors that help us run the service — cloud hosting and storage, transcription and AI analysis providers, and authentication providers — bound by confidentiality and data-protection obligations;
• Paddle.com, to process payments;
• Other members of your organization, if and to the extent you've enabled sharing for a given client, note, or report;
• Authorities, where required by law or to protect the safety of any person.

Enterprise or clinic customers who need a signed Data Processing Agreement can contact team@xrapy.com.

7. Cookies

We use essential cookies/local storage needed to keep you signed in and to remember basic preferences. We don't use third-party advertising trackers.

8. Your rights

You can access, correct, export, or delete the information in your account directly from the app, or by contacting team@xrapy.com. Because client records belong to your practice, requests relating to a specific client's data should come from the practitioner or organization responsible for that client.

9. Children

Rcovr AI accounts are for professional use by adults. We do not knowingly collect account information from anyone under 18.

10. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date.

11. Contact

Questions about this policy or your data? Email team@xrapy.com.