Privacy Policy

This Privacy Policy explains how InDate Systems LLC ("InDate," "we," "us," or "our") collects, uses, and protects information in connection with the InDate inventory management platform and related services (the "Service"). It applies to the organizations that subscribe to the Service and to the individual users those organizations authorize.

InDate provides a business-to-business tool. Most of the information we handle relates to workplace accounts and supply inventory, not to consumers in their personal capacity.

1. Information We Collect

Account and contact information. When an organization signs up and when users are added, we collect information such as names, work email addresses, job roles or titles, the organization name, and the station or location a user is assigned to. We also collect authentication information used to secure accounts.

Customer Data you enter. The Service stores the supply and inventory information that you and your users enter, import, or scan, including item descriptions, quantities, locations, lot and batch numbers, expiration dates, par levels, and related activity such as who recorded a change and when.

Usage and device information. When you use the Service, we automatically collect basic technical information such as log data, IP address, browser or device type, and actions taken within the Service. We use this to operate, secure, and improve the platform.

Communications. If you contact us for support or otherwise, we keep records of that correspondence.

We do not intend for the Service to hold patient health information. See Section 8.

2. How We Use Information

We use the information we collect to:

• Provide, maintain, and operate the Service and its features;
• Authenticate users and secure accounts;
• Provide customer support and respond to requests;
• Send administrative and service-related communications, such as notifications, expiration alerts, and important notices about the Service;
• Monitor, troubleshoot, and improve the performance, reliability, and security of the Service; and
• Comply with legal obligations and enforce our Terms of Service.

We may create aggregated or de-identified information that does not identify you, your organization, or any individual, and use it to operate and improve the Service.

3. We Do Not Sell Your Data

4. Service Providers and Sub-Processors

We rely on a small number of trusted third-party providers to host and operate the Service. These providers process information only on our behalf and under obligations of confidentiality and security. They currently include:

• Supabase — database hosting, authentication, and backend infrastructure;
• Vercel — application hosting and delivery.

We may add or change sub-processors as the Service evolves and will update this Policy accordingly. Additional providers may be used for functions such as email delivery, payment processing, or error monitoring.

5. Data Security

We take reasonable technical and organizational measures designed to protect information against unauthorized access, loss, or misuse. These measures include encryption in transit, access controls, and role-based permissions within the Service. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for managing which of your users have access.

6. Data Retention

We retain account information and Customer Data for as long as your organization maintains an active subscription and as needed to provide the Service. Following termination, we make Customer Data available for export for a limited period (as described in our Terms of Service) and then delete or de-identify it in the ordinary course, subject to our backup cycles and any legal retention obligations.

7. Your Rights and Choices

Depending on your location and applicable law, you may have rights to access, correct, update, or request deletion of certain personal information we hold about you. Because much of the information in the Service is controlled by the subscribing organization, we will generally direct individual requests to the relevant organization, which acts as the controller of that data. To make a request or ask a question, contact us using the details in Section 12.

8. Protected Health Information (HIPAA)

The Service is designed for supply and inventory data, not for patient information. We ask that customers not enter Protected Health Information (PHI) into the Service unless InDate has entered into a written Business Associate Agreement (BAA) with the customer. Absent a signed BAA, InDate does not act as a HIPAA business associate, and the customer is responsible for ensuring that no PHI is introduced into the Service. If you have a need to process PHI through the Service, contact us to discuss a BAA before doing so.

9. Cookies and Similar Technologies

The Service uses cookies and similar technologies that are necessary to keep you signed in, to remember your preferences, and to keep the Service secure and functioning. We do not use advertising or cross-site tracking cookies.

10. Children's Privacy

The Service is intended for use by organizations and their authorized personnel in a professional capacity. It is not directed to children and is not intended for anyone under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by email or through the Service, and update the "Last Updated" date above. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions or requests regarding this Privacy Policy or your information, contact: