eLab Privacy Policy
RX Orthotic eLab app · Effective date: October 23, 2026
RX Orthotic Inc ("RX Orthotic", "we", "us") makes custom foot orthotics, braces and footwear in Arcadia, California. This policy explains how we handle information in the RX Orthotic eLab iPhone app (the "App") and the services behind it. It applies to the App only. Our website and other services may have their own notices.
1. Who the App is for
The App is a business tool for podiatry, orthotic and other healthcare clinics that order custom devices from us (our "Clinic Customers") and their staff. It is not intended for use by patients or the general public. We create each clinic's login; there is no public sign-up.
Clinicians use the App to record a patient's measurements and prescription, 3D-scan the patient's feet, take photos, and send the order to our laboratory. The clinic decides what patient information to enter. The clinic is responsible for having its patients' authorization or another lawful basis to share that information with us for fabricating their devices.
2. Information the App handles
About clinic users (your account)
- Name, work email address, role, clinic name, account number and ship-to addresses.
- Sign-in records: when you signed in and the type of device. Your password is never stored in readable form.
- Messages and requests you send to the lab through the App (questions, changes, cancellations, hold releases).
About patients (entered by the clinic)
- Name; date of birth; sex; height and weight; shoe size and width.
- Prescription and clinical details needed to make the device, such as diagnosis, device type, materials, modifications and notes.
- 3D scans of the feet (and ankle, for braces), photos of the feet, and paper order forms the clinic photographs or attaches.
- Phone number, email and notes, if the clinic enters them. These stay on the clinic's iPhone and are not sent to us unless they appear on an order form the clinic sends.
Technical information
- Your device's network (IP) address, held for up to 2 days to protect sign-in and limit abuse.
- Order and request numbers, and a log of account activity (for example "order sent" or "request made"). Patient names are not kept in this log.
We do not use advertising, analytics or tracking tools in the App. We do not track you across other apps or websites, and we do not sell or rent personal or patient information.
3. How we use it
We use the information only to:
- fabricate, ship and support the devices the clinic orders, including remakes and reorders;
- let clinic users see their order history, order status and package tracking, and communicate with the lab;
- invoice the clinic and keep the business records the law requires;
- keep the App and our systems secure, for example with sign-in limits, abuse prevention and troubleshooting.
4. Where it goes
| Where | What | Why |
|---|---|---|
| The clinic's iPhone | Patient records, scans, photos and forms the clinic creates | Encrypted by iOS, kept out of iCloud and computer backups. The clinic can delete a patient or order, or remove all patient data when signing out. |
| RX Orthotic (our lab and staff) | Orders, scans, photos, forms, messages | To make and ship the device and answer the clinic |
| Zoho Books (Zoho Corporation) | Sales orders, including the patient's name as the order reference, the prescription, and attached photos and forms | Our order-management and invoicing system |
| Cloudflare | The App's server, our secure storage for 3D scans, and email delivery to our order desk | Hosting and secure transfer |
| Google Workspace | Emails the App sends to orders@rxorthotic.com about a clinic's request | Our order-desk mailbox |
| USPS / FedEx | Tracking numbers only | Showing the clinic where a package is |
These providers process information for us under contracts. Where they handle protected health information, they do so under business associate agreements. All data travels over encrypted (HTTPS) connections.
We do not share personal or patient information with anyone else, except where the law requires it (for example a valid court order), to protect someone's safety, or as part of a sale or merger of our business under a commitment to keep it protected.
5. Health information and HIPAA
When a Clinic Customer sends us patient information to fabricate a device, we handle it as protected health information. Depending on the arrangement, we do this as the clinic's business associate or as a healthcare provider in the patient's care. We use and disclose it only as described above and as HIPAA and the California Confidentiality of Medical Information Act allow. Patients with questions about their health information should first contact the clinic that treated them; we will help the clinic respond.
6. How long we keep it
- On the iPhone: until the clinic deletes it, removes data at sign-out, or deletes the App.
- Orders, scans, photos and forms: for as long as needed to make, remake or reorder the device, and as required for medical-device, tax and business records.
- Sign-in and network records: up to 2 days. Account activity log: up to 3 years.
- Clinic user accounts: until the account is closed or deleted.
7. Security
We use encryption in transit and at rest, access limited to staff who need it, sign-in limits and rate limits, and file checks on everything uploaded. Within the App, patient information is hidden from the iPhone's app switcher. No system is perfectly secure. If a breach affects patient information, we will notify the clinic, and others as the law requires.
8. Your choices and rights
- Clinic users can see and update account details through their clinic administrator or by contacting us. You can delete your account at any time in the App under Settings → Request account deletion. This signs you out, removes patient data from that iPhone, and asks us to delete your account; we confirm by email. Orders already in production and records we must keep by law are not affected.
- California residents may have rights under the CCPA/CPRA to know, correct and delete personal information, and not to be discriminated against for using these rights. Patient health information covered by HIPAA or the CMIA is handled under those laws instead.
- To make a request, contact us using the details below. We will verify your identity before acting on it.
9. Children
The App is not directed to children, and children may not use it. A clinic may send us information about a child patient to make the child's device; we treat it as health information as described above.
10. Changes
We will post any update here with a new effective date and, if the change is significant, tell clinic users in the App or by email.
11. Contact us
RX Orthotic Inc11940 Goldring Rd, Suite D, Arcadia, CA 91006
Phone: (800) 798-9612
Email: support@rxorthotic.com