Privacy Policy

Effective date: June 16, 2026 · Last updated: June 16, 2026

Who we are. OrthoCentric AI, LLC is a Maryland limited liability company that builds and operates software products for orthopaedic surgical practices. This Privacy Policy describes how OrthoCentric AI, LLC ("OrthoCentric AI," "we," "our," or "us") collects, uses, and discloses information when you visit our website or interact with our products and services, including any SMS messaging programs we operate on behalf of contracted orthopaedic surgical practices.

1. Scope

This Privacy Policy applies to information collected through:

The orthocentricai.com website ("Site");
SMS, MMS, and other text-message communications we send or receive on behalf of contracted orthopaedic surgical practices (the "SMS Program");
Email, web forms, and other direct communications you initiate with us.

This Privacy Policy does not govern personally identifiable health information ("Protected Health Information" or "PHI") that we process under a Business Associate Agreement on behalf of a covered-entity client. PHI is governed by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and by the client's own Notice of Privacy Practices. If you are a patient of one of our client practices and you have a question about how that practice uses your health information, please contact the practice directly.

2. Information we collect

2.1 Information you provide directly

Contact information: name, email address, mobile phone number, employer, and role, when you contact us through the Site or by email.
SMS Program enrollment information: when a contracted orthopaedic surgical practice enrolls a patient in the SMS Program on the patient's behalf following signed written consent, we receive the patient's mobile phone number, an internal practice patient identifier, and consent metadata (date, location of signing, and consent form version). We do not receive the patient's clinical record unless processing it is necessary to perform the service the practice has retained us to perform, and only under a Business Associate Agreement.
SMS message content: the content of any SMS message a patient sends to a phone number we operate, and the content of any SMS message we send to a patient on behalf of a contracted practice.

2.2 Information collected automatically

Site usage data: IP address, browser type and version, device type, operating system, referrer URL, pages visited, and timestamps. We use this data for security, fraud prevention, and aggregated traffic analytics.
SMS delivery metadata: message timestamps, delivery status, carrier identifier, and the mobile country and network codes associated with the recipient's number. This metadata is provided by our SMS carrier partner (Twilio) and is used to operate and audit the SMS Program.

2.3 Information we do not collect

We do not collect Social Security numbers, financial-account numbers, or payment-card information through the Site or through the SMS Program.
We do not use Site analytics tools that build cross-site behavioral profiles. We do not embed third-party advertising trackers.

3. How we use information

We use information we collect to:

Operate the SMS Program — that is, to deliver SMS messages a contracted orthopaedic surgical practice has authorized us to send to its patients, and to receive and route SMS replies from those patients back to the practice;
Maintain a defensible audit record of SMS Program activity for the contracted practice;
Respond to inquiries you initiate with us through the Site or by email;
Operate, secure, and improve the Site and our products;
Comply with legal obligations, including obligations under HIPAA when we act as a Business Associate, and obligations under the Telephone Consumer Protection Act ("TCPA") and CTIA messaging guidelines.

4. SMS Program: consent, opt-out, and message frequency

4.1 Consent

Patients are enrolled in the SMS Program only after they have provided signed written consent to receive SMS communication from their orthopaedic surgical practice via OrthoCentric AI. The signed consent is recorded in the patient's medical chart and in the practice management system before any SMS is sent. The consent form discloses:

That the patient's consent to receive SMS messages is voluntary and is not a condition of receiving medical care, surgery, post-operative follow-up, or any other service from the orthopaedic surgical practice. A patient who declines SMS consent continues to receive identical medical care through telephone, patient portal, and in-person communication. A sample of the consent form is published at orthocentricai.com/sample-consent.pdf;
The identity of the sender (the patient's orthopaedic surgical practice, via OrthoCentric AI);
The types of messages the patient will receive (appointment confirmations, post-operative check-ins, care-team callbacks, and acknowledgements of patient-initiated messages);
Approximate message frequency;
That message and data rates may apply;
Opt-out instructions (reply STOP);
Help instructions (reply HELP).

4.2 Opt-out

You can opt out of the SMS Program at any time by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT to any SMS message we send. You will receive a confirmation message and no further SMS messages from the SMS Program. You may also opt out by contacting your orthopaedic surgical practice directly and asking to be removed from SMS communication.

4.3 Help

For help with the SMS Program, reply HELP or INFO to any message. For medical emergencies, call 911. For non-urgent clinical questions, contact your orthopaedic surgical practice.

4.4 Message frequency and rates

Message frequency varies and is driven by the patient's post-operative care plan, the patient's own messages, and the contracted practice's configuration. Message and data rates may apply; consult your mobile carrier for details.

4.5 SMS data is not shared for marketing or third-party purposes

We do not share mobile phone numbers, SMS message content, or SMS consent records with third parties for marketing purposes. We do not sell mobile phone numbers. We do not share mobile phone numbers with affiliates for their own marketing purposes. SMS Program data is shared only with (a) the contracted orthopaedic surgical practice that enrolled the patient, (b) the SMS carrier partner (Twilio) as necessary to deliver messages, and (c) law enforcement, courts, or regulators when legally required, as described in Section 5.

5. How we share information

We share information only as described below:

With the contracted orthopaedic surgical practice that enrolled the patient. Patient SMS metadata, message content, and routing decisions are visible to and owned by the practice on whose behalf we operate the SMS Program. Each contracted practice acts as the data controller for its own patients; OrthoCentric AI acts as a data processor and, where applicable, a HIPAA Business Associate.
With service providers. We share information with infrastructure and tooling vendors who process information on our behalf and are bound by contractual confidentiality obligations. These include our SMS carrier (Twilio), our application hosting and database provider (Supabase), our website hosting provider (Netlify), and the model vendor we use for clinical-rule application (Anthropic). We do not authorize these vendors to use patient information for their own purposes.
For legal compliance. We may disclose information when legally required by subpoena, court order, or other legal process; in response to a lawful request by a public authority; or to protect the safety, rights, or property of OrthoCentric AI, our clients, our clients' patients, or the public.
In a business transaction. If OrthoCentric AI is acquired by or merged with another entity, information may be transferred as part of that transaction, subject to the terms of this Privacy Policy or a successor policy at least as protective.

6. How we store and protect information

We use commercially reasonable administrative, technical, and physical safeguards to protect information from unauthorized access, alteration, disclosure, or destruction. These include encryption in transit and at rest, role-based access controls, audit logging, and least-privilege access to production systems. No method of transmission over the Internet or method of electronic storage is completely secure; we cannot guarantee absolute security.

SMS Program data is stored in databases located in the United States. SMS delivery metadata may be processed by our SMS carrier partner (Twilio) in accordance with its own privacy practices.

7. How long we retain information

We retain SMS Program data, including message content and delivery metadata, for the duration of our service agreement with the contracted orthopaedic surgical practice plus a defensible retention window required by applicable law (typically seven years from the date of last message, consistent with general medical-records retention practice in Maryland). We retain Site contact-form submissions for two years from the date of last interaction. Aggregated, de-identified Site usage data may be retained indefinitely.

8. Your rights

Depending on your jurisdiction, you may have rights with respect to the information we hold about you, including the right to request access to, correction of, or deletion of your information, and the right to object to or restrict certain processing.

If you are a patient of a contracted orthopaedic surgical practice and you want to exercise these rights with respect to your medical record or your SMS Program enrollment, please contact the practice directly. The practice is the data controller for that information.
If you are a visitor to the Site and you want to exercise these rights with respect to information you have provided directly to OrthoCentric AI, contact us at contact@orthocentricai.com.

9. Children

The Site is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the Site. If you believe a child under 13 has provided personal information through the Site, contact us and we will delete it. When the SMS Program is used by a contracted orthopaedic surgical practice to communicate with a minor patient, consent is obtained from the minor's parent or legal guardian on the minor's behalf in accordance with the practice's policies and applicable law.

10. International users

OrthoCentric AI operates the Site and the SMS Program from the United States. The SMS Program is offered only to patients of contracted United States orthopaedic surgical practices and uses United States telephone numbers. If you access the Site from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was most recently revised. Material changes will be communicated by posting a notice on the Site and, where required by law, by other means. Continued use of the Site or the SMS Program after a revision constitutes acceptance of the revised Privacy Policy.

12. Contact

For questions about this Privacy Policy or our privacy practices, contact:

OrthoCentric AI, LLC
8906 Mackall Court
Frederick, MD 21704
contact@orthocentricai.com