Privacy & data handling

What Plexus stores

Plexus is designed as a personal surgical logbook. You are the sole owner of the data you enter. We store:

• Your account email and profile (name, specialty, training level).
• Case entries you create: case reference, age, gender, condition, procedure, category, hospital, date, operative time, involvement, and notes.
• Progress-note text and radiology images that you upload.
• An audit trail of your own create / update / delete actions.

Operative-note photos you take at case entry are never uploaded — they are read locally by the AI helper to pre-fill fields and then discarded.

Do not enter identifiable data

The "Case ID" field is intended for a non-identifiable reference (e.g. a visit or study number) that only you can link back to a patient. Do not enter names, NRICs, addresses, or phone numbers. Redact identifiers from radiology images before uploading.

Security controls in place

• Encrypted in transit (HTTPS) and encrypted at rest by the hosting database.
• Row-level security: only your account can read or modify your cases, media, and follow-ups.
• Private storage buckets for radiology images — no public URLs.
• Password strength enforced and checked against known breached passwords.
• Audit log of case create / update / delete actions.

Your rights

From Profile → Privacy & data you can at any time:

• Export all your data (cases, follow-ups, notes) as a spreadsheet.
• Delete your account and all associated data permanently.

Not a certified medical record system

Plexus is a personal logbook tool. It is not certified for use as a hospital electronic medical record, and it has not been assessed against HIPAA, PDPA, GDPR, or any specific health-data regulation. If your institution requires clinical data to remain on approved infrastructure, do not enter that data here. Always follow your institution's data-handling policy.

Contact

For questions about your data, contact the account holder listed on your workspace.