Privacy Policy

1. Introduction

This Privacy Policy explains how ClearPath Digital, Inc., operating as CaseBench ("CaseBench", "we", "us", "our") collects, uses, stores, and protects information when you use our platform and services.

We serve global users, including those in:

• United States
• Canada
• European Union & United Kingdom
• Latin America
• Asia & APAC

We are committed to protecting your privacy and handling your data responsibly.

2. Who We Are

We operate a digital platform connecting clinicians, labs, treatment planners, designers, and manufacturers for case coordination, CAD/CAM services, and related workflows.

3. What Information We Collect

We collect the following categories of information:

3.1 Account & Profile Information

• Name
• Email address
• Phone number
• Country/region
• Business name, role, and professional credentials
• Password (hashed)

3.2 Business & Operational Information

• Services offered
• Planning or manufacturing capabilities
• Software tools used
• CAD/CAM workflows
• Case volume estimates
• Billing information (if applicable)

3.3 Case & File Data

This may include:

• STL files
• Photos
• Treatment prescriptions
• Clinical notes
• Uploaded files generated by planners or labs

You must ensure patient consent is obtained before uploading identifiable data.

3.4 Usage Data

• IP address
• Device/browser information
• Platform interactions
• Log and audit data
• Error logs

3.5 Communication Data

• Messages sent within the platform
• Support tickets
• Emails exchanged with CaseBench
• Feedback and survey responses

4. How We Use Your Information

We use your information to:

4.1 Provide and improve the platform

• Facilitate matching between users
• Manage cases and enable secure file sharing
• Maintain access controls and security
• Provide customer support, including authorized support access to your account (see section 5.4)
• Improve functionality, performance, and reliability

4.2 Communications

• Updates about cases
• Platform notifications
• Operational emails
• Optional newsletters (with consent)

4.3 Compliance & Security

• Verify identity
• Prevent misuse or fraud
• Enforce platform terms
• Meet legal obligations

4.4 Analytics & Product Development

We may use anonymised and aggregated data to:

• Improve platform workflows
• Train and refine AI-assisted features
• Understand usage trends

We do NOT use personally identifiable patient information for AI training.

5. Disclosure of Information

We may share information with:

5.1 Other Users You Work With

When you submit or accept a case, relevant data may be shared with:

• Planners
• Labs
• Clinicians
• Manufacturers

5.2 Service Providers

Including:

• Supabase (database, object storage, auth)
• Cloud infrastructure providers
• Email and communication tools
• Analytics tools
• Payment processors (if applicable)

All providers are bound by data processing agreements.

5.3 Legal Requirements

We may disclose data if required by:

• Law
• Court order
• Government request

5.4 Authorized Support Access

To investigate and resolve issues you or your organization report, and to maintain the security and reliability of the platform, a small number of authorized CaseBench platform administrators may temporarily access the platform as you would see it ("support access"). During support access, an administrator can view the information available in your account, including case data and files, and can take actions within your account where needed to diagnose or fix a problem.

Support access is subject to the following safeguards:

• Only authorized CaseBench platform administrators can use it, and they are bound by confidentiality obligations.
• It is used only for support, troubleshooting, security, and platform integrity purposes, never for marketing or unrelated purposes.
• Each session is time-limited and ends automatically.
• A reason must be recorded before each session begins.
• The start and end of each session, the administrator involved, and the stated reason are recorded in our audit logs.
• Administrators access only what is necessary for the purpose of the session.

You are not currently notified each time support access takes place. You can request a record of support access to your account by contacting hello@casebench.io.

Where your account contains clinical or patient information, support access is carried out in line with our Data Processing Agreement and, where applicable, our Business Associate Agreement.

For users in the EU and UK, we rely on our legitimate interests in providing a secure, reliable and supported service, and on the performance of our contract with you or your organization, as the lawful bases for support access.

6. International Data Transfers

Because we serve global users, your data may be transferred across borders.

For EU/UK individuals:

Transfers outside the EU/UK rely on:

• Standard Contractual Clauses (SCCs)
• UK Addendum (when applicable)

For Canadian users:

We comply with PIPEDA for personal information.

For California users:

Your rights under CCPA/CPRA are included below.

For Latin America users:

We process personal data in accordance with applicable Latin American data protection laws, including Brazil's LGPD and equivalent regulations, using contractual necessity, consent, and legitimate interests as lawful bases where permitted.

7. How We Store and Protect Data

7.1 Storage Infrastructure

Data is stored using Supabase, which provides:

• PostgreSQL databases
• Object storage (built on AWS S3 or equivalent)
• SOC2, ISO27001, and GDPR-compliant infrastructure

7.2 Security Measures

• Encryption at rest and in transit
• Row-Level Security (RLS)
• Access controls and audit logs, including logging of all administrative support access
• Regular security reviews
• Principle of least privilege

7.3 Retention

We retain data only as long as necessary to:

• Provide services
• Meet legal obligations
• Resolve disputes

You may request deletion as outlined below.

8. Your Rights

Your rights depend on your location.

EU/UK GDPR Rights

• Access your data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Data portability
• Object to processing

United States (General)

You may:

• Request access
• Request deletion
• Opt out of certain disclosures

California (CCPA/CPRA)

You may:

• Request what data we collect
• Request deletion
• Opt out of sale or sharing (we do not "sell" data)

Canada (PIPEDA)

You may:

• Access your data
• Request correction
• Withdraw consent

APAC

We comply with local principles such as:

• Singapore PDPA
• Australia Privacy Act

9. Children's Data

CaseBench is not intended for minors under 18.

We do not knowingly collect data from children.

10. Data Breach Notification

If a data breach occurs:

• We will notify affected users as required by law
• We will work with Supabase and relevant authorities

11. Cookies & Tracking

We use cookies and similar technologies to enhance your experience, analyze usage, and support marketing efforts. You can manage your cookie preferences at any time using our Cookie Settings link in the footer.

Cookie Categories

Managing Cookies

• Use our Cookie Settings (in the footer) to update your preferences at any time
• Configure your browser to block or delete cookies
• Note that disabling certain cookies may affect website functionality

We respect "Do Not Track" browser signals and will not load non-essential cookies until you provide consent.

12. Changes to This Policy

We may update this Privacy Policy periodically.

Continued use of the platform constitutes acceptance of changes.

13. Contact Us