Privacy Policy

Exit Plan LLC, doing business as Stcki ("we," "our," or "us"), operates the Stcki mobile application and website (stcki.com) (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our Service.

Stcki holds practice operations data — product, purchasing, cost, vendors, workforce and paperwork — together with patient information associated with each usage event. That patient reference is protected health information. We handle it as a business associate under a Business Associate Agreement with your practice, and we describe below exactly what we collect and how we handle it.

By using our Service, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Password credential (stored as a secure hash)
• Role within your practice (admin, manager, or staff)
• Practice name and location information

1.2 Practice Operations Data

When you use the Service, we collect and store:

• Product inventory records (product names, lot numbers, expiration dates, unit counts)
• Inventory transactions (receipts, transfers, usage, write-offs)
• End-of-day reconciliation counts and variance data
• Location and room configurations
• Provider and staff activity logs
• Team member information, roles, credentials and access records
• Purchasing records, supplier invoices, costs, rebates and reward-program data
• Vendor and manufacturer representative records
• Documents you upload, and files generated by the Service on your behalf

1.3 Protected Health Information

When your team records product usage, Stcki records patient information on usage events, including the patient’s full name and/or initials, date of birth (including year), treatment date, provider, product name, units, lot number, product expiration date, treatment room, the staff member who entered the record, and a session identifier associating product lines from the same treatment session. A treatment record may also contain information entered in a free-text note field or metadata field and is not limited to the listed fields. Patient information may be submitted only through approved workflows. This is protected health information ("PHI"). The practice remains responsible for maintaining its primary patient record.

We handle PHI as a business associate, under a Business Associate Agreement ("BAA") executed with your practice. The BAA governs our use, disclosure, safeguarding, retention and return or destruction of PHI, and controls over this Policy in the event of any conflict.

Stcki also receives room-log photographs through an approved intake workflow and uses machine-reading services to create treatment records. Room-log source photographs are deleted within 30 days after capture or receipt, and the associated extraction data is deleted within 30 days after creation. Treatment records created from them remain subject to the account-retention provisions below. VERA may process treatment information and other PHI submitted through approved workflows; VERA prompts, conversation messages, generated briefs and summaries, tool requests, tool responses, and related transient processing payloads are deleted within 30 days after creation, except that any content affirmatively saved by the practice as part of a treatment or practice record follows the retention period applicable to that record.

1.4 Device and Usage Information

We automatically collect:

• Device type, operating system, and version
• App version
• General usage patterns (features accessed, frequency of use)
• Error logs and crash reports
• When someone submits a form on stcki.com, how they arrived: the page they landed on, the referring site, and campaign tags (UTM parameters), recorded with what they submit so we can understand which of our marketing works

1.5 Feedback and Communications

When you submit feedback through the app, contact support, or communicate with us, we collect the content of those communications along with your name, email, and practice information.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Track and manage the products your practice stocks, and the purchasing, cost, vendor and workforce records associated with running it
• Generate reports, analytics, and intelligence dashboards
• Send transactional emails (password resets, team invitations, alerts)
• Send operational notifications (expiration alerts, low stock alerts, weekly digest emails)
• Improve the Service based on usage patterns and feedback
• Respond to support requests
• Ensure security and prevent unauthorized access
• Comply with legal obligations

Our use and disclosure of PHI is limited to what the Business Associate Agreement and HIPAA permit.

We may use aggregated, de-identified operational data across our user base for industry benchmarking, research, and product improvement purposes. This includes de-identified metrics such as inventory usage rates, shrinkage percentages, and product adoption patterns. De-identification is performed in accordance with 45 C.F.R. § 164.514. No personally identifiable information, practice names, patient identifiers or PHI is included in any aggregated or benchmarking dataset. Individual practice data is never shared with or identifiable by other practices or third parties.

We do not sell your personal information or PHI. We do not use your data for advertising purposes. We do not share your data with third parties for their marketing purposes.

3. How We Share Your Information

We may share your information only in the following circumstances:

Service Providers and Subprocessors: We use third-party service providers to operate the Service. Those that may handle PHI do so under a Business Associate Agreement. The current list and each provider's status is in Section 9.

Legal Requirements: We may disclose information where required by law, subpoena, court order or other legal process, or to protect our rights, safety or property. Where the disclosure concerns PHI, we will handle it in accordance with the BAA and HIPAA, including notifying your practice where permitted.

Business Transfers: If Exit Plan LLC is involved in a merger, acquisition or sale of assets, practice data may transfer as part of that transaction. Any successor will be bound by this Policy and by the Business Associate Agreement. We will notify you before your data becomes subject to a different policy.

4. Data Security

We implement administrative, physical and technical safeguards designed to protect your data:

• All data is encrypted in transit using TLS/HTTPS
• All data is encrypted at rest in our database
• Passwords are hashed and never stored in plain text
• Row Level Security (RLS) ensures that each practice can only access its own data
• Role-based access controls limit what each team member can see and do
• Access to and changes in the Service are audit logged
• Authentication is managed through secure, industry-standard protocols
• Subprocessors that may handle PHI are engaged under Business Associate Agreements

While we take reasonable precautions to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

We will notify you of any breach of unsecured PHI in accordance with the Business Associate Agreement and 45 C.F.R. § 164.410.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service.

Following termination or cancellation, the account remains available on a view-only basis for 90 calendar days. At the beginning of that period, Stcki notifies the account owner of the scheduled deletion date and the deadline for requesting an assisted export. Stcki sends a reminder no later than day 45. A request for an assisted export must be submitted no later than day 60, and Stcki will provide a timely requested export within 30 calendar days after receiving the request.

At the end of the 90-day period, Stcki deletes Customer Data from active systems after providing any timely requested assisted export, subject to protected backups, circumstances in which return or destruction is not feasible, legally required records, and the applicable BAA. Customer may self-export Customer Data throughout the 90-day period.

Stcki is not the custodian of your patient records. Your practice remains responsible for its own medical-record retention obligations, and should export any data it needs before the 90-day period ends. A request for an assisted export must be submitted by the deadline described above. You may request earlier deletion of your account and associated data by contacting support@stcki.com.

After the customer relationship ends, Stcki retains records of the applicable agreement and its acceptance for six years, Stcki’s own business and billing records concerning the customer relationship for seven years, and a limited record confirming completion of the exit and deletion process permanently. These retained records do not contain Customer Data or PHI.

6. Patient Information

Stcki records patient information on usage events, including the patient’s full name and/or initials, date of birth (including year), treatment date, provider, product name, units, lot number, product expiration date, treatment room, the staff member who entered the record, and a session identifier associating product lines from the same treatment session. A treatment record may also contain information entered in a free-text note field or metadata field and is not limited to the listed fields. Patient information may be submitted only through approved workflows. The practice remains responsible for maintaining its primary patient record.

Stcki handles PHI under a BAA with the practice. If information is entered outside the permitted paths, notify us promptly; we will investigate and address it under the BAA and applicable law.

Third-party tools connected to the Service, whether by your practice or by Stcki (for example, invoice email or Drive sources, messaging destinations, Coda, QuickBooks Online and Google Workspace), may receive PHI only if: (a) Stcki has entered into any required business associate agreement with the tool’s provider; or (b) the tool is selected and controlled by your practice, and your practice has entered into any required business associate agreement with the provider and configured the tool for lawful use with PHI. All such uses must comply with HIPAA, the applicable BAA, and other applicable law. We do not send PHI through Resend or Telegram. PHI-bearing Slack delivery is disabled unless the particular practice’s workspace and configuration have been reviewed and approved.

7. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your own personal information:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data, subject to legal retention requirements
• Portability: Request a copy of your data in a portable format
• Objection: Object to certain processing of your personal data

To exercise any of these rights, contact us at support@stcki.com. We will respond to your request within 30 calendar days.

Patient requests. Your practice is the covered entity and the custodian of the patient record. A patient exercising HIPAA rights — access, amendment, accounting of disclosures, restriction — should contact your practice directly. Where your practice asks us to act on such a request, we will do so as required by the Business Associate Agreement.

8. Children's Privacy

The Service is intended for use by healthcare professionals, practice administrators, and other authorized adult users. It is not directed to individuals under 18 as users. Stcki may process information concerning minor patients on behalf of a practice under the applicable BAA. The practice is responsible for the authority, notices, and consents required to provide that information to Stcki.

9. Third-Party Services and Customer-Controlled Integrations

The table identifies Stcki service providers and current examples of connected tools; it is not a closed list. Stcki may connect other third-party tools reasonably necessary to provide the Service, whether your practice or Stcki connects them. Stcki will not transmit PHI to a connected tool unless Stcki has entered into any required business associate agreement with the provider or the tool is selected and controlled by your practice and your practice has entered into any required business associate agreement and configured the tool for lawful use with PHI. Each PHI-capable connection must be used only as permitted by HIPAA, the applicable BAA, and other applicable law. Customer-controlled email, Drive, and Slack environments are not approved for PHI by default; each PHI-capable path must meet the applicable agreement and configuration requirements. Stcki maintains a current list of subprocessors, available at stcki.com/subprocessors (or on request); any subprocessor that receives PHI is bound by a business associate agreement before it receives PHI.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date. For material changes affecting how we handle practice data or protected health information, we will provide direct notice via email at least 30 days before the change takes effect. Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Exit Plan LLC, d/b/a Stcki

Email: support@stcki.com

Website: https://stcki.com

Austin, Texas

© 2026 Exit Plan LLC. All rights reserved.