SheldonDx Privacy Policy

The data controller for SheldonDx is ZEBRA HEALTH LTD (“SheldonDx”, “we”, “us”).

For Indian patients whose clinical records are held by a clinician using SheldonDx, the registered clinician acts as the independent data controller. SheldonDx acts as data processor on their behalf.

Clinician account data

• Full name, email address, professional role
• NHS number (UK clinicians only)
• Practice / clinic name and address
• Professional credentials and qualifications
• Verification status and method

OAuth credentials (integration tokens)

When you connect Zoom or Google Calendar, we store OAuth access and refresh tokens in an encrypted Firestore sub-collection. These are used solely to create meetings and manage your calendar. You can disconnect integrations at any time from Settings.

Google Calendar user data

Patient referral data (processed on your behalf)

• Patient name, email, date of birth, phone number
• Assessment type (ADHD / autism / combined)
• Demographic variant (standard, female phenotype, LGBTQ+, late-diagnosed)
• Age group and respondent type
• Clinical referral notes

Informant / caregiver data

Name, email, and relationship to the patient for each invited informant (parent, caregiver, teacher). This is processed only to deliver and track the informant assessment questionnaire.

LEADS marketplace profile

Session style, age group specialisations, trauma focus, LGBTQ+ affirming status, and neurodiversity experience level — collected during LEADS onboarding. This information is used to match clinicians to patients in the finder.

Live session transcripts

Verbatim speech transcribed from Zoom/Google Meet sessions via Recall.ai and Deepgram nova-3-medical. Transcripts include speaker diarization (who said what) and are tagged with session instrument (ADOS-2 or ADI-R).

Behavioral coding events

ADOS-2 item scores (0–3), shorthand notation (eye contact, joint attention, echolalia, etc.), AI-suggested codings, and clinician rationale notes. These constitute clinical health records.

Screening and assessment scores

ASRS, CAT-Q, RAADS-R, ADI-R domain totals (A, B, C, D), ADOS-2 Calibrated Severity Scores (CSS), and free-text symptom responses from the adaptive question engine.

AI-generated clinical analysis

Differential diagnosis probability weights (ASD, ADHD, social anxiety, female phenotype, trauma), clinical synthesis summaries, masking indicators, and session narrative summaries generated by the AI review system.

SheldonDx uses Recall.ai to deploy a notetaking bot into Zoom or Google Meet sessions. The bot:

• Announces itself in chat: “Session Notes is capturing this consultation for the medical record. You can ask to remove it anytime.”
• Records audio and video (speaker view or gallery view)
• Sends audio to Deepgram nova-3-medical for transcription with speaker diarization
• Returns transcript chunks to SheldonDx in real time

Clinician obligations

Before starting any session recording you must obtain explicit written consent from the patient or (for children) their caregiver/guardian. SheldonDx enforces a consent confirmation gate in the interface before the bot joins. The consentGranted flag is written to the session record when you confirm. You are responsible for retaining the signed consent form in your own clinical records.

Dictation (real-time notes)

The microphone dictation feature streams clinician speech to Deepgram (EU endpoint: api.eu.deepgram.com) for real-time transcription of clinical notes. No patient audio is sent through this path — it is a clinician-only dictation tool.

Data residency

Deepgram dictation uses the EU endpoint. Session transcripts via Recall.ai pass through Recall’s infrastructure; refer to Recall.ai’s DPA for their data residency commitments. Transcript data stored in Firebase is in asia-south1 (Mumbai).

SheldonDx uses Google Gemini (via Google Cloud) to power the automated clinical-reasoning support workflow. This is a clinical decision support tool — it does not make diagnoses. All outputs must be reviewed by the responsible clinician.

What is sent to Gemini

• Synthesised clinical evidence items (domain, criterion, evidence text, strength)
• Patient demographics (age group, assessment type)
• Prior screening scores (ASRS, CAT-Q, ADI-R totals)
• Lowercase transcript signal keywords (not verbatim transcript text)
• Session context (ADOS-2 module, CSS band, coding state)

What is NOT sent

Patient names, email addresses, phone numbers, dates of birth, and verbatim transcript text are not included in Gemini API calls.

Retention of reasoning-support outputs

Clinical reasoning-support outputs (formulations, evidence summaries, differential weights) are stored in Firestore as part of the clinical record for 8 years (adult patients) or 25 years (child patients).

Google processes data under the Google Cloud Data Processing Addendum (DPA), which includes Standard Contractual Clauses for international transfers.

The following sub-processors receive personal or clinical data as part of delivering SheldonDx services:

If you request deletion of an account whose clinical records are within the statutory retention period, we will deactivate your account and anonymise identifiers where possible, but the clinical record itself will be retained for the full statutory period. We will notify you of what is retained and why.

Under GDPR / UK GDPR (EU/UK clinicians)

• Access — request a copy of personal data we hold
• Rectification — correct inaccurate data
• Erasure — request deletion (subject to clinical retention obligations)
• Portability — receive your data in JSON or PDF format
• Restriction — pause processing while a dispute is resolved
• Object — object to processing based on legitimate interests
• Lodge a complaint — with the UK ICO at ico.org.uk

Under India DPDP Act 2023

• Access — summary of personal data processed and processing activities
• Correction & erasure — rectify inaccurate or misleading data; request erasure on withdrawal of consent
• Grievance redress — raise a complaint with our Grievance Officer (see §16)
• Nomination — nominate a person to exercise rights on death or incapacity

All rights requests: info@sheldondx.com. We respond within 30 days.

What we are doing

• Implementing HIPAA Security Rule technical safeguards (access controls, encryption, audit logs)
• Drafting BAA templates for Recall.ai, Deepgram, and Google Cloud
• Conducting a HIPAA risk analysis
• Training all staff on HIPAA Privacy Rule obligations

Timeline

Target HIPAA readiness: Q4 2026. We will update this page when certification is complete. Subscribe to our changelog at sheldondx.com/changelog for updates.

• Data encrypted in transit (TLS 1.3 minimum)
• Data encrypted at rest (AES-256 via Firebase / Google Cloud)
• Firestore security rules enforce per-clinician data access (clinicians cannot access other clinicians’ patient data)
• OAuth tokens stored in a restricted Firestore sub-collection inaccessible to client-side code
• Firebase Authentication enforces email/password with rate limiting
• API endpoints authenticated via Firebase ID tokens (server-side verification)
• Recall.ai webhook verified by signature (HMAC-SHA256)
• Razorpay webhook verified by signature (HMAC-SHA256)

In the event of a personal data breach that poses a risk to individuals:

• We will notify the relevant supervisory authority (UK ICO / India DPBOARD) within 72 hours of becoming aware
• We will notify affected clinicians without undue delay if there is a high risk to their rights or their patients’ rights
• Notification will include: nature of breach, data categories affected, likely consequences, and measures taken/proposed

To report a suspected breach: info@sheldondx.com

Subscription and per-assessment payments are processed by Razorpay. Card numbers, bank account details, and UPI IDs are handled entirely by Razorpay and never pass through or are stored on SheldonDx servers. Razorpay is PCI DSS Level 1 certified.

SheldonDx retains: order reference, payment status, amount (INR), and Razorpay transaction IDs for billing and dispute resolution purposes. Payment records are retained for 7 years.

SheldonDx uses only essential cookies required for authentication (Firebase Auth session cookie) and security (CSRF protection). We do not use advertising trackers, third-party analytics cookies, or retargeting pixels. Optional first-party journey measurement is off until you choose it. If enabled, it records broad page areas, fixed action categories, active time, broad entry source and error categories; it excludes case notes, clinical text, raw query values and screen recordings. The choice is stored for this browser origin and can be changed here or in Settings.

We will notify you of material changes to this policy by email (to your registered clinician account email) at least 30 days before changes take effect. Continued use of SheldonDx after the effective date constitutes acceptance.

Contact