BISHOP Orthotics App Privacy Policy

BISHOP Orthotics (“the App”) is a 3D scanning tool made by Rippetoe Health, Inc. d/b/a BISHOP for capturing limb geometry used to make custom orthotics. Three groups use it:

• Customers who ordered a brace at bishop3do.com;
• Partner offices (medical equipment suppliers and health systems) that order braces for their patients; and
• BISHOP staff.

What the App collects

Nothing is transmitted automatically. The App has no analytics, no advertising, and no tracking. Information reaches BISHOP only when you sign in or choose Send to BISHOP, as described below. BISHOP never sells this information or uses it for advertising.

Customers: Send to BISHOP (bishop3do.com orders)

If you ordered a brace at bishop3do.com, you can send your scan to BISHOP from the App. You sign in with the order number and scan code from your order email. The App then:

• receives from BISHOP your first and last name, date of birth, and which knee(s) the order is for, to label your scans (kept on the device, protected by iOS data encryption, until you sign out of the order or delete the App);
• uploads only the scans you choose to send, as 3D model files named with the scan’s label, together with your order number.

Sent scans are stored in BISHOP’s Google Workspace account (covered by a HIPAA business associate agreement) and are used only to make and fit your brace. Your scans stay in the App’s library until you delete them.

Partner offices and BISHOP staff

Partner office and BISHOP staff members sign in once with their work email address and a 6-digit code that BISHOP emails to them. Only people BISHOP has set up can sign in. Sign-in goes through bishop3do.com, which receives only the work email address and code. The App keeps the sign-in (name, work email, organization and role) in the device’s iOS Keychain for 30 days or until the person signs out.

After a scan, the signed-in person approves it and fills in an order form. The form collects:

• the patient’s first and last name and date of birth;
• the brace type, which knee(s), and one optional modification;
• the address the brace ships to (for partner offices, the office’s address);
• for orders placed by BISHOP staff only, the patient’s phone number and email address and their answers to the Lysholm knee questionnaire;
• for orders placed by BISHOP staff only, the patient’s acknowledgment of BISHOP’s Notice of Privacy Practices: their fingertip signature (or the reason they didn’t sign), its date, and whether they asked to receive the notice by email or as a paper copy BISHOP mails to them.

When the person taps Send to BISHOP, the App sends the order form and the scan directly to BISHOP’s Google Workspace account, which is covered by a HIPAA business associate agreement. This patient information is protected health information. BISHOP uses it only to make, ship and support the patient’s brace, and handles it as HIPAA requires. BISHOP’s Notice of Privacy Practices explains how BISHOP may use and share patients’ health information and the rights patients have.

On the device:

• Sent scans are removed. Once BISHOP confirms it has received a scan, the App deletes it from the device. Scans that haven’t been sent stay until they are sent or deleted.
• Unsent order forms are saved on the device, encrypted, so closing the form doesn’t lose them. They are deleted when the order is created, when the scan is deleted, or when the person signs out.
• A list of the person’s orders (order number, patient name, date of birth and knees) stays on the device so more scans can be added to an order. It is shown only when that same person is signed in, including after signing out and back in, and is removed when the App is deleted.

Partner offices are responsible for the devices their staff use (passcodes, device management, and removing the App or signing out when someone leaves) and for telling BISHOP when a staff member no longer needs access, so BISHOP can delete their account.

What stays on your device

• 3D scans captured with the device’s TrueDepth camera, including surface color images of the scanned limb.
• Scan labels: a patient first initial, the first three letters of a last name, a date of birth, and the orthotic type. They leave the device only as the file name of a scan you share or send with Send to BISHOP.

Everything the App stores is protected by iOS data encryption. Scans, labels, order lists and unsent order forms are not included in iCloud or computer backups.

Camera use

The App uses the front (TrueDepth) camera solely to capture depth and color data during a scan you start. No face recognition or identification is performed, and camera data is never used for any other purpose.

Face data

The App performs no facial recognition, facial identification, face tracking, or face matching of any kind. It does not use Face ID data, ARKit face tracking, or any biometric template, and it cannot identify a person from a scan.

The App captures the 3D surface shape and color of whatever the camera is pointed at, and it is intended for scanning limbs. If a user points the camera at a face, the resulting 3D model contains the shape and appearance of that face, in the same way a photograph would. Such a scan is handled exactly like every other scan described in this policy: it is stored on the user’s own device, encrypted at rest by iOS, and never transmitted to any third party. It reaches BISHOP only if the user deliberately sends that scan with Send to BISHOP. It is never used for identification, never used to train any model, and never used for advertising. It is retained only until the user deletes it, which they can do at any time by deleting the scan in the App’s library or by deleting the App. The App never sends face data on its own, and BISHOP never sells or shares it.

Sharing

Scans leave the device only when you explicitly share them (for example via AirDrop, the Files app, Google Drive, or email) or send them with Send to BISHOP. Where files shared another way go is governed by the service you choose and your organization’s policies, not by the App.

Deletion

Deleting a scan in the App’s library permanently removes it from the device. Deleting the App removes its scans, labels, order lists and unsent order forms; iOS may keep a staff or partner sign-in in the device Keychain until it expires.

To delete a staff or partner account, tap Delete account in the App’s Settings, which opens an email to BISHOP, or contact us below. BISHOP deletes the account within 5 business days. Orders already sent to BISHOP, including who sent them, are patient records BISHOP is required by law to keep. To ask about other information sent to BISHOP, contact us below.

Contact

Questions: eric@mybishop.net or 318-333-1331