Privacy notice

Draft, subject to review. This explains what UveitisDDx, operated by Meteorosis Labs, stores about you and why. It is written to match what the application actually does.

1. What we store

• Your account: display name, e-mail address, a salted hash of your password (never the password), role, default region, the version and time of the terms you accepted, and your last sign-in.
• Your case log (only if you save cases): age in years (90 means 90 or older), sex, region, title, tags and notes, the findings entered at each visit, the engine’s reading at that visit, your final diagnosis and its certainty, and outcomes. Visits are dated only as a day offset from the first visit. No names, record numbers or calendar dates are collected; free text is scrubbed of anything that looks like a date, phone number, e-mail address or record number, and a warning is shown before you save it.
• Your plan and payments: your plan status, trial and subscription dates, and the identifiers Paddle gives us for your customer and subscription. We do not receive or store your card or bank details; those are handled by Paddle.
• Technical records: a log of changes made by administrators to the knowledge base, and ordinary server logs needed to run and secure the service.

2. What stays on your device

• The private reference you can attach to a case (for example a hospital number) is stored only in your browser and is never sent to us or included in any export.
• The case you are working on, your language, theme and region are kept in your browser’s storage. Pro users’ offline copies (app files, knowledge base, unsent changes) are kept in your browser and removed when you sign out.
• Share links contain only finding codes, never free text.

3. Cookies

We set only two strictly necessary cookies: one that keeps you signed in and one that protects forms against forgery. We do not use advertising or analytics cookies and we do not track you across other sites. On the pricing page, Paddle’s checkout may set its own cookies while you pay.

4. Why we use it

• To provide the service you registered for (account, case log, your plan) and to keep it secure.
• To take payment and give you the plan you paid for, through Paddle.
• To send service messages: account activation, and announcements about the service and its plans. We do not sell your data and we do not send marketing from third parties.
• Pooled learning, only if you opt in, case by case: de-identified cases with a final diagnosis may be included in aggregate analysis used to improve the knowledge base. Your identity is never part of that data, and you can opt a case out again.

5. Who else handles it

• Paddle, our Merchant of Record, receives what is needed to process your purchase (name, e-mail, country, payment details) and acts under its own privacy notice for that processing.
• Our hosting provider stores the database and application, and our mail provider delivers e-mail.
• We share nothing else with third parties unless the law requires it.

6. How long we keep it

Account and case data are kept while your account exists. When you delete your account, your account and all your cases are removed; financial records that Paddle must keep are held by Paddle under its own obligations.

7. Your choices

• Export: you can export your cases as JSON or CSV from My cases, and everything we hold about you from Account → Your data.
• Delete: you can delete your account and all your cases yourself at any time under Account → Your data (you confirm with your password). If you cannot sign in, write to support@idoc.site.
• Access, correction, objection: write to us and we will respond. You can opt any case out of pooled learning yourself, at any time.

8. Children and clinical data

The service is for professionals aged 18 or over. It is not a patient record: please do not enter anything that identifies a patient.

9. Contact

Meteorosis Labs · support@idoc.site