Privacy
Short version: patient name, date of birth and medical record number never leave your browser. Everything else you enter is sent to the server to build the note, used only for that, and not stored. Free-text boxes are sent exactly as you type them, so do not put identifiers in them.
What stays in your browser
Three fields are removed in your browser before any network request is made, and removed again on the server as a second line of defence in case a modified client ever sent them:
- Patient name
- Date of birth
- Medical record number
They are merged into the finished note locally, on your machine, after the note comes back. That is why the note you see is complete even though the server never saw those three fields.
What is sent to the server
Everything else you enter. The note is assembled by an engine that runs on the server, so it needs the case to build from. That includes:
- Date of service, patient age, and the physician, assistant and referring-physician names you type
- Indication, Rutherford category, wound location and laterality
- Every vessel finding, device, size and measurement you record on the diagram
- Access, closure, medication, contrast and radiation entries
- Free-text boxes, exactly as you typed them — the manual note fields, complication detail, anesthesia extras and similar. Nothing inspects these for identifiers. Do not type patient names, dates of birth or record numbers into them.
What is stored, and for how long
| Where | What | How long |
|---|---|---|
| Server | Nothing from your case. The note is generated and returned; no case record, note or request body is written to disk or to a database. | Not stored |
| Server counters | Aggregate tallies only, with no link to any individual case. When a case ends, the server increments counters for: the number of cases and notes; the day; a coarse region (US state or country); place of service; access approach; which vessel segments were treated and with which modality (angioplasty, atherectomy, stent, IVL) and outcome; which vessels had IVUS; the closure device used; and which CPT codes the tool suggested. No note text, no measurements, no dates of service, no IP addresses, and no timestamp finer than the calendar day. | Indefinite, aggregate |
| Your browser | A draft of the case so an accidental reload does not lose your work. Name, DOB and MRN are stripped out of the draft. The expiry is checked when the page is opened, not on a timer. | Removed the next time you open the page after 12 hours |
Your IP address is used once, in memory, to resolve a coarse region for the usage counter, and is never written to the statistics file or to a log.
The feedback button
If you send feedback from inside the tool, the case state is attached so the problem can be reproduced. Name, date of birth and medical record number are removed first, the same three fields as everywhere else. Free-text boxes are included as written. If you would rather send nothing from the case, describe the issue without using the in-app button.
The standalone version
The single-file version that runs from a local file has no server at all. Everything is processed on your own device and nothing is transmitted.
What this is not
Changes
If what the software does changes, this page changes with it. It describes the behaviour of the version currently deployed at this address.