Privacy Notice — Endoscopy Reporter · iPad

This Privacy Notice explains how data is handled in Endoscopy Reporter for iPad ("the app"). The core principle is simple: your data and your patients' data stay on your iPad. The Developer does not receive it, does not store it in the cloud, and has no access to it.

The app is designed as a local personal/professional documentation tool for the physician. It is not designed or offered as an official clinical record, electronic health record, EHR/EMR, hospital system, PACS, or institutional medical archive system.

At a glance

• Everything is local. Data is stored on your device; it is not sent to the Internet or to the Developer.
• Encryption. The database, study photographs and stored PDFs are encrypted (AES-GCM); the key lives in the iPad's Keychain. Videos are stored with opaque names not attributable to a patient, inside the app's private container and with iPadOS file protection.
• No accounts, no servers. No registration, no remote sign-in, no synchronization, no telemetry or analytics.
• Physician's personal use. The physician user is the controller of their patients' data.
• No advertising or third-party trackers inside the app.

1. Who handles the data

All information is processed and stored locally on the user's iPad. With respect to patient data, the physician who uses the single profile is the data controller. If the app is used within a clinic, practice or institution, the user must also observe the internal and legal rules applicable to that environment. The Developer acts neither as recipient nor as processor of that data, because it never leaves the device or reaches any server.

2. What data is handled and where it is stored

The app may store locally:

• Patient identification data (name, date of birth, sex, internal identifier or record number, etc.) that you enter.
• Images and video captured during the procedure through the capture card connected to the device.
• Study text (indication, findings, conclusion, indications or recommendations) written by the physician.
• Generated reports (PDF) and their versions.
• Physician and practice profile data (name, professional license number, signature, logos) and a verifier for the password and the recovery code.

This data is stored in the app's own local store, inside the app's private container (sandbox) on the iPad, which no other app can read as long as the system is not compromised.

3. Encryption and security

Precision matters here, because not everything is protected in the same way:

Videos are stored with opaque names (UUID-type identifiers), separate from the database. These files do not contain the patient's name or data in their filename or path; an isolated file is not attributable to a patient, since the patient↔video relationship lives only inside the encrypted database. For reasons of size and performance, their content is not encrypted with AES-GCM by the app, but it is unlinked from the patient's identity and protected by the private container and iPadOS file protection.

The iPad's security measures are essential. iPadOS file protection depends on the device passcode: without it, that protection layer does not operate.

Opening the app and accessing the single physician profile are always protected by device-owner authentication using Face ID, Touch ID or the iPad passcode, depending on what iPadOS supports and has configured. The password configured inside Endoscopy Reporter is a backup password: it protects .erbackup files and is not used to open the app. The Developer receives neither the iPad authentication data nor the backup credentials and does not possess the local key required to decrypt clinical data.

The PDF report is generated each time you request it. To view, print, export or share it, a temporary copy with a readable name is created, which remains under your exclusive responsibility. Any file you export, share or save on your own outside the app's container — including those sent via AirDrop, email or messaging, or saved to Files or iCloud Drive — becomes a user file, outside the scope of the app's encryption, and its protection depends on the security of the destination.

The physical security of the device (passcode, auto-lock, biometrics, control over who uses it) is the user's responsibility and significantly reinforces data protection.

4. No cloud transmission or collection by the Developer

The app does not send patient data to the Internet, does not synchronize it automatically with any cloud, and the Developer does not collect, sell or share patient information. There is no advertising and there are no third-party trackers inside the app. The app creates no user accounts and requires no Internet connection to operate.

5. System backup

If you enable an iPad backup managed by the operating system or by an Apple service — iCloud, for example — the app's data may be included in that backup. That backup is managed by Apple under its own policies and is outside the Developer's control. It is your decision whether to enable it and to assess whether it is compatible with your legal obligations toward your patients.

6. Technical operating data

The app does not collect usage data on its own, includes no advertising, and integrates no third-party trackers. If the app is distributed through the App Store, Apple may collect aggregated and/or anonymous crash and performance data in accordance with its own policies and the user's or platform's settings. That data is not sent by the app to the Developer and does not include patient information captured in Endoscopy Reporter. In-app purchases are processed by Apple under its own privacy policies; the Developer does not receive your payment data.

7. Backups you generate

Backups are the user's responsibility. The app may generate portable backups in .erbackup files, which may include the physician's profile, signature, patients and studies and, depending on the option chosen, a copy of the media store. Backup information is encrypted with a key protected by your password and by your recovery code; large files are encrypted in blocks.

Any backup remains under your control and custody, and must be protected in accordance with applicable data protection laws. It can be restored with your password or with your recovery code; if you lose both, you will not be able to restore it and the Developer cannot recover them.

8. Patient consent, purpose and legal bases

The purpose the app exists for. The app is intended for a single purpose: documenting the patient's procedure and generating its report. The data, photographs and videos the physician captures are processed for that. Any other use — teaching, publication, conferences, dissemination, promotional material, research or any other end — is a different purpose and, under the purpose-limitation principle, requires the physician to obtain the patient's additional, specific consent for that use.

Form of consent. Health data is sensitive personal data. Mexican law in force requires, in order to process it, the data subject's express consent given in writing, and the official standard on clinical records requires written authorization to publish or disclose photographs that would allow the patient to be identified. Consent must be obtained before capture, and a record of it should be kept.

The app does not manage consent. It does not collect it, does not retain it, does not verify that it exists, and does not substitute for it. Acceptance of the Terms is given by the physician, not the patient, and has no effect as against the patient.

As the data controller, the physician must ensure they have the legal basis and the consent required by law to process their patients' information in their own local use of the app — including consent for image and video capture — and to inform their patients in accordance with the regulations applicable in their country. The app may be downloaded and used in different countries, so compliance with local law is exclusively the physician user's responsibility. This includes, depending on the jurisdiction and by way of example only: the LFPDPPP and its privacy notices in Mexico, the UK GDPR / GDPR in the United Kingdom and the European Union, HIPAA in the United States, or other applicable data protection and health laws.

9. Data subject (patient) rights

Patients may have rights over their data (in Mexico, ARCO rights: Access, Rectification, Cancellation and Objection; in the UK/EU, data subject rights under the GDPR). Since the data resides solely on the physician's device, these requests must be directed to the physician user or, where applicable, to the relevant institutional controller, who will handle them directly from the app and their device. The Developer cannot handle these requests because it does not hold the data.

10. Retention and deletion

The app may delete information automatically. Please read carefully:

• What you delete moves to a trash within the app and is kept for thirty (30) days, after which it is deleted permanently and irreversibly.
• If you enable automatic retention of recent cases — optional and disabled by default — cases falling outside the criterion you choose will move to the trash and then be deleted.
• Uninstalling the app may delete its local store and, with it, all data you have not backed up.

Reports and backups you have exported outside the app remain where you saved them until you delete them.

The app is not a long-term preservation archive. If your professional regulations require you to retain records for a given period, it is your responsibility to safeguard them outside the app.

11. Minors

The app is intended for healthcare professionals, not for minors. It may contain data of underage patients entered by the physician; processing of that data is the physician's responsibility under applicable law.

12. Changes to this Notice

The Developer may update this Notice. The version in force will be displayed within the app and, where the change is substantial, acceptance will be requested again. Continued use after a change implies awareness of the updated Notice.

13. Contact

For privacy questions relating to the app, write to: support@deltasoto.com. For requests concerning a specific patient's data, contact the physician who treated them or, where applicable, the relevant institutional controller.

Language. This Notice is offered in Spanish and English for convenience. In case of discrepancy between versions, the Spanish version shall prevail.

For browsing this website and contacting DeltaSoto, see the corporate privacy notice.

← Back to site