Operandi

In early testing on iPhone

Privacy policy

Last updated

This policy explains what Operandi keeps about you, why, who handles it and for how long. In short: we keep your email address, what you log and whatever you add to your profile, and use them to run Operandi. There is no advertising or tracking, there are usage statistics you can turn off, and no other account can see your notes or your profile.

Who is responsible

Meffecta AB, organisation number 556916-8106, Melodislingan 46, 115 51 Stockholm, Sweden, is the controller of the personal data described here. Write to hello@operandiapp.com with questions and requests.

What we keep

  • Your account. Your email address, when the account was created and last signed in to, when you last asked for an export of it, and when you accepted the terms of use and which version.
  • Your profile, if you fill it in. Your name, a picture of you, and the clinic you work at with its city and country. Every part is optional. The picture is stored without the details cameras write into photos, such as where and when it was taken.
  • Your logbook. What you enter. For each operation that is the procedure and the date, and whatever else you fill in: the clinic, the side, the patient’s age and sex, your role, the approach, the implant, screw and cable diameters, the drill, the technique and what you would change. Complications you add come with their kind, date and note. Operandi asks for nothing that identifies a patient, and the terms forbid entering it.
  • Signing in. The codes we email, to sign in or to confirm a new email address, are stored only as hashes (scrambled one way, so the code cannot be read back). To stop anyone flooding an inbox with codes, we also store a hash of the network address a code was asked for from, never the address itself. Your session is stored as a hash of its key.
  • Technical logs. When the app talks to our server, our hosting provider logs the request, including your IP address. We use the logs to find faults and to keep the service secure.
  • Usage statistics, unless you turn them off. They are on until you turn them off: on an iPhone with the switch on Operandi’s page in the phone’s Settings, where the app’s language is too, and on Android with the switch under Account. While they are on and you are signed in, the app reports which screens you open and which buttons you use: for example saving, editing, closing or deleting an operation or a complication, searching, sorting or refreshing your logbook, saving your profile or changing its picture, changing your email address, opening the terms, the privacy policy or the language settings, exporting your data, signing in or out and deleting your account, and when you install, update, open or close the app. For a new operation it also reports how long logging it took, how many of the fields you filled in, and which of the app’s shortcuts you used; for your profile, how many of its fields are filled in. Each report carries your account’s random identifier (never your email address), your phone’s model, system, language, time zone and screen size, and the version of the app. Your IP address reaches PostHog with it, which works out your country and city from it. Nothing you write in your logbook or your profile is ever included: no procedure, date, clinic, patient detail, note or name, and not what you search for.
  • On your phone. The app keeps its session key in the phone’s keychain, the email address you last signed in with, so the next sign-in starts filled in, and a copy of your profile picture, so it shows without being downloaded each time. It also keeps the position of the usage statistics switch, and PostHog’s code keeps a random identifier and any statistics not yet sent in the app’s own files.
  • Email you send us. If you write to hello@operandiapp.com, we keep your message and your address.

What we do not do

  • There is no advertising or tracking: nothing about you is combined with data from other companies or used for ads. The only third-party code in the app that reports on you is PostHog’s, and it sends nothing once you turn usage statistics off. The website sets no cookies and runs no scripts.
  • We do not sell your data or share it for marketing.
  • We do not look at your logbook unless you ask us to, for example to fix a fault you report, or the law requires it.
  • To provide the service you signed up for: your account, your profile, your logbook, and the emails with codes and exports. The legal basis is our agreement with you, the terms of use (article 6(1)(b) of the GDPR).
  • To know where Operandi is used: the clinic, city and country in your profile, if you give them, tell us which hospitals and countries Operandi has reached. The legal basis is our legitimate interest in developing Operandi for the people who use it (article 6(1)(f)). You can clear them in the app at any time.
  • To see how Operandi is used, and what to improve: the usage statistics, unless you turn them off. The legal basis is our legitimate interest in improving Operandi for the people who use it (article 6(1)(f)). They never include what you write, and you can object at any time by turning the switch off, which stops them at once.
  • To keep the service secure and working: the hashed network addresses, the technical logs, and the record of which terms you accepted. The legal basis is our legitimate interest in running a secure service and being able to show what was agreed (article 6(1)(f)).
  • To answer you when you write to us. The legal basis is our legitimate interest in answering (article 6(1)(f)).

Who handles it for us

  • Cloudflare, Inc. runs our server and database, stores profile pictures, sends the emails with codes and exports, and keeps the technical logs. The database is stored in Cloudflare’s data centres in western Europe, and profile pictures in the EU. Requests pass through the Cloudflare data centre nearest to you, which can be outside the EU.
  • Google runs the mailbox for hello@operandiapp.com, as part of Google Workspace.
  • PostHog, Inc. receives and stores the usage statistics in its EU cloud in Frankfurt, Germany.
  • Apple distributes the app through the App Store and TestFlight, under Apple’s own privacy policy. If you test Operandi through TestFlight, Apple shows us what it shows every developer: crash reports and any feedback you send, and your name and email address if you were invited by email.

Cloudflare, Google and PostHog are US companies. Where your data leaves the EU with them, the transfer is covered by the EU–US Data Privacy Framework and by the EU’s standard contractual clauses in their data processing terms.

How long we keep it

  • Your account, profile and logbook: until you delete the account. Deleting closes it at once. If you sign in again within 30 days, it opens again as it was; after 30 days it is deleted for good, with everything in it. An operation or complication you delete is deleted at once, and so is a profile picture you remove or replace.
  • Restore history: our database provider keeps 30 days of history for restoring the database after a fault, so whatever is deleted is gone from that history 30 days later.
  • Codes: they stop working after 10 minutes. A code is deleted once it is used, and otherwise within two days, together with the hashed network address it was asked for from.
  • Sessions: until you sign out, or after half a year.
  • Technical logs: 7 days.
  • Usage statistics: PostHog keeps them for a fixed period set by our plan with it, at most seven years, which cannot be shortened. They carry your account’s random identifier, not your name or email address. Write to us and we will have yours deleted there.
  • On your phone: the session key and the copy of your profile picture until you sign out; the last email address until you delete the account or the app; the position of the usage statistics switch until you delete the app; PostHog’s files until you delete the app.
  • Email you send us: as long as we need it to handle what you wrote about.

Your rights

You have the right to see what we keep about you, to have it corrected or deleted, to get it in a machine-readable form, and to object to or restrict how we use it. In the app you can change and delete what you have logged and your profile, and delete your account. Under Account, Export data emails you everything in the account as a zip file: your logbook as JSON and as CSV files, your profile and its picture. For anything else, write to hello@operandiapp.com; we answer within a month.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

Security

Everything between the app and our server is encrypted (HTTPS), and the database is encrypted where it is stored. Codes, session keys and network addresses are kept only as hashes. Every request is checked against your session, so no other account can reach your logbook or your picture.

Children

Operandi is for professionals, and not meant for anyone under 18.

Changes to this policy

If we change this policy, the date at the top changes with it, and we will tell you in the app or by email before a change that matters takes effect.