Where your data lives
In short. Patient names, MRNs, ages, sexes, earnings and photos are scrambled on your phone, with a key only your backup password opens, before anything is stored. We keep the scrambled copies but cannot read them. Everything else about a case is ordinary data we can read.
On this page
Anyone with full access to our servers or to the photo storage sees only unreadable bytes for the sensitive parts. If you lose your backup password and every unlocked device, we cannot recover them for you. See Your backup password.
Who can see what
| What | Your phone (readable after unlock) | Our server (scrambled + bookkeeping) | Photo storage, AWS Mumbai (scrambled files only) |
|---|---|---|---|
| Patient name | Readable | Scrambled | Not stored here |
| MRN | Readable | Scrambled | Not stored here |
| Patient age and sex | Readable | Scrambled | Not stored here |
| Your earnings figures | Readable | Scrambled | Not stored here |
| Photos and X-rays | Readable | Not stored here | Scrambled |
| Marks drawn on a photo | Readable | Scrambled | Not stored here |
| Album titles and notes | Readable | Scrambled | Not stored here |
| Teaching file: body region and note | Readable | Scrambled | Not stored here |
| Procedure, date, hospital, side, role, complications | Readable | Readable | Not stored here |
| Colleagues’ names on a case’s surgical team | Readable | Readable | Not stored here |
| Notes you typed or dictated | Readable | Readable (keep patient names out of notes; the app warns you) | Not stored here |
| Which case a photo is on, whether it filed itself, consent status | Readable | Readable (bookkeeping) | Not stored here |
| Account email, display name, specialty, recovery phone number, and gender and how you’d like to be addressed if set | Readable | Readable | Not stored here |
| Hospitals you added to your profile, and the procedure list you pick from | Readable | Readable | Not stored here |
The line is drawn around what could identify a specific patient. Your phone scrambles each sensitive value first, then sends only the scrambled bytes. A photo is scrambled on your phone and goes straight to private storage in AWS Mumbai (India). The storage holds a file it cannot open, and our server never holds the picture. The server is the master copy, and your phone keeps a readable working copy while it is unlocked. On a new phone, your backup password unlocks everything again.
Voice and the agent
When you capture a case, the text of your typed or dictated notes goes to one AI provider so the agent can fill in the procedure, side and role. Keep patient names out of your notes. Before anything is sent, your phone looks for MRNs, phone numbers and the names of patients you have logged before, and shows you what it will hide. It can miss a new patient’s name, so the check is a help, not a guarantee.
Dictation is turned into text on your phone by default, and the audio never leaves it. The optional higher-accuracy cloud mode is your choice per recording, and it is explained in Dictating well.
Your sign-in (magic-link) emails go through one email-sending service.
Exports
Logbooks for boards and credentialing are built on your phone, so the server never sees the readable result. See Exports.
Recovery
A new phone, a lost phone and blank names are covered in Using a new or lost phone.
Photos kept on this phone
Photos kept on this phone, whether for Available offline, the last 14 days or Recently viewed, are encrypted copies, the same scrambled files held in the cloud. Only your unlocked phone can open them. Clear Offline in Settings → Storage removes the downloaded ones; the cloud copy is untouched.
Anonymous usage data
So we can see where the app helps and where it trips people up, it counts a handful of anonymous actions — a screen was opened, a case-capture step was reached, an import started or finished. Each is one item from a short, fixed list of counters. That’s all that’s sent.
What goes with it is a random tag your phone makes up the first time you use the app, so we can tell “this many sessions did X” apart from “this happened X times in one session.” That tag is not your name, your email, or your account — it isn’t tied to who you are, and it can’t be traced back to you.
What is never in this data: patient names, MRNs, earnings figures, notes, anything from your vault, or any free text at all. There’s nowhere for it to go — the counters are a fixed list, so a name or number couldn’t ride along even by accident. This is our own counting, on our own servers; nothing is handed to an outside analytics company.