What protects a report here
Health data is among the most sensitive data there is; Swiss law calls it «besonders schützenswert». Here is what is done about it, and where the limits are.
Anonymised before it leaves
The model needs the values, not who they belong to.
- Names, birth dates, addresses, phone numbers, e-mail, IBAN, AHV and insurance numbers, and patient and order numbers are replaced with placeholders in your browser.
- You see each replacement before sending, can switch any off and can add words of your own.
- The table of what each placeholder stands for never leaves your device.
- Detection is deliberately generous: hiding one word too many costs a little detail; one too few would send your data.
- Photos are not read in the browser, so they are sent as they are unless you cover the details first.
Kept on your device
Your reports live in this browser's storage.
- There is no account and no copy of your reports on our server.
- Clearing this site's data deletes them; export a file first if you want to keep one.
- Anyone with access to this browser profile can read them.
Nothing kept on the server
The server passes a request through and forgets it.
- The anonymised text goes to a model provider for one request; the server stores nothing and logs only which model answered.
- Requests are rate limited per caller to protect the shared free tier.
- A model provider sees the anonymised text, so read its terms. With your own key it goes to your provider instead.
A browser told to trust little
The page is served with strict headers.
- Scripts run only from this site and only with this response's nonce; requests go only to this site.
- HTTPS only for two years; no framing; no referrer leaves the site.
- No analytics and no third-party scripts.
Your key stays yours
If you connect your own model:
- The key is kept in this browser only and sent with each reading to reach your provider.
- It is never stored or logged by the server.
If something goes wrong
What each failure would expose, said plainly.
A model provider is breached
It could expose the anonymised text of readings sent to it: values and dates without your name, address or numbers, unless a photo went uncovered.
We are compromised
There is no database of reports to steal. An attacker could change the site to send data elsewhere, which is why the code is public and the headers are checked after every deploy.
Your device is lost or shared
Your reports are readable by anyone who can open this browser. Use a device lock, and delete what you no longer need.