Privacy notice

ChartEcho does not create user accounts. The clinician who enters a chart decides what patient data is typed or spoken into the app on their own device.

Periodontal measurements, notes, and medical-history fields (including smoking status, diabetes status, and HbA1c), together with any name or medical record number, stay in the clinician's browser until the clinician exports a file, prints, or downloads a PDF. ChartEcho does not upload patient charts to the server.

An unfinished chart may remain in this browser's local storage until the clinician clears site data or replaces the draft. That copy is not a clinical archive.

• Provide periodontal charting and documentation on the clinician's device.
• Receive anonymous feedback messages the clinician chooses to send.
• Count anonymous product-usage events (for example, that a chart was started or exported).
• Carry short-lived WebRTC signaling so a phone on the same network can mirror the chart.
• Limit abusive requests using IP addresses for a short window.

Patient data is processed on the device by the clinician. The clinician is responsible for having a legal basis or the patient's consent before entering it. ChartEcho does not determine that basis.

For feedback, usage events, rate-limit records, and WebRTC signaling processed by the operator: [LEGAL BASIS — for example consent or legitimate interests, to be confirmed by the operator under the Saudi Personal Data Protection Law].

Anonymous feedback: the message text and the time it was sent. No account id is attached. When Upstash Redis is configured, feedback is stored there. Otherwise it is written to a file on the host.

Usage events: an event name (such as landing view, chart started, exam exported, or print opened), a timestamp, and a coarse platform hint (desktop or phone). These events do not include patient names, chart measurements, or file contents. When Upstash Redis is configured they are stored there. Otherwise they are written to a file on the host.

IP addresses are used as rate-limit keys for feedback, usage events, phone-mirror signaling, and the admin password check. When Upstash Redis is configured those keys are stored there; otherwise they stay in server memory. They are kept only until the rate-limit window ends (about one minute for usage events and phone-mirror requests, and about fifteen minutes for feedback and admin sign-in).

Phone-mirror signaling stores a short-lived session code and connection data so the laptop and phone can negotiate a direct WebRTC link. Chart measurements travel between those devices on the local network, not as a stored patient record.

Vercel Web Analytics may collect standard site-measurement data as configured by Vercel. It is not given the chart contents.

Server functions are hosted by Vercel in the United States. Upstash Redis, when configured, stores feedback and WebRTC signaling data. [UPSTASH REGION — to be confirmed by the operator].

Transfer of personal data outside Saudi Arabia: [CROSS-BORDER TRANSFER MECHANISM — to be confirmed by the operator, including any adequacy decision, appropriate safeguard, or other PDPL condition that applies].

Patient charts are not retained on the server. Browser drafts last until the clinician replaces them, exports and later clears site data, or the browser removes them.

Feedback is kept for 90 days and capped at the most recent 2,000 messages. Usage events are capped at the most recent 8,000 events. WebRTC signaling records expire after a short time-to-live. Rate-limit records expire at the end of their window. [ANY SHORTER OR LONGER OPERATOR RETENTION PERIOD].

The site sends security headers, checks the origin of mutating API requests, and does not keep clinician accounts. The admin usage and feedback viewer requires an `ADMIN_PASSWORD` set in the server environment, with no built-in password. Phone-mirror tokens require an `AUTH_SECRET` of at least 16 characters, with no built-in secret.

Exported files, printed pages, and PDFs leave the app under the clinician's control. The clinician is responsible for storing them securely.

Under the Saudi Personal Data Protection Law, a person may have rights to be informed, to access their personal data, to request correction or destruction, and to withdraw consent where processing is based on consent, subject to exceptions in the law and its regulations.

Because patient charts stay on the clinician's device and in the clinician's exports, requests about a chart should go to that clinic. ChartEcho does not keep a copy of the patient chart.

Complaints may be raised with the Saudi competent authority for personal data protection. [AUTHORITY NAME AND HOW TO COMPLAIN — to be confirmed by the operator].