Privacy policy

Every calculation, result, timeline and PDF is made on your device and never sent to us. In the Android app it is app storage (Settings › Apps › ARDS Workup › Storage), never backed up; on the website it is this site's browser storage.

• The run in progress is stored encrypted (AES-256-GCM) under a key the device never lets out, so it survives the app closing. Where that key cannot be kept, nothing is stored. A reset or closed outcome clears it.
• Handoff and analysis PDFs are opened or downloaded on the device. In the Android app you choose where each one goes; copies left in the app are removed after a day.
• Display choices, the signed terms version, The Math unlock and your quiz scorecard are remembered on this device only.

Saved runs live in one data file sealed with AES-256-GCM under a key made from a six-character PIN you choose (PBKDF2-SHA-256, 600,000 rounds). The PIN is never stored, so nobody, including us, can open the file without it.

• Local keeps the sealed file on this device. Clearing storage or uninstalling deletes it.
• Cloud saves it through your device's own file dialog or share sheet into your own drive. We never sign in to your cloud or receive the file.
• Five wrong PINs pause entry for 30 seconds. A forgotten PIN cannot be recovered: a local file can only be erased.

The PIN guards non-PHI numbers from a casual look, not from a determined attacker, which is one more reason PHI must never go in.

No workup value, result, report or saved run reaches our servers. Only these do:

• Usage. Anonymous counts: time on screen, features opened, Save Load Engine actions, whether the app is installed, and your region (city, state, country). Never what you typed or saved. Deleted after 7 days, after being added into daily totals that name no visitor.
• Security and errors. A short note per suspicious request or crash (kind, region, device type), kept 7 days. Your IP address is never written down; it is only turned into a one-way code to count visitors and slow floods. Our host, Netlify, keeps its own short-lived logs.
• Feedback. Your name, contact, comments and grades are e-mailed to the developer through our host's form service, which also keeps a copy in the site's private form inbox until the developer deletes it. Comments that look like patient details are refused.
• DVS access requests. If you tick "Request access to ARDS DVS", your name, the e-mail your access is tied to and your note are stored here until the developer approves, denies or ignores the request, then deleted after 30 days.
• Terms signature. Your name, e-mail, the time and your region go into a signed PDF, confirmed by a passkey or a one-time authenticator code after a short picture puzzle. The PDF goes straight to the developer and no copy is kept. The puzzle and authenticator key hold nothing about you and are deleted within 30 minutes. A passkey's private key never leaves your device; we keep only its public key, a random id, dates and the terms version, linked to nothing about you. Your IP address, time zone and device are shown to you while signing, then scrambled and never kept.
• APC testers list. If you join on ardsed.com, your e-mail address, when you joined and, if you used one, a passkey's public key are stored so the developer can add you to the APC testers Google group. Nothing else about you is kept. A passkey lets you check your place or leave the list, which deletes it all; otherwise ask through the Feedback Machine.
• DVS members. For approved DVS users: their e-mail, join and sign-in dates, passkey public keys, and sign-in fingerprints for up to 12 hours. Removing access deletes it all.

• Netlify hosts the site and runs its functions.
• Google Fonts supplies the typefaces.
• Android System WebView shows the Android app, with its usage reports to Google turned off. The app has no analytics, advertising or crash SDK.
• Netlify Forms and e-mail deliver feedback and DVS requests to the developer's inbox.
• Telegram delivers the signed terms PDF and the daily site report to the developer, encrypted.
• Anthropic (through Netlify's AI Gateway) re-checks the console's reference wording every two weeks. It is sent only that text, never anything about you.
• Google Groups hosts the optional beta test group and the APC testers group, under Google's terms.
• Your cloud provider, if you use one, holds your sealed file under its own terms.

• Reset or close a run to clear it from this device; delete saved runs in the Save Load Engine or your cloud.
• Clear the app's storage, uninstall it, or clear this site's browser data to remove everything it keeps.
• Ask about anything we hold, or for it to be deleted, through the Feedback Machine below.

ARDS Workup is for healthcare professionals and students, not children. If this policy changes, the effective date above changes.

Everything that leaves your device, in Google Play's categories:

• Name and e-mail address. On the signed terms PDF (required): sent to the developer, not stored. Optionally with feedback: e-mailed to the developer, with a copy in the site's private form inbox until deleted. Stored only for a DVS access request until answered, for approved DVS members until access is removed, and for the APC testers list (e-mail only) until you leave it. Never shared, except that testers are added by the developer to the APC testers Google group.
• Approximate location. Your region, from the connection, on the signed PDF and in anonymous counts. No location permission.
• App interactions. Anonymous counts kept 7 days per visitor, plus daily totals. Analytics only.
• User-generated content. Feedback, only if you send it. E-mailed to the developer, copy kept in the private form inbox until deleted.
• Crash logs. Stripped of secrets and typed values, kept 7 days.
• Device or other IDs. No device or advertising ID is read. Declared to be safe: the one-way visitor code (7 days) and, if you make one, a passkey's public key and random id.
• Not collected: health or patient information, precise location, contacts, media, files, messages, browsing history, financial details, your IP address or any advertising ID.
• Shared: none, except that the developer adds APC testers' e-mail addresses to the APC testers Google group. Netlify, the e-mail provider and Telegram act only as service providers.
• Security. HTTPS only. The Android app asks for internet; notifications, vibration and exact alarms for DVS reminders; and NFC for DVS true handoff. None of them reads anything on your phone.

ARDS DVS is a separate clinical tool, opened only by clinicians the developer approves, with a passkey. Its intake takes the patient's name, date of birth, record number and optional encounter or FIN number.

• It stays on the device, encrypted (AES-256-GCM) under a key the device never lets out, until a closed outcome or master reset. It is never sent to anyone in a readable form.
• True handoff locks the run under a one-time key that travels only in the QR code (or NFC link). Our host holds the locked copy for at most 10 minutes, cannot open it, and deletes it when claimed; afterwards only who took part, when, and the result are kept, for 7 days.
• Saved and printed records carry the patient's identifiers and belong only on the computer's drive or institution-approved storage, under your institution's policy.
• Notifications and the Timer mode face never show patient details.
• Your institution decides how DVS is used with its patients and is responsible for the devices and storage involved.

The ARDS Pocket Calculator is the workup's calculator mode on its own, sold as a separate paid Android app; it is no longer on this website. Everything it needs ships inside the app, so it works with no connection, keeps nothing you type and sends nothing. It carries its own short privacy policy. Google Play link coming soon.

Its landing page, ardsed.com, keeps a testers list: the e-mail address you leave (and, if you add one, a passkey's public key) until you leave the list, so the developer can add you to the APC testers Google group when testing opens.