OcuPath Privacy Policy

Effective date: 2026-05-27
Last updated: 2026-11-01

OcuPath ("we", "the app") helps you keep your own eye-health records:
intraocular pressure (IOP) readings, prescriptions, contact-lens specs, eye
drops and dose history, symptoms, clinic visits, and scanned documents. This
policy explains what we collect, why, who we share it with, and your choices.

OcuPath is not a diagnostic tool. It shows and organizes your data and may
suggest you review something with a professional. It never diagnoses, prescribes,
or replaces medical care.

What we collect

We store records you enter or import, account identifiers, and subscription
verification metadata needed to provide the app. There is no tracking SDK,
advertising identifier, or advertising analytics on your health data.

Health & fitness data (the core of the app):

• IOP measurements (value, eye, date/time, source, optional context tags and notes)
• Prescriptions (sphere, cylinder, axis, add, PD, visual acuity, clinic)
• Contact-lens specifications (base curve, diameter, brand)
• Eye drops and dose history (taken / skipped / late)
• Symptoms (type, severity, eye, time)
• Clinic visits (clinic, doctor, date, summary, next-review date)
• Scanned documents you upload (PDF/image files, the text we read from them via
  on-device and server OCR, and the structured data extracted from them)

Identifiers:

• Your Apple account identifier (the Sign in with Apple sub claim) verifies
  your identity. Our server maps it to an internal account UUID used to sync
  your records across your devices.
• Your email address, only if you choose to share it during Sign in with Apple.
• Measurement-device identifiers, such as the instrument serial number, when
  you import readings from a connected device or service.

Local Mac diagnostics: slow-operation timings, record counts, and random
correlation identifiers are kept on your Mac, without clinical values or account
identifiers. Logs rotate within three files of at most 1 MiB each and entries
older than seven days are pruned at startup, on new log writes, and before
export. They are not uploaded automatically. You can export
them from Settings and choose whether to share them with support.

How we use it

• To store your records and sync them across your signed-in devices.
• To run reminders for your eye drops (scheduled locally on your device).
• To read and structure documents you scan (OCR + AI extraction), so the data
  lands in the right fields for you to confirm.
• To authenticate you (Sign in with Apple).

We do not sell your data, use it for advertising, or use it to train any
third party's models.

Who we share it with

Your data is processed only by the services needed to run the app:

OcuPath asks for consent before sending document text or clinical record context
to Anthropic for AI extraction, answers, or narrative summaries. You can withdraw
that consent in Settings. On-device text recognition and factual reports do not
require AI consent. The AI document-extraction request sends recognized text; it
does not send the original image or file to Anthropic. Per Anthropic's API terms,
API inputs and outputs are not used to train their models.

Optional connected services

If enabled for your account, optional iCare CLOUD import uses credentials stored
in your device's Keychain to sign in directly to iCare and retrieve readings.
Imported readings and measurement-device identifiers sync to OcuPath. iCare
operates the connected service under its own privacy policy.

Payments and subscriptions

OcuPath Pro is an auto-renewable subscription sold through Apple's In-App
Purchase. Apple handles the payment; we never see or store your payment
details. When you subscribe, the App Store sends the app a cryptographically
signed transaction, which the app forwards to our server so we can unlock your
subscription. The signed transaction includes subscription metadata such as transaction and
product identifiers, purchase and expiry information, and status. Our server
uses this information to verify access and receives Apple's subscription
notifications for changes such as renewal, expiry, refund, or revocation. Manage
or cancel your subscription in your App Store account settings.

Where it is stored

Application services and the PostgreSQL record database are hosted by Hetzner.
Uploaded scan files are stored in Cloudflare R2. A local copy of records is
cached on your device for offline use.

Retention and deletion

Deleting an individual record removes it from active records. Earlier versions
and synchronization history remain until you delete your account.
To delete your entire account and all associated data, use
Settings → Account → Delete Account in the app: this immediately and
permanently removes your account records from our database and requests removal
of your scan files from object storage. When Apple authorization is available,
we also request its revocation; external storage cleanup and Apple revocation
are best-effort operations. Account deletion cannot be undone and does not
cancel an Apple subscription. Manage or cancel that subscription in your Apple
account settings. You can also request deletion by email at the address below;
we remove the data within 30 days.

Security

• Traffic between the app and our server is encrypted in transit (HTTPS/TLS).
• The server is bound to loopback behind a TLS reverse proxy; the database is
  not exposed publicly.
• We never log raw Apple identity tokens or your email address.

HealthKit

On iOS, you can opt in to vision-prescription sync with Apple HealthKit and
control its permissions in Apple Health. IOP and other specialized eye records
remain in OcuPath because HealthKit has no IOP type. The Mac app does not access
HealthKit.

Children

OcuPath is not directed at children under 13 and we do not knowingly collect
their data.

Your rights

Depending on where you live (e.g. GDPR/EEA, UK, California), you may have rights
to access, correct, export, or delete your data, and to withdraw consent. Most
are self-serve in the app; for the rest, contact us.

Changes to this policy

We will update this page and the "Last updated" date when the policy changes.
Material changes will be surfaced in the app.

Contact

Privacy questions or deletion requests: [email protected]