Privacy policy

INRO is a digital clinical reference for healthcare professionals (doctors, nurses, nurse anaesthetists, emergency physicians, anaesthetists…).

Publisher and data controller: KABUTO, SASU with share capital of 1,000 euros, SIREN 109 094 649, Marseille Trade and Companies Register, registered office 55 rue Grignan, 13006 Marseille, France.

Contact: inroapp@hotmail.com
App identifier: com.inro.app

INRO is a decision support tool intended exclusively for qualified healthcare professionals. It is in no way a substitute for the clinical judgement of a qualified professional. The protocols and calculations it provides must be checked before any clinical decision or administration. The publisher accepts no liability for misuse or for use outside a professional setting.

In an emergency in France: 15 (SAMU) or 18 (fire and rescue).

On your device only:

• temporary patient parameters, cleared when the session closes
• notes, handovers and patient records
• favourite medications and browsing history
• shift planners and training progress
• display preferences (theme, language)
• profile photo
• your subscription status

Retention: for as long as the app is installed. Uninstalling deletes all of it immediately, completely and irreversibly. The publisher has no access to this content.

INRO collects none of the following:

• personal identifying data (name, e-mail address, telephone number)
• health data or patient data, on any server whatsoever
• content you type into the app, with the single exception of search terms that returned no result, described in article 5
• the names of the medications, protocols or records you look up
• a stored IP address: it is used only to work out the country on arrival, then discarded (see article 5)
• advertising, behavioural tracking, cross-app tracking

No server belonging to INRO receives your clinical data. INRO does not, in fact, own any server that stores user data.

The app sends anonymous technical data in three cases, and three only:

• when the app crashes: the error stack trace, the device model, the operating system version, the app version, and the list of screens visited before the crash;
• to measure how the app is used: the name of the screen reached or the action taken, chosen from a closed list written into the app's own code, together with the device model, the system version, the app version and the country. Some of those events carry one extra detail, also chosen from a closed list written into the code: the profession and the work setting selected during setup, a duration band for that setup, the subscription plan chosen, the type of content added to or removed from favourites, the type of notification tapped to open the app (morning question, evening card, shift reminder, end of trial), or the identifier of the INRO content opened, completed or reserved for subscribers (a medication sheet, a protocol, a score, a diagram, a quiz, a clinical case). These identifiers point to pages of INRO, the same for everyone: they say nothing about you or your patients. The free text you type yourself when your job is not in the list is never sent.
• when a search returns no result: the word typed into the search bar. This case is set out at the end of this article.

This data contains no health information about you or a patient, and cannot identify you. The only text you type that can be sent is a search term that returned no result, described below. The IP address is not kept: it is used only to work out the country, then discarded.

Each report carries an installation identifier: a random number drawn by the app on your device, used only to group reports coming from the same installation. It holds no information about you, does not follow you from one app to another, and disappears if you uninstall INRO.

Legal basis: the publisher's legitimate interest in fixing faults and improving the app (article 6.1.f GDPR).

Processors: Functional Software, Inc. (Sentry), hosted in the European Union, for crash reports; Google Ireland Limited, for Google Analytics for Firebase, which measures how the app is used.

Retention: 90 days maximum at Sentry, 2 months at Google, automatically deleted afterwards. Sentry's privacy policy: sentry.io/privacy. Google's privacy policy: policies.google.com/privacy.

Objection: you can switch this off entirely, at any time, under Settings > Privacy > Anonymous technical data. Once it is off, nothing leaves the device at all, crash reports included.

Search terms that returned no result

When a search in the app returns no result, the word you typed is sent to Google Analytics for Firebase. It is used solely to spot content that is missing from the app, so that it can be added.

What is sent: the text typed into the search bar, lowercased and stripped of its accents, together only with the name of the screen where the search was made.

What is never sent: the text of searches that return a result, text typed anywhere else in the app, personal notes, the free text of the profession field, and any patient data.

Filters applied before anything is sent: nothing is sent if the entry is shorter than three characters or longer than forty, nothing is sent if it contains only digits and punctuation, nothing is sent if it runs to more than five words. A delay is applied while you type, so that only the finished entry is sent, never the intermediate letters.

This term is not tied to any identifier that could lead back to a person. It follows the same retention period as the other usage measurements, namely two months at Google Ireland Limited.

Legal basis: legitimate interest under article 6.1.f GDPR, namely improving the content of the app.

INRO offers an optional subscription, INRO Premium (monthly or yearly). Basic use of the app stays free.

Payment. Payments are handled by Apple (App Store) or Google (Google Play) depending on your device. INRO has no access to any banking data, at any point.

Subscription management. Subscriptions are validated and tracked by RevenueCat, Inc. (revenuecat.com), our processor. RevenueCat receives and stores:

• an anonymous installation identifier generated by the app (it cannot identify you)
• if audience measurement is on, the app's Google Analytics instance identifier, to count purchases in our audience statistics
• the subscription purchase history: purchase, renewal, free trial, cancellation, refund
• the platform (iOS or Android), the app version and the device model

This information is used to check that your subscription is active, to unlock the Premium features and to count purchases in our audience statistics. It is not used for advertising, is not resold and is never linked to clinical or patient data, which does not leave your device.

RevenueCat's privacy policy: revenuecat.com/privacy

Every permission below is optional and can be refused or withdrawn without preventing you from using the app.

• Camera: profile photo and QR code scanning
• Photo library: choosing a profile photo; no photo is ever uploaded to a server
• Location: local weather only; your position is neither stored nor transmitted
• Calendar: syncing your shifts

The app does not request microphone access and records no sound.

Sensitive data is protected by the iOS Keychain and the Android Keystore, with AES-256 encryption. Your clinical content does not travel over the internet: only the anonymous technical data in article 5 and the transaction information in article 6 do, over HTTPS.

To erase everything: Settings > Erase all data.

INRO includes no advertising network, no advertising SDK, no commercial audience measurement tool, and never requests access to the IDFA (iOS) or the GAID (Android). No data is shared for cross-app or cross-site tracking, and none is resold.

Three technical processors are involved, and only those three: Sentry, for crash reports (article 5), Google, for anonymous usage measurement (article 5), and RevenueCat, for subscription validation (article 6). Google Analytics for Firebase is used for internal audience measurement only: no advertising identifier is collected, and no data is used for advertising or shared with ad networks.

Local data is stored on your device, so you keep direct control of it: Settings > Erase all data.

The technical data in article 5 is anonymous: it cannot be linked to any person, and the right to erasure takes the form of stopping the collection, which is immediate under Settings, Privacy.

For the transaction data held by RevenueCat, you have the rights of access, rectification, erasure, restriction and objection. Write to inroapp@hotmail.com: we pass the request on and reply within 30 days. You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Retention. Local data is kept until you delete it or uninstall the app. The technical data in article 5 is kept for 90 days maximum at Sentry and 2 months at Google. Transaction data is kept by RevenueCat for the life of the subscription, then for the legal retention period applicable to proof of purchase.

The app is strictly reserved for adult healthcare professionals. We knowingly collect no data from minors. Contact: inroapp@hotmail.com

The crash reports in article 5 are hosted by Sentry in the European Union and are not transferred outside the EU. Usage measurement is entrusted to Google Ireland Limited, established in the European Union; Google may process this anonymous data on servers outside the European Union, in particular in the United States, on the basis of the standard contractual clauses provided for by the GDPR.

Apple, Google and RevenueCat may process transaction data outside the European Union, in particular in the United States, in line with their own privacy policies and the contractual safeguards provided for by the GDPR (standard contractual clauses).

Clinical data, for its part, never leaves your device and is therefore never transferred.

This policy may be updated. The date at the top of the document is changed accordingly, and any significant change is flagged in the release notes.

For any question: inroapp@hotmail.com