Privacy policy

INRO is a digital clinical reference for healthcare professionals (doctors, nurses, nurse anaesthetists, emergency physicians, anaesthetists…).

Publisher and data controller: KABUTO, SASU with share capital of 1,000 euros, SIREN 109 094 649, Marseille Trade and Companies Register, registered office 55 rue Grignan, 13006 Marseille, France.

Contact: inroapp@hotmail.com
App identifier: com.inro.app

INRO is a decision support tool intended exclusively for qualified healthcare professionals. It is in no way a substitute for the clinical judgement of a qualified professional. The protocols and calculations it provides must be checked before any clinical decision or administration. The publisher accepts no liability for misuse or for use outside a professional setting.

In an emergency in France: 15 (SAMU) or 18 (fire and rescue).

On your device only:

• temporary patient parameters, cleared when the session closes
• notes, handovers and patient records
• favourite medications and browsing history
• shift planners and training progress
• display preferences (theme, language)
• profile photo
• your subscription status

Retention: for as long as the app is installed. Uninstalling deletes all of it immediately, completely and irreversibly. The publisher has no access to this content.

INRO collects none of the following:

• personal identifying data (name, e-mail address, telephone number)
• health data or patient data, on any server whatsoever
• content you type into the app
• the names of the medications, protocols or records you look up
• a stored IP address: it is used only to work out the country on arrival, then discarded (see article 5)
• advertising, behavioural tracking, cross-app tracking

No server belonging to INRO receives your clinical data. INRO does not, in fact, own any server that stores user data.

The app sends anonymous technical data in two cases, and two only:

• when the app crashes: the error stack trace, the device model, the operating system version, the app version, and the list of screens visited before the crash;
• to measure how the app is used: the name of the screen reached or the action taken, chosen from a closed list written into the app's own code, together with the device model, the system version, the app version and the country. Three of those events carry one extra detail, also chosen from a closed list: the profession and the work setting selected during setup, and a duration band for that setup. The free text you type yourself when your job is not in the list is never sent.

This data contains no health information, no content you typed, no medication name you looked up, and cannot identify you. The IP address is not kept: it is used only to work out the country, then discarded.

Each report carries an installation identifier: a random number drawn by the app on your device, used only to group reports coming from the same installation. It holds no information about you, does not follow you from one app to another, and disappears if you uninstall INRO.

Legal basis: the publisher's legitimate interest in fixing faults and improving the app (article 6.1.f GDPR).

Processors: Functional Software, Inc. (Sentry), hosted in the European Union, for crash reports; Google Ireland Limited, for Google Analytics for Firebase, which measures how the app is used.

Retention: 90 days maximum at Sentry, 2 months at Google, automatically deleted afterwards. Sentry's privacy policy: sentry.io/privacy. Google's privacy policy: policies.google.com/privacy.

Objection: you can switch this off entirely, at any time, under Settings > Privacy > Anonymous technical data. Once it is off, nothing leaves the device at all, crash reports included.

INRO offers an optional subscription, INRO Premium (monthly or yearly). Basic use of the app stays free.

Payment. Payments are handled by Apple (App Store) or Google (Google Play) depending on your device. INRO has no access to any banking data, at any point.

Subscription management. Subscriptions are validated and tracked by RevenueCat, Inc. (revenuecat.com), our processor. RevenueCat receives and stores:

• an anonymous installation identifier generated by the app (it cannot identify you)
• the subscription purchase history: purchase, renewal, free trial, cancellation, refund
• the platform (iOS or Android), the app version and the device model

This information is used solely to check that your subscription is active and to unlock the Premium features. It is not used for advertising, is not resold and is never linked to clinical or patient data, which does not leave your device.

RevenueCat's privacy policy: revenuecat.com/privacy

Every permission below is optional and can be refused or withdrawn without preventing you from using the app.

• Camera: profile photo and QR code scanning
• Photo library: choosing a profile photo; no photo is ever uploaded to a server
• Location: local weather only; your position is neither stored nor transmitted
• Calendar: syncing your shifts

The app does not request microphone access and records no sound.

Sensitive data is protected by the iOS Keychain and the Android Keystore, with AES-256 encryption. Your clinical content does not travel over the internet: only the anonymous technical data in article 5 and the transaction information in article 6 do, over HTTPS.

To erase everything: Settings > Erase all data.

INRO includes no advertising network, no advertising SDK, no commercial audience measurement tool, and never requests access to the IDFA (iOS) or the GAID (Android). No data is shared for cross-app or cross-site tracking, and none is resold.

Three technical processors are involved, and only those three: Sentry, for crash reports (article 5), Google, for anonymous usage measurement (article 5), and RevenueCat, for subscription validation (article 6). Google Analytics for Firebase is used for internal audience measurement only: no advertising identifier is collected, and no data is used for advertising or shared with ad networks.

Local data is stored on your device, so you keep direct control of it: Settings > Erase all data.

The technical data in article 5 is anonymous: it cannot be linked to any person, and the right to erasure takes the form of stopping the collection, which is immediate under Settings, Privacy.

For the transaction data held by RevenueCat, you have the rights of access, rectification, erasure, restriction and objection. Write to inroapp@hotmail.com: we pass the request on and reply within 30 days. You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

Retention. Local data is kept until you delete it or uninstall the app. The technical data in article 5 is kept for 90 days maximum at Sentry and 2 months at Google. Transaction data is kept by RevenueCat for the life of the subscription, then for the legal retention period applicable to proof of purchase.

The app is strictly reserved for adult healthcare professionals. We knowingly collect no data from minors. Contact: inroapp@hotmail.com

The crash reports in article 5 are hosted by Sentry in the European Union and are not transferred outside the EU. Usage measurement is entrusted to Google Ireland Limited, established in the European Union; Google may process this anonymous data on servers outside the European Union, in particular in the United States, on the basis of the standard contractual clauses provided for by the GDPR.

Apple, Google and RevenueCat may process transaction data outside the European Union, in particular in the United States, in line with their own privacy policies and the contractual safeguards provided for by the GDPR (standard contractual clauses).

Clinical data, for its part, never leaves your device and is therefore never transferred.

This policy may be updated. The date at the top of the document is changed accordingly, and any significant change is flagged in the release notes.

For any question: inroapp@hotmail.com