Where your data lives

The short version: patient names, hospital numbers (MRNs), and the per-case earnings figures you enter are scrambled on your phone using your backup password, then sent — still scrambled — to the app’s servers. The servers hold them but can’t read them. Only your phone, after you unlock it with your backup password, can read them.

To say it plainly: your patients’ names, their MRNs, and your earnings figures are scrambled on your phone, with your backup password, before they ever leave it. The servers hold only unreadable bytes, and never the key that would unscramble them. Only your unlocked phone can read them. We can’t read them even if we wanted to — and neither could anyone who broke into the servers.

Two places, different jobs

Your case data lives in two places:

• The app’s servers hold everything: procedure, date, hospital, side, notes, plus the scrambled patient names, MRNs, and earnings figures. The servers can read everything except the scrambled bits.
• Your phone holds a working copy of your patient names in readable form, so your case list loads quickly. This copy only exists while your vault is unlocked.

The servers are the master. Your phone holds a working copy. If you wipe your phone, the next sign-in pulls everything back from the servers.

Why patient names are scrambled on your phone

Two reasons.

One. Even people with full access to the servers cannot read your patient names. The scrambled bytes are unreadable without a key derived from your backup password, which only your phone sees.

Two. Scrambling on your phone is stronger than scrambling at the server. A server-only approach protects the disk but not the running software. Scrambling on your phone means patient names are never readable on any server, ever.

The trade-off: if you forget your backup password and lose access to all your devices, the scrambled bytes on the servers become permanently unreadable. We can’t unscramble them on your behalf. See Your backup password.

The MRN on a case is the thread back to the hospital’s own records — it’s how a settlement sheet or an EMR finds the same patient — which is why the app keeps it stable once it’s set. You can add a patient name to a case later, but the MRN it was given doesn’t change.

How saving a name actually works

When you save a patient name, this happens in this order:

1. Your phone scrambles the name and MRN using your backup password’s key.
2. The scrambled bytes are sent to the servers.
3. Once the servers confirm the bytes arrived, your phone updates its working copy.

The servers go first. If step 2 fails, your phone doesn’t pretend a name is saved that isn’t.

What the app’s servers can see

For each of your cases, the servers see:

• Your account
• Procedure (free text or matched from the procedure list)
• Date, hospital, side, role
• Notes you typed (don’t put patient names in notes — the app warns you if you try)
• Scrambled bytes for the patient name, the MRN, and any per-case earnings figures you entered

The servers do NOT see the patient name, the MRN, or your earnings figures in readable form. Ever. To the servers, those are just unreadable bytes.

Recovery on a new phone

When you set your backup password during onboarding, your phone creates a key, scrambles it under your password, and uploads the scrambled key to the servers. That’s the only secret material the servers hold — useless without your password.

On a new phone:

1. Sign in with the magic link to your email (tap the link, then tap Continue to sign in).
2. Type your backup password. Your phone unscrambles the key.
3. Your phone fetches your cases. Names appear as the list loads.

No file to copy, no backup file to download, no cloud-drive setup.

Self-correction

Occasionally the scrambled bytes on the servers were scrambled under a key that no longer exists (usually because you reset your vault at some point). The app handles this automatically: if your phone’s working copy still has the name, the app re-scrambles under your current key and quietly updates the servers. Next time the case loads, everything reads cleanly. You see nothing.

If a name is unrecoverable both on the servers and on your phone, you’ll see a Lost in reset label on that case. Tap it and you can either re-enter the name (which fixes it) or delete the case.

Board-ready exports

When a board, an interview panel, or a credentialing body asks for your operative experience, the app can produce two documents from your cases. Both live under Settings → Backup & recovery.

• Logbook summary — the consolidation report: how many of each procedure you’ve done, split into performed and assisted. The header is honest about what’s being counted: “512 procedures across 460 cases” means some cases involved more than one procedure. Procedures and cases are both shown, never blurred into one number.
• Credentialing logbook — the per-case evidence: date, MRN, age and sex, procedure, hospital, your role, and whether the case has been verified against hospital records. No patient names appear anywhere in it. The MRN is the identifier — that’s how credentialing dossiers work, and it keeps the document safe to hand over.

Before exporting, you choose the scope: a specialty (yours is preselected), a hospital (all or one), and a date range. Then either download a spreadsheet file (CSV), or open the printable report and use your browser’s print dialog to save it as a PDF. The printable report carries a signature line so a consultant or head of department can attest it on paper.

Both documents are produced entirely on your device. Your phone unscrambles the patient details under your unlocked vault, builds the document, and downloads or prints it locally. The servers play no part in the export and never see the readable result. And the exports never guess: if a case has no recorded age or sex, those cells stay blank.

What is NOT scrambled

• The clinical content of your case — procedure, date, side, complications, notes — lives on the servers in readable form. (The servers still protect them as ordinary databases do, but not with your backup password.)
• The list of procedures you choose from.
• Hospitals you’ve added to your profile.
• Your account email, display name, specialty, and — if you’ve set them — your gender and how you’d like to be addressed.

The line is drawn around what could identify a specific patient. Everything else is ordinary data.

Voice dictation

When you dictate a case, the words are turned into text on your phone by default. The audio never leaves the device, and it’s wiped once the words are transcribed. This is the normal way voice works, and it’s private the same way the rest of your case data is.

There is one deliberate exception, and you’re the one who chooses it. If the on-device transcription keeps mishearing you — a heavy accent, dense sub-specialty terms — you can switch on a higher-accuracy cloud mode for a recording. When that’s on, that recording’s audio (which could include a patient name you spoke aloud) is sent, as you speak, to a secure, contracted medical transcription service that’s bound not to keep it — the more accurate words appear live on your screen, and the audio is discarded as soon as the transcript exists. Nothing is stored on our servers: normally the audio travels straight from your phone to the transcription service, and if a bad connection forces the recording through our server instead, it only passes through — transcribed and deleted immediately, never kept.

You can always tell which mode you’re in: a cloud recording shows a small “High-accuracy cloud” badge while you record; no badge means the recording never left your phone. If the live connection drops mid-dictation, the recording carries on and the words simply appear when you finish — a dictation is never lost to a bad connection. And whichever mode produced the words, they run the same on-device patient-name and MRN checks before anything is saved.

This is off unless you turn it on, you decide it per recording, and you can switch it back off at any time. When it’s off, your dictation stays entirely on your phone.

Anonymous usage data

So we can see where the app helps and where it trips people up, it counts a handful of anonymous actions — a screen was opened, a case-capture step was reached, an import started or finished. Each is one item from a short, fixed list of counters. That’s all that’s sent.

What goes with it is a random tag your phone makes up the first time you use the app, so we can tell “this many sessions did X” apart from “this happened X times in one session.” That tag is not your name, your email, or your account — it isn’t tied to who you are, and it can’t be traced back to you.

What is never in this data: patient names, MRNs, earnings figures, notes, anything from your vault, or any free text at all. There’s nowhere for it to go — the counters are a fixed list, so a name or number couldn’t ride along even by accident. This is our own counting, on our own servers; nothing is handed to an outside analytics company.