Privacy Policy

SumaFlow Chart never receives your family's medical records. The documents, the values confirmed against them, the consultation recordings, the medications and the appointments are created and kept on your own phone. We operate no server that could receive them, and the app has no account to sign in to.

There is no account

No email address, no password, no phone number, no verification step, no "continue with". The app opens and you begin filing. This is not a signup we have postponed — there is no server for an account to exist on, so the concept appears nowhere in the product. It follows that we hold no identity for you, cannot recognise you across devices, and have no user record to hand over, sell, lose or be compelled to produce.

Data collected

None. Medical documents, the values read off them, consultation audio, medications, appointments, care notes, providers, contacts and the members of your household live in storage on your device. They are never transmitted to SumaFlow, because there is no SumaFlow service to receive them.

Data shared

None of your record, ever. There are no analytics, no advertising, and no usage reporting of any kind planned for the app — no launch counts, no crash reports, no tester profile. The trade is the same one our other apps make and worth stating plainly: because nothing is reported back to us, a problem you do not write in about is one we will not learn about.

The reading happens on the device

Chart reads values off your documents, and it does that on the phone. A document is not sent away to be read, processed or transcribed by anyone else's computer, and it is not used to train anything. The same is true of consultation audio: it is recorded and read on the handset and never uploaded.

This is also why the app is designed to work with no network at all — its fonts and its models are bundled rather than fetched. An app that made small, reasonable network calls would be an app that phones home, and a medical record is the last folder that should.

Nothing is filed until you confirm it

Reading a document is not the same as recording what it says. Every value the app extracts is shown to you beside the region of the page it came from, and it enters your record only when you accept it. Extraction on its own never writes. A value that was read but not confirmed is not in the record, and there is no queue of half-saved data waiting somewhere to be tidied up.

A household is joined by a key

Sharing a record with another member of the family involves two things, and only one of them travels.

• The file can be sent by email or chat. It is locked, and on its own it opens nothing, wherever it ends up.
• The key is twenty-four words, read from the other phone in the room. It never touches a network, and it never reaches us.

Because the two are separated, a household file sitting in an inbox or a chat backup is not a copy of your family's medical history — it is a locked container that the service carrying it cannot open, and neither can we.

We cannot recover your household

There is no cloud copy, no recovery email and no key escrow. If the twenty-four words are lost, that household cannot be opened again, and we cannot open it for you. This is the direct and unavoidable cost of our holding nothing, not an oversight. The app prints a Recovery Kit for exactly this reason; keep it where you keep the passports.

What leaves your device

Only what you deliberately send. Printing or sharing a Visit Brief, an Emergency Sheet or an export is an act you initiate, one file at a time, with the contents shown to you before it goes. Once a file is in your email, your cloud drive, a chat app or a clinic's hands, it is governed by that service or that clinic and no longer by us — Chart cannot protect a file after it leaves.

The Emergency Sheet is designed to be reachable without unlocking the phone, because the situation it exists for does not wait. That is a deliberate trade you opt into: anything placed on a lock screen can be read by whoever is holding the device.

Payments, if and when there are any

Nothing is for sale today. When a subscription ships it will be processed by Google Play, which means Google handles the payment and we run no payment server and receive no card details. A purchase would create no account with SumaFlow and would carry none of your record — a billing channel knows that a purchase happened, and nothing about anybody's health.

Selling anything on Android requires Google Play's billing library, which brings network access into the app with it. When that happens this page will say so in the same detail the Kaban policy does, rather than leaving you to discover it.

Cancelling never deletes anything

Stop paying and you keep everything. The record stays on the phone in full, and reading, printing and exporting keep working. A subscription pays for reading new documents for you; it does not hold your history hostage, and export is not a paid feature. You can take the whole household out to open formats at any time — documents as PDFs, values as a spreadsheet.

Data deletion

Delete the app and its data goes with it. There is no account to close, no server-side copy to request the erasure of, and no retention period to wait out. Individual documents, values and members can be deleted inside the app at any time. Exports and printed sheets you have already made are yours to manage; we have no way to reach them.

Recording a consultation

The audio never leaves the phone, but that is a statement about where the file goes, not about whether you may make it. Whether — and how — you may record a conversation with a clinician differs by country and sometimes by clinic, and it is a matter to raise in the room rather than something an app can settle for you. Chart's job is to make sure that if you do record, the recording stays yours.

Not a medical device, and not advice

SumaFlow Chart is a record-keeping tool. It holds a household's own documents, keeps the values confirmed against them, and prints what is already there. It forms no view about anyone's health: no ranges, no bands, no targets, no figure coloured by what it says, and no reminder triggered by a number rather than by a time you set. It is not a substitute for advice from a clinician, and any glossary entry it shows is a general definition rather than a comment on a particular person's record.

What this does not protect against

Stating the limits is part of being trustworthy about the rest. Keeping data on one device protects it from breaches of servers that do not exist; it cannot defend against a compromised or rooted operating system, against malware with screen-reading privileges, or against someone who knows your device passcode. Anyone you give the household key to can read the household — that is the point of the key, and it is a matter of who you trust rather than of cryptography. Nor can any app protect you from being compelled to unlock it.

Children

A household record may well include a child's documents, entered and managed by an adult. The app is designed for adults keeping a family's records and is not directed at children as users. It collects nothing from anyone, of any age, because it collects nothing.

Contact

For privacy questions, email privacy@sumaflow.app. In practice we hold no data about you to disclose, correct or delete — but the address is real and answered, and questions about the design are welcome while it is still being built.