Privacy Policy

1. General Provisions

This Privacy Policy (the “Policy”) governs the processing of personal data of users of the MedNotes web application (the “Service”), owned by Viacheslav Hovras (the “Owner”). By using the Service, the user (the “User”) confirms that the User has read this Policy and agrees to its terms. If the User does not agree with any provision, the User must immediately discontinue use of the Service.

2. Categories of Data Processed

The Owner processes only the data strictly necessary for the operation of the Service, namely:

• Google account identification data (name, email address, account identifier and public profile picture), obtained solely for the purpose of authentication via the OAuth 2.0 protocol;
• content of medical notes, attached files and images that the User creates within the Service;
• patient visit data (date, time, duration, notes) stored in the User’s calendar;
• access tokens issued by Google Identity Services, stored locally in the User’s browser (localStorage) and never transmitted to the Owner.

3. Purpose and Legal Basis of Processing

Personal data is processed solely to operate the Service: to authenticate the User, to store and display the content the User creates, and to synchronize visit reminders with the User’s Google Calendar. The legal basis for processing is the User’s consent given upon authorization through Google, as well as the performance of the Owner’s contractual obligations to provide the Service.

4. Where Data Is Stored

The Owner does not store medical notes, files, images or calendar events on its own servers. All such data is stored exclusively in the User’s own Google account — in Google Drive (notes and files) and Google Calendar (visit reminders). The Owner has no ongoing access to this data and creates no backups of it.

5. Disclosure to Third Parties

The Owner does not disclose the User’s personal data to third parties, except where expressly required by applicable law. The Service interacts only with the APIs of Google LLC to the extent necessary to perform the User’s requests; processing of data by Google is governed by the Google Privacy Policy.

6. Scope of Google Permissions Requested

The Service requests only the following limited OAuth 2.0 scopes:

• drive.file — access only to files and folders created by the Service in the User’s Google Drive; the User’s other files remain inaccessible to the Service;
• calendar.events — creation, reading and deletion of events in the User’s calendar that pertain to scheduled visits;
• openid profile email — basic profile data for authentication.

7. Retention

Local access tokens are stored in the User’s browser until they expire or until the User signs out. Content created within the Service is retained in the User’s Google account for as long as the User chooses.

8. User Rights

The User has the right to: be informed about the processing of their data; access their data; rectify, update or delete it; withdraw consent to processing; restrict or object to processing; and lodge a complaint with the competent data protection authority. Deletion of data created within the Service is performed by the User directly through the Service’s interface or through the corresponding Google services.

9. Security

The Owner takes reasonable organizational and technical measures to protect personal data against unauthorized access, loss or disclosure. All interactions with Google servers are performed exclusively over a secure connection (HTTPS). The Owner is not liable for security breaches resulting from the User’s actions (in particular, compromise of the User’s device or Google account).

10. Changes to the Policy

The Owner reserves the right to amend this Policy. The current version is always available at /en/privacy within the Service. Continued use of the Service after publication of an amended version constitutes the User’s acceptance of its terms.

11. Contact Information

For questions regarding the processing of personal data, the User may contact the Owner at: govras99@ukr.net.