OcufuseSummary
This policy explains what personal data Ocufuse collects, why, where it is kept, who else handles it, and the rights you have. It covers the Ocufuse apps (iPhone and web) and this website.
Who is responsible
Ocufuse is the data controller responsible for your personal data.
- Address
- Available on request at hello@ocufuse.com
- hello@ocufuse.com
- Phone
- +1 (561) 652-2011
Write to us about anything in this policy, including requests to use your rights.
What we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account details | Email address, display name, sign-in method, account ID | You, or Apple or Google if you sign in with them |
| Eye photos | The photos you take in guided capture, with the date and time | You |
| Journal entries | How your eyes felt, symptoms you note, eye drops, caffeine, sleep, screen time, practice sessions, free-text notes, and the time you set for each | You |
| Settings | Language, theme, reminders, sound and haptics | You |
| Technical data | App version, device type, operating system, error reports, sign-in and security logs including IP address | Your device, automatically |
| Messages to us | Your name, email address and what you write in the contact form or emails | You |
Health data
Your eye photos and journal entries can reveal information about your health. Data protection law treats this as a special category of personal data, and we only process it with your explicit consent (see Legal bases).
What we don't collect
- We don't collect your location, contacts, or advertising identifiers.
- We don't run facial recognition and don't create biometric templates from your photos.
- The website sets no cookies and uses no analytics or tracking.
How we use it
- To create and secure your account and sign you in.
- To store your photos and entries and show them back to you: your timeline, comparisons, checklist and practice log.
- To build a Doctor Brief or export when you ask for one.
- To keep the service working and secure, fix errors, and prevent abuse.
- To answer your messages and send essential service emails, such as sign-in links and account deletion confirmations.
We do not sell your data, use it for advertising, share it with data brokers, or use your photos or entries to train machine learning models. We do not make automated decisions about you that have legal or similarly significant effects.
Legal bases
Under the EU General Data Protection Regulation (GDPR) and comparable laws, we rely on:
- Contract (GDPR Art. 6(1)(b)): to provide your account and the features you use.
- Explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)): to store and process your eye photos and health-related journal entries. We ask for this consent separately when you set up the app, and keep a record of the wording you agreed to and when.
- Legitimate interests (GDPR Art. 6(1)(f)): to keep the service secure, prevent abuse, and answer messages you send us.
- Legal obligation (GDPR Art. 6(1)(c)): where we must keep or disclose information by law.
You can withdraw your consent at any time by deleting your account. Because Ocufuse cannot work without the photos and entries you add, withdrawing consent means we delete them. Withdrawal does not affect processing that happened before.
Who handles your data
We use a small number of service providers who process data on our behalf, under contracts that require them to protect it and use it only on our instructions.
| Provider | What they do | Location |
|---|---|---|
| Supabase | Database, file storage for photos, and sign-in | EU (Frankfurt, Germany) |
| Apple | Sign in with Apple, if you choose it; App Store distribution | United States |
| Sign in with Google, if you choose it. We receive only your name, email address and profile picture. | United States | |
| GitHub | Hosts this website. Their servers record visitor IP addresses for security. | United States |
| Google Fonts | Serves the website's typefaces. Receives your IP address when a page loads. | United States |
| FormSubmit | Delivers contact form messages to our inbox | United States |
Nothing leaves your account unless you send it yourself, for example a Doctor Brief you export and give to your clinician. Once you share an export, the person you share it with is responsible for how they handle it.
We may disclose data if required by law or to protect someone's safety, and we will tell you unless the law prevents it.
International transfers
Your account, photos and journal entries are stored in the EU. Some providers above are based in the United States. Where personal data is transferred outside the EU or European Economic Area, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
How long we keep it
- Account, photos and entries: until you delete them or your account.
- After you delete your account: removed from live systems straight away and from backups within 30 days.
- Security logs: up to 90 days.
- Messages to us: up to 24 months after the conversation ends, then deleted.
- Inactive accounts: if you don't sign in for 24 months, we email you, and delete the account 30 days later if you don't respond.
Security
Data is encrypted in transit (TLS) and at rest. Access rules in the database mean each account can only read its own records, and photos are kept in private storage that requires your signed-in session. Access to production systems is limited to keeping the service running or helping you when you ask.
No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the supervisory authority as the law requires.
Your rights
You have the right to:
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong.
- Delete your data, which you can do yourself from the app (see how).
- Receive your data in a portable format. The app's CSV export covers your entries.
- Restrict or object to processing based on legitimate interests.
- Withdraw consent at any time.
Email hello@ocufuse.com or use the contact form to make a request. We answer within one month. We may ask you to confirm the request from the email address on your account.
You can also complain to a data protection authority, for example in the country where you live or work, or the data protection authority of the country where the operator is established.
Children
Ocufuse is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child under 16 has created an account, contact us and we will delete it.
This website
ocufuse.com is a static website. It sets no cookies, uses no analytics, and loads no tracking scripts. Our hosting provider, GitHub, records the IP address of each visit in server logs for security. Our typefaces are loaded from Google Fonts, so your browser sends your IP address to Google when a page loads; Google describes how it handles this in its Fonts privacy FAQ. If you use the contact form, your message is sent through FormSubmit to our inbox.
Changes to this policy
If we make material changes, we will update the date at the top and tell you in the app or by email before the changes take effect. Earlier versions are available on request.