Your data

Where your data lives.

The logbook lives on your phone, encrypted. The server's job is identity, matching colleagues and relaying ciphertext. Each scene below ends with the line a privacy officer asks for first: what the server can read.

A case is saved. Nothing leaves the phone.

Your phone

Logbook: cases, outcomes, photosencrypted · Keys in the iOS Keychain, this device only
Search index of patient identifiershash only · HMAC-SHA256 under a key that never leaves the phone

Opus server

Your account: email, name, hospitals, career stagereadable
Your colleague listreadable · Names and the email, phone or registration used to match
Device public keysreadable · One X25519 key per device; the private half stays in its Keychain

Colleague's phone

Nothing about this caseabsent

Nothing moves.

What the server can read Your account and colleague list. No case, no patient, no photo.

Scenes advance on their own; choose one to stop.

Three things to know

Nothing is uploaded unless you do something that uploads it. Sharing a case, saving a backup, exporting a file. There is no background sync of the logbook and no cloud copy.
A shared case is end-to-end encrypted, not de-identified. It is sealed on your phone to your colleague's own devices, so the server stores ciphertext it cannot read. Your colleague, who was on the operating team, sees the patient identity you recorded. You choose the recipients, and the Privacy Policy says so.
Assessments are blinded. Trainee and supervisor each commit a hash before either can reveal, so neither rating can be shaped by the other.

The implementation, file by file: security and privacy.