Privacy policy
Visus holds an eye centre's patient records. This page says where they are kept, who can see them, which outside services are used and for what, and how long anything is kept. The short version: the records belong to the eye centre, and we keep them only to run Visus for it.
1. Who is responsible
Visus is made and run by AppBay, Palestine (info@appbay.dev, +970 59 757 9694).
- Patient records: the eye centre decides what is recorded about its patients and why, and is responsible for it under the laws that apply to the centre. AppBay keeps and processes those records on the centre's behalf and on its instructions, and for no purpose of its own.
- This website and the centre's own account with us: AppBay is responsible.
2. What Visus keeps
- About patients, as the centre enters it: name, file number, date of birth, sex, ID number and contact details; visits, examinations, measurements, diagnoses, prescriptions, test results and scans, operation records and consent forms; bills, payments and insurance or charity cover.
- About the centre's staff: names, usernames, roles and permissions. Passwords are stored only in a scrambled form that cannot be turned back into the password, so nobody, including us, can read them.
- What keeps the records safe: a log of who opened, changed, printed or downloaded a patient's file and who used an AI feature on it; server logs that include the internet address a request came from; and error reports, so faults can be fixed.
3. Where it is kept
Visus is hosted by AppBay on servers in Germany, inside the European Union, provided by Hetzner Online GmbH. Every connection to Visus is encrypted (HTTPS). Each centre has its own separate database. A full backup is taken every night to separate storage, also in Germany.
4. Who can see it
- The centre's staff, according to the roles and permissions the centre gives them. Clinical staff can be kept away from money, and nobody can grant more than they hold.
- AppBay, only to run, update, back up, restore or fix Visus, or when the centre asks us to.
- Nobody else. We do not sell data, show advertising, or use patient records for any purpose of our own.
5. Outside services
Some features send part of a record to an outside service to do their job. Each is used only if the centre uses that feature, and only for that feature.
- AI features (Anthropic, Claude): when a doctor uses dictation, the visit summary, "Ask the reports", or the reading of a photographed paper file, the text, figures or images needed for that task are sent to Anthropic and the answer comes back. Under Anthropic's commercial terms, what Visus sends is not used to train its models. The centre decides who may use AI features and sets spending limits.
- Speech to text (ElevenLabs): when a doctor dictates, the recording is sent to be turned into text.
- Text messages (HTD): appointment reminders send the patient's name and phone number, the date and time, and the centre's name and phone number.
- Email: password resets and system alerts are emailed to the centre's own staff.
- Spoken patient calls (Microsoft), if the centre switches them on: the patient's name is sent to be turned into speech for the waiting-room call.
- WhatsApp: the WhatsApp button only opens WhatsApp on the user's own device with a message ready to send. Visus itself sends nothing to WhatsApp.
6. How long
- Patient records are kept for as long as the centre uses Visus. A patient file that has records linked to it is archived rather than erased, and can be restored.
- Backups: one a day for the last 14 days, one a week for 8 weeks and one a month for 12 months, so an old copy can be recovered. The restore is tested automatically every week.
- The access log for patient files is kept for as long as the records are. Other activity is kept for two years.
- When a centre stops using Visus, we give it a complete copy of its data on request, keep the data for 90 days so the copy can be made, and then delete it. Copies inside backups expire on their normal schedule, at the latest 12 months later.
7. Security
Encrypted connections, scrambled passwords, optional two-step sign-in with an authenticator app, lock-out after five wrong passwords, sign-ins that end on their own, a permanent log of who opened each patient's file, signed visits that cannot be changed afterwards, and encrypted backups.
8. On your device
Visus sets no cookies. It keeps a few things in the browser so it works: the sign-in, the chosen language and theme, and screen preferences. The cookie policy lists them. This website counts visits with Umami, which runs on our own server, sets no cookies and does not identify you.
9. Patients' rights
If you are a patient of an eye centre that uses Visus and want to see, correct or remove your information, please ask the centre: it is responsible for your record. We will help the centre answer you. A centre can ask us for a copy of its data, or for it to be corrected or deleted, at info@appbay.dev.
10. Changes
If this policy changes, the date at the top changes too, and centres using Visus are told before anything important changes.