EndoShelf Privacy Policy
The short version
EndoShelf is a stock-control app for hospital supply rooms. It records what endoscopy supplies a department holds, where they are, and when they expire.
It holds no patient information of any kind. There is no field in it that could hold any.
The only personal information it holds is about staff — a work email address and a display name — so that people can sign in and so colleagues can see who received or used an item.
There is no advertising, no tracking, no analytics, and nothing is sold or shared with anyone.
Who is responsible for your information
Shaurya Chowdhry, operating as an individual developer.
Contact: shauryachowdhry44@gmail.com
Each centre controls what happens inside it. A centre is a clinic, hospital or department whose supplies are being tracked, and whoever created it is its administrator — that may be your employer, or it may be a colleague who set EndoShelf up for your practice. They decide who is admitted, what each person may see, and whose access ends. Requests about your own account are usually best raised with them first.
You can also create a centre of your own, in which case you are the administrator of it and those decisions are yours. A centre can see only its own stock, counts and history; it can never see another centre's, and we do not use anything in your centre for any purpose of our own.
What is collected
About you, as a member of staff:
| What | Why it is held | Where it comes from |
|---|---|---|
| Work email address | To sign you in, and to record who performed an inventory action | You, when the account is created |
| Display name | So a colleague sees “received by Dana Lee” rather than an anonymous code | You, when the account is created |
| Role, and whether your account is approved | To decide what you are allowed to do | Set by an administrator at your organisation |
| Date and time of actions you take | The inventory audit trail | Recorded automatically |
That is the complete list.
About supplies: product names and catalog numbers, quantities, storage locations, lot numbers, expiry dates, and the history of every stock movement.
What is never collected
- No patient information. No names, medical record numbers, dates of birth, diagnoses, procedure details, appointment information, or insurance information. The app has no data model for a patient. A supply being used is recorded only as a quantity leaving a shelf, with no link to any person receiving care.
- No location tracking. The app never requests or records your position.
- No advertising identifier, and no tracking of any kind. Nothing you do in EndoShelf is used to build a profile of you or followed across other companies’ apps or websites.
- No analytics or crash-reporting service. There is no third-party software development kit in the app collecting behaviour.
- No access to your photos, contacts, microphone, health data, or files.
The camera
EndoShelf asks for camera access for one purpose: reading the barcode printed on a supply box or a shelf label.
Images from the camera are examined on your device to find a code and are never saved, never uploaded and never shared. Only the decoded characters — a product number, a lot number, an expiry date — are used, and only to fill in the form you are already looking at.
You can refuse camera access and still use the app; there is a field for typing a code instead.
Free-text notes
Six optional fields accept typed text: a note on a stock movement (receiving or using), a note when asking another centre for stock, one when sending it, one when receiving it, and notes on a product or a storage place added from inside the app. They exist for things like “damaged in transit” or “found behind the shelf”.
All six display a permanent warning that patient information must never be entered, and all are limited in length. Two of them go further, and one does less:
- Creating a product or a storage place: text that looks like it contains a personal identifier is refused and cannot be saved at all. A catalog entry is permanent, and it is visible to the other hospitals in the network.
- The three transfer notes: the same check warns before saving, and the warning can be ignored.
- The note on a stock movement: the standing warning only, with no automatic check.
A check of this kind is a prompt, not a filter — it cannot catch everything, and anything typed into a note is stored as typed. Please do not put patient information there. Nothing in the app requires it.
Where the information is stored
In a managed PostgreSQL database operated by Supabase, hosted on Amazon Web Services in US East (Ohio).
- Traffic between the app and the database is encrypted with TLS. The app refuses unencrypted connections at the operating-system level.
- Data is encrypted at rest by the hosting provider.
- Your sign-in credentials are held in the iOS Keychain on your device, not in the app’s own storage.
Who can see it
Only people your organisation has approved.
A new account is given no access to anything until an administrator at your organisation approves it. Access is enforced by the database itself, not by the app, so it cannot be bypassed by modifying the app.
Hospitals that share a supply network can see a limited view of one another’s stock: which products are surplus or close to expiring, and how many. They cannot see each other’s storage locations, par levels, lot numbers, internal purchasing numbers, notes, or staff.
No information is sold, rented, or shared with advertisers, data brokers, or any third party. It is disclosed outside your organisation only if the law requires it.
How long it is kept
- Inventory history is permanent. Records of stock movements cannot be edited or deleted by anybody, including administrators — a correction is made by adding a further entry, so both remain visible. This is deliberate: a supply record that can be quietly rewritten is not a record.
- Your account is kept while you have access. An administrator removing your access ends it immediately, but does not by itself remove your name — so entries you made still show who made them to the people you worked with. Deleting your account is what removes your name and email address, and you can do that yourself at any time.
- Because inventory history is permanent, the entries recording actions you took remain, no longer attached to a name or a working account. The centre needs those quantities; it does not need them to identify you afterwards.
Your choices
| You want to | How |
|---|---|
| See what is held about you | Ask shauryachowdhry44@gmail.com, or your administrator |
| Correct your name or email | Your administrator can change it |
| Delete your account | In the app: More → Delete my account. Or ask shauryachowdhry44@gmail.com |
| Lose access without deleting | Ask your administrator to revoke it |
What deleting your account does and does not do. It removes your name and email address, withdraws your membership of every centre, and disables your sign-in: the password stops working immediately, and every hospital’s information becomes unreadable to you at once. If you were signed in on a device at the moment you deleted the account, the sign-in already open there is accepted by the server until it expires — within an hour — but it can no longer reach any hospital’s stock, people or history, and it cannot be used to request access anywhere. It does not remove the inventory history described above, which the hospital is keeping for its own supply records and which the app makes impossible for anyone to alter. Those entries survive without anything identifying you.
Before you confirm, the app tells you how many entries that is, in figures — not “some records may be retained”. If you would rather see the number before deciding, open the screen and read it; nothing happens until you type the confirmation.
There is one case where the app asks you to do something first. If you are the only administrator of a centre where other people are still working, deleting your account would leave them unable to approve anyone or change anything, so the app asks you to make somebody else an administrator before you go. It names the centre and takes about thirty seconds.
Depending on where you live you may have further rights over your personal information, such as under the GDPR or the California Consumer Privacy Act. Write to shauryachowdhry44@gmail.com and say what you would like; there is no charge.
Children
EndoShelf is a workplace tool for hospital staff. It is not directed at children, and no account is created without an administrator at a healthcare organisation approving it.
What this policy does not claim
EndoShelf is an inventory tool. It is not a medical device, it gives no clinical guidance, and it plays no part in anyone’s care.
This policy describes what the app does. It is not a statement that any particular legal or regulatory standard has been met. Whether EndoShelf is appropriate for a given organisation is that organisation’s own decision, and their privacy, security and compliance people should make it. A technical overview written for them is available on request.
Changes
If this policy changes, the date at the top changes with it, and material changes will be announced in the app before they take effect.
Contact
Shaurya Chowdhry
shauryachowdhry44@gmail.com
For anything about your own account, your organisation’s administrator can usually help fastest.