Privacy Policy

Summary

openEHR Explorer is a desktop application that runs entirely on your machine. There is no openEHR Explorer account, no backend service operated by this project, and no patient or clinical data is ever sent to us. Other than your own requests to the servers you configure and update checks, the only data that can leave your machine is the anonymous analytics described below: a minimal launch ping that is sent even if you decline, plus usage and crash data that is sent only if you opt in.

Data stored on your machine

• Server profiles (name, URL, server type, authentication method) are stored in a local configuration file, for example~/.config/openehr-explorer/profiles.json on Linux and macOS or %APPDATA%\openehr-explorer\profiles.json on Windows.
• Credentials are stored in your operating system's keychain, or in an encrypted local file if no keychain is available.
• Request Inspector history is kept in memory for the current session only. Authorization headers and cookies are redacted.
• Settings such as your analytics choice are stored locally.

Network connections

• Servers you configure. The app sends requests directly from your machine to the openEHR servers (and the optional terminology server) you set up. The project never sees this traffic or its contents.
• Update checks. The app checks GitHub Releases for a newer version. GitHub receives the request as it would from any download, including your IP address, underGitHub's privacy statement.
• Anonymous analytics to Aptabase, only in release builds that include an Aptabase app key. See below.

Anonymous analytics and crash reports

On first launch the app asks whether you want to share anonymous usage data. Sharing is off unless you opt in, and you can change your choice at any time under Settings.

Sent even if you decline

A single session_started event is sent once per launch, after you have answered the consent dialog. Its only property is your choice (consent: "yes" or "no"). It exists so the project can tell how many people use the app compared with how many opt in. Like every event, it is sent by Aptabase's client library together with standard system information: the app version, operating system name and version, your system language setting (locale), the name and version of the web view engine, whether it is a debug build, the library version, a timestamp, and a random session ID that is not stored on your machine and changes after four hours of inactivity. As with any internet request, Aptabase's servers also receive your IP address. If you quit before answering the dialog, nothing is sent.

Sent only if you opt in

• Usage data: an app_launched event with the app version and your platform string; which features you use (for example that an AQL query was run or a composition was viewed); and the CDR platform type (ehrbase,better_platform, ferro_ehr or generic). These events carry the same system information as above.
• Crash and error reports: an error category and a scrubbed code location (a file name and line number). Error messages are never sent.

Never sent

Analytics events never contain server URLs, credentials, patient data, EHR IDs, composition content, query text, template content or anything you type. The design is documented inADR-0018 and the source code is open for inspection. How Aptabase handles data it receives is described inits privacy policy.

Code signing

Free code signing provided by SignPath.io, certificate bySignPath Foundation, where signing is enabled for a release. Releases without a signature may show a Windows SmartScreen warning. Signing does not involve any user data.

Contact

Questions or concerns? Open an issue on GitHub. Changes to this policy are tracked in the page history.