Privacy Policy — ARTpatient
Version: 1.2 · Effective date: 2026-09-27
Application: ARTpatient (iOS / Android), Ferticare
1. Who processes your data
The data controller is the clinic that issued your activation invite: Ferticare, Centro de Medicina de Reprodução - Braga, Lda., Rua José António Cruz, n.º 235, 2.º, Fração B, 4715-343 Braga, Portugal, company number 507696212.
Data protection contact:
geral@ferticare.pt · +351 253 004 474 · https://www.ferticare.pt/fale-connosco/
ARTpatient is the application through which the clinic communicates with you. The clinic determines the purposes and means of processing; the app is the technical channel.
2. Who the app is for
ARTpatient is only usable by patients and professionals of Ferticare. Access requires an activation invite (QR code or link) issued by the clinic. There is no public sign-up: without an invite the app neither collects nor processes any data about you.
3. What data is processed, and where
| Category | Examples | Where it lives |
|---|---|---|
| Private cryptographic keys | Ed25519, X25519, local encryption key | Device only (iOS Keychain / Android Keystore). Never transmitted. |
| Commitment identifier | SHA-256 of your public key | Server — non-reversible pseudonym |
| Public keys | Ed25519, X25519 | Server |
| Clinical content | Treatment plan, prescriptions, dose calendar, adherence, side effects, notes, report PDFs, ultrasound images | End-to-end encrypted. Stored on the server only as ciphertext the server cannot read. In the clear only on your device and in the clinic's own system. |
| Audit log | Who accessed what, and when | Server, pseudonymised |
| App preferences | Language, dose reminders, biometric lock | Device only |
| Operational metrics | Request counts, error rates | Server, no patient identifiers |
The server never receives in readable form: your name, date of birth, chart number, contact details, medication names, doses or clinical notes.
4. Device permissions
| Permission | Purpose | Notes |
|---|---|---|
| Camera | Read the activation QR code issued by the clinic | No image is stored or transmitted |
| Photos | Read a QR code from a saved image | One-off access, only to the file you choose |
| Face ID / Touch ID / biometrics | Require authentication before showing clinical data | Verification is performed by the operating system; the app receives only a yes/no. No biometric data is read, stored or transmitted |
| Notifications | Dose and appointment reminders; alert that the clinic sent something | Reminders are scheduled on the device itself. Notifications are discreet by default (generic text, content hidden on the lock screen). See "Clinic alerts" below |
| Boot completed (Android) | Re-schedule reminders after a restart | — |
Location: the app does not use or collect your location. On iOS a location usage string exists in Info.plist only because a bundled file-selection library requires it; the app never requests location access.
5. What the app does not do
- No analytics, no trackers. There is no Google Analytics, Firebase Analytics, Crashlytics, Sentry, advertising SDK or equivalent. The only Firebase component included is messaging (Firebase Cloud Messaging), used solely by the optional "Clinic alerts" feature described below; analytics collection is deactivated.
- Medication reminders never go through Google or Apple. They are scheduled on the device, so no external server learns when you take medication.
- No Google or Apple push without your consent. Unless you accept "Clinic alerts", the app does not start Google's messaging service and creates no identifier in it.
- No advertising and no in-app purchases.
- No selling or sharing of data for commercial or targeted advertising purposes.
- No tracking identifiers (IDFA, Advertising ID).
Clinic alerts (optional, from version 1.2.0)
When your clinic offers this feature, the app asks you — for each session, never with the option pre-selected — whether you want to be alerted when the clinic sends you something. Only if you accept:
- your phone receives a generic alert ("You have news from the clinic") when there is a message, a document or a change to your plan or appointments. The alert does not carry the content, your name, the sender, dates, medication or any clinical identifier; the content stays end-to-end encrypted and is fetched only by the app;
- by default the alert is always the same text. Only if you turn off discreet notifications may the alert say what kind of news it is ("You have a new message", "New document received", "Changes to a plan received"); in that case Google and Apple also receive a short code for the kind of news (for example
c2), never the content. Turning discreet notifications back on restores the single text; - the alert is sent by the clinic's sync server through Google's notification service (Firebase Cloud Messaging) and, on iPhone, Apple's (APNs). These services process an installation identifier (registration token and Firebase installation ID) and technical data, including connection information (such as the IP address) and when each alert is sent. The link to the clinic's app and the frequency of alerts may allow use of its services to be inferred;
- the sync server keeps the token, associated with the session's pseudonym, until you withdraw consent, remove the session, the clinic revokes the device, or 60 days pass without the app renewing it.
You can withdraw consent for each session, or turn the feature off for the whole phone, in Settings → Notifications. The app then deletes the association on the server, deletes the token and asks Google to delete the installation ID; Google states a period of up to 180 days to remove it from its systems and backups. Without an Internet connection the cleanup stays pending and is retried. An alert already handed to Google or Apple cannot be recalled.
Declining has no consequence: the app works the same and the clinic can still contact you by email or SMS. With the alerts off, the app fetches what is new when you open it and on the system's periodic checks — there is no other alerting channel, on any platform.
6. Zero-knowledge architecture
All clinical content is encrypted on your device before it leaves it. Private keys never leave the device. The synchronisation server (relay) stores only ciphertext bound to a pseudonym, so it cannot — even under a court order — reconstruct clinical content from what it holds.
Each session has a separate cryptographic identity in your wallet: one session's data is not reachable from another.
7. Legal basis (GDPR)
| Purpose | Basis |
|---|---|
| Delivering care and treatment follow-up | Art. 6(1)(b) and Art. 9(2)(h) |
| Access audit log | Art. 6(1)(c) and Art. 9(2)(h) |
| Service security and availability | Art. 6(1)(f) — legitimate interest |
8. Retention
| Data | Period |
|---|---|
| Encrypted clinical content | Until you request deletion |
| Data on the device | Until you remove the session or uninstall the app; on iPhone, until the first launch of a new installation, unless you choose to keep it (see below) |
| Audit log | At least 7 years (legal obligation for clinical records) |
| Operational metrics | 30 days |
| "Clinic alerts" token on the sync server (only if you accepted) | Until you withdraw consent, remove the session or the device is revoked; at most 60 days without renewal |
| Record of your consent to "Clinic alerts" (text version, scope, dates) | On the device, until you remove the session |
| Exported files | Deleted from the server after download |
Removing a session from the wallet irreversibly erases that device's keys and encrypted caches.
On iPhone, deleting the app is not enough to erase them: the system keeps them in the phone's Keychain. The first launch of a new installation erases them, unless you turned on "Keep connections when reinstalling" (Settings → Security): then your connections come back with the new installation, and so does the app lock if it was on. To erase them straight away, remove your connections from the wallet before deleting the app. On Android, uninstalling the app erases them.
9. Processors and transfers
We do not sell your data and do not share it with third parties for their own purposes.
- A hosting provider (VPS) in the European Union — hosting for the synchronisation server, under an Art. 28 GDPR processing agreement. The processor's identity is provided on request.
- Cloudflare — DNS and connection protection for the synchronisation server.
- Apple / Google — app distribution. They receive download and account data under their own policies; they receive no clinical data.
- Google (Firebase Cloud Messaging) and, on iPhone, Apple (APNs) — only if you accept "Clinic alerts": delivery of the generic alert. They process the installation identifier and technical service data; they receive no clinical content and no clinical identifiers.
All servers hosting clinical data are located in the European Union, and there are no third-country transfers of clinical data. "Clinic alerts", if you accept them, involve processing of the technical identifiers above by Google and Apple, which may take place outside the European Union under the transfer mechanisms set out in their terms (EU–US adequacy decision and/or standard contractual clauses).
10. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection (GDPR Art. 15–22). You can:
- export your data from within the app;
- erase local data by removing the session;
- contact geral@ferticare.pt for any other request, including erasure on the clinic side.
Audit log entries are retained for the statutory period even after an erasure request, as permitted by Art. 17(3)(b).
You may lodge a complaint with the Portuguese supervisory authority — CNPD, Comissão Nacional de Proteção de Dados, https://www.cnpd.pt.
11. Security
- End-to-end encryption of clinical content (AES-256-GCM)
- The clinic's public key is pinned at build time, which prevents a forged invite from validating itself
- Ed25519 signatures on all synchronised records
- Local storage in Keychain (iOS) / Keystore (Android)
- Optional biometric lock when returning from the background
- Rate limiting on authentication endpoints
- Server-side audit logging
12. Children
The app is intended for adults undergoing assisted reproduction treatment. It is not directed at children under 16 and does not knowingly collect their data.
13. Not a medical device
ARTpatient displays information entered by healthcare professionals. It does not diagnose, does not calculate doses and does not issue treatment recommendations. It does not replace medical consultation. In an emergency, call your local emergency number.
14. Changes
Material changes are announced through an in-app notice, and the effective date at the top of this document is updated.
15. Contact
Controller: Ferticare, Centro de Medicina de Reprodução - Braga, Lda., Rua José António Cruz, n.º 235, 2.º, Fração B, 4715-343 Braga, Portugal
Privacy contact: geral@ferticare.pt
Support: https://www.ferticare.pt/fale-connosco/