Privacy Policy
Effective Date: September 13, 2026 (supersedes September 2, 2026)
Overview
HAI Compass ("the App") is a companion tool for patients with hepatic artery infusion (HAI) pumps, and a clinical reference tool for their providers. Your privacy is important to us. This policy explains what information the App collects, how it is stored, and your rights regarding your data.
Information We Collect
The App may collect the following types of information, depending on which features you use:
- Pump details (serial number, flow rate, implant date, implanting surgeon, managing oncologist)
- Refill visit records (dates, residual volume, drug loaded, lab values)
- Symptom logs (fatigue, nausea, pain, mood, appetite, urgent flags such as jaundice or fever)
- Patient-entered lab values (AST, ALT, ALP, bilirubin, and optional custom labs)
- Travel logs and altitude data (if Travel Mode is used)
- Notification preferences
- Provider dosing calculations and patient records (provider accounts only)
- Electronic health record data (lab values, imaging report metadata) fetched at your request when you connect your MyChart or other EHR account. Imported lab values become part of your HAI Compass lab record and are stored the same way as lab values you enter by hand; everything else the connection fetches stays on your device. See the Electronic Health Record Integration section below for full details.
How Your Data Is Stored
Personal and health-related data is stored using Google Firebase (Firestore) under a signed HIPAA Business Associate Agreement with Google. Data is encrypted in transit (TLS) and at rest (Google Cloud default encryption). Each user's data is isolated to their authenticated account by Firestore security rules and is not accessible by other users, with one exception you control: if you link a family member or caregiver as a companion, they can see the health information in your record. You choose whether to link anyone, what level of access they get, and you can remove their access at any time.
Serial number protection. As of April 2026, pump serial numbers are never stored in Firestore in plaintext. Before a serial number is written, it is transformed server-side using HMAC-SHA256 with a secret key held in Google Cloud Secret Manager. Only the irreversible hash and the last four digits (for display) are stored in the cloud. The full serial number lives only in the operating system keychain (Secure Storage) on your own device. The one exception, made only at your explicit request, is described under Wallet passes and card exports below.
Patient names. The name a patient enters on their own device card stays only in the operating system keychain on their own device — it is never uploaded for storage (the transient signing step described under Wallet passes and card exports below is the one exception, and happens only when you request a pass). For provider accounts, the patient display names a clinician enters during dosing workflows are stored in the clinician's device keychain and, so that the clinician's own patient panel stays consistent across their devices, are also synced to our database in encrypted form only: each name is encrypted on our servers (AES-256-GCM) before storage, and the encryption key is held in a separate hardened key store — never in the database itself. Plaintext patient names are never written to the database, and only the clinician who entered a name can retrieve it. (Updated July 2026 — previously these names never left the clinician's device; the encrypted sync was added so a clinician's panel works across multiple devices.)
Wallet passes and card exports (added August 2026). You can export your device ID card as a PDF, which is generated entirely on your device — nothing about it touches our servers. If you choose to add the card to Apple Wallet or Google Wallet, the fields printed on the card (your name, the full pump serial number, physician, clinic phone, implant date, and drug) are sent once, over an encrypted connection, to our HIPAA-covered server, which signs the pass in memory and returns it immediately. The pass and its contents are not stored on our servers and no record of them is kept there. An Apple Wallet pass then lives only on your device. Saving to Google Wallet stores the pass in your own Google account, under Google's terms — the same way a file you share to a cloud drive would be. All of this happens only when you tap the button; nothing is exported automatically.
Electronic Health Record Integration
HAI Compass offers an optional feature to connect your MyChart (Epic) or other electronic health record (EHR) account to the App. This section describes exactly how that connection works and how the information is handled.
What happens to your EHR data. When you import lab results from your health record, those lab values become part of your HAI Compass lab record. They are stored in our database (Google Firebase, under a signed HIPAA Business Associate Agreement) in exactly the same way as lab values you enter by hand, so that they appear in your lab trends and history — and so that signing in to the same account on a new phone brings them with you. Nothing else the connection fetches is stored on our servers: imaging report summaries and your health system's internal identifiers are kept only on your device, in encrypted local storage, and your name as it appears in your chart is used once, to confirm we connected to the right account, and is then discarded — it is not stored anywhere, on your device or ours. Imported lab values are never included in analytics events, never attached to crash reports, and never exported to research datasets. If you have linked a family member or caregiver to your HAI Compass record, they can see imported lab values in the same way they can see lab values you enter yourself. Linking someone does not give them your sign-in details, and you can remove their access at any time. (Updated August 2026 — an earlier version of this policy stated that no EHR data reached our servers; that described a pre-release design. Since imported labs joined the synced lab record, this section describes the actual handling.)
What we request. When you choose to connect your EHR, the App uses the industry-standard SMART on FHIR authorization protocol. You sign in on your health system's own website in a secure browser window — we never see your MyChart username or password. After you sign in, your health system asks you whether HAI Compass can request these specific categories of information on your behalf:
- Your basic patient information (used one time, only to confirm we connected to the right account)
- Your lab results
- Your imaging reports (summary information only — study date, modality, and title)
- Permission to refresh the above while you use the App (so you don't have to sign in every time)
Read-only access. The App cannot change, add, or delete anything in your health system's records. It can only read the information you authorize.
How long we keep it. Imported lab values stay in your HAI Compass lab record until you delete your account. They are kept on purpose: your health system's connection only provides a recent window of results, so the values already imported are what makes a long-term trend possible. Everything else (imaging report summaries, connection metadata) is cached only on your device for as long as your account is linked. Disconnecting stops any further importing and clears the cached copy on your device; you can also choose to remove the imported lab results from your record at the same time. Deleting your account removes imported lab values along with the rest of your data.
Revoking access. You can disconnect your EHR account at any time from the My Records screen inside the App. When you disconnect, we attempt to send a revocation request to your health system's authorization server (when that system supports revocation), and we immediately clear the access token and all cached data from your device. Deleting your HAI Compass account performs the same revocation and wipe. You can also revoke the app's permission directly from your MyChart portal at any time.
Security. Access tokens are stored in your device's operating-system keychain (the same secure storage used for other credentials on your phone). The short-lived verification secret used to complete the sign-in process is held only in temporary memory during the sign-in flow and is never written to any kind of storage.
Crash Reports and Analytics
This release of the App does not send crash reports or third-party analytics off your device.
This describes the App as published on the App Store and Google Play, and the public web dosing calculator. If you are enrolled in a pre-release testing program (for example TestFlight or a Google Play testing track), an earlier test build may still include the limited analytics or crash reporting described below until you update to the current version.
- Crash reporting is turned off. The App does not transmit crash or error reports to Sentry or any other external monitoring service in the released build.
- No Google/Firebase Analytics. The App does not use Google Analytics for Firebase. Automatic and event-based Google Analytics collection is disabled.
- Our own product metrics are pseudonymous. To understand how the App is used (for example, how many people log a refill, or use Travel Mode) we record a small set of de-linked events in our own database, which runs on Google Cloud under a signed HIPAA Business Associate Agreement. These events carry only categorical labels, counts, and qualitative bands — never free-text notes, never your name, date of birth, or pump serial number. Your identity is represented only by a one-way cryptographic hash of your account ID (a pseudonym, not an anonymous value), and these events are deleted when you delete your account.
- Quality checks on our own records. To make sure the App records what it claims to record — for example, whether a lab value you typed matches the same value imported from your health record — we may run internal quality checks over the records held in our own database. These checks produce counts and averages only: no per-person results, no clinical interpretation, and nothing leaves HAI Compass. They are how we find and fix mistakes in the App itself. They are not research (see Research Participation below), and they do not change the rule that imported lab values are never exported to research datasets.
- Before you create an account. The App requires an account to use, but you can open it and choose which experience fits you before creating one. During that short window we may record a limited number of unlinked events about how the App is used, such as which experience you selected. We do not store an identifier that links these events to one another, to you, or to an account you later create. These events do not include symptoms, laboratory values, refill details, pump identifiers, or other clinical values. They are assigned a 90-day expiration and are then automatically deleted, subject to a short processing period.
We do not use advertising trackers, and we do not sell your data to third parties.
AI-Powered Features
The App's generative AI assistant features (the "Ask about HAI" education chat and the in-app "App Help" assistant) are not part of this release. No text you type is sent to Anthropic or any other AI service in this version of the App.
Two additional AI features that would have summarized account-collected data (Post-visit notes and Symptom summary drafts) are also disabled. If we re-introduce any AI feature in the future, we will do so only after confirming the appropriate vendor data-handling arrangements (including a Business Associate Agreement and a zero-data-retention configuration where required), we will update this Privacy Policy first, and use will require your explicit in-app consent, which you can decline or revoke at any time.
Travel Mode and Location
If you use Travel Mode (to track altitude change and its effect on pump flow rate) or the Find a Center feature (to sort HAI centers by distance from you), the App will ask your permission to access your device's precise location. Location is used on your device to perform one-time lookups against these third-party services:
- An address you type is sent to OpenStreetMap Nominatim to convert it into coordinates.
- For the provider dosing calculator's altitude-correction address field (clinician-only feature), address fragments you type are sent to Mapbox's geocoding API for autocomplete suggestions. Mapbox autocomplete is not used in the patient Travel Mode flow.
- Coordinates are sent to Open-Meteo's Elevation API to return the altitude at that point.
We do not attach your name, account ID, or health data to these lookups, and we do not route your location through our own servers. However, like any request your phone makes to a website, these requests necessarily reveal to those providers the information being looked up (the coordinates or address) together with your device's internet (IP) address, which can be approximately location-linked. We do not control those providers' own logging; please review their privacy policies. The App stores only the returned altitude (in feet) and any optional destination label you choose to type (such as "Denver visit") — never raw coordinates.
Research Participation
The App does not currently include any active research feature, and using it does not enroll you in research. Any research program we may offer in the future (such as an observational registry) will be strictly opt-in, presented separately from standard use, and governed by a separate informed-consent process that you can decline or withdraw from at any time without losing access to the App's clinical features. We will update this Privacy Policy before any such feature becomes active.
Data Sharing
We do not share, sell, rent, or trade your personal information with third parties. Data leaves your device only for these purposes:
- Authentication, encrypted data storage, and our pseudonymous product metrics (Google Firebase / Google Cloud, under a HIPAA Business Associate Agreement)
- Location lookups for Travel Mode and Find a Center (OpenStreetMap Nominatim, Mapbox, and Open-Meteo), which receive the coordinates or address being looked up and, inherently, your device's IP address (see Travel Mode and Location above)
- Push notification delivery (Apple Push Notification service and the Expo push service), which carry only a generic, non-identifying payload (see Push Notifications below)
- Direct device-to-EHR requests (only if you opt in to Electronic Health Record Integration; these requests travel directly from your device to your health system's authorization and FHIR servers and do not pass through our servers — the App does not relay, log, or cache the responses anywhere our backend can reach)
Your Rights
You have the right to:
- Delete all App data at any time. See our Data Deletion page for instructions.
- Decline optional features like notifications and Electronic Health Record integration
- Disconnect your EHR account at any time from the App's My Records screen — this clears the cached EHR data on your device and revokes access with your health system where supported
- Withdraw from any research study you have joined, at any time, without penalty
- Request information about your stored data by emailing us at the address below
Companion Access
Patients may optionally grant a family member or caregiver read or read/write access to their data through the companion pairing feature. Companion access requires the patient to actively generate and share a pairing code, and can be revoked at any time from within the App.
Push Notifications
Server-sent notifications (for example, an alert to a paired caregiver) are delivered through the Apple Push Notification service (APNs) and the Expo push service. That server-sent payload — what those services carry — is intentionally generic and does not include personal health information, your name, your pump serial number, or any account ID. A typical server-sent message reads "HAI Compass — You have a new care update. Open the app for details," and the specific content is fetched only after you open the App and sign in.
Refill reminders you schedule are different. The refill-countdown reminders you set are composed and scheduled entirely on your own device by the operating system. To be useful, their text may mention refill timing on your lock screen (for example "Refill due today" or an overdue reminder). This content is generated locally and is not sent to us or to any third party; it never leaves your device.
Audit Trail
To keep certain records tamper-evident, the App writes a minimized audit record when specific data changes (for example, a refill or symptom entry). Each record captures only which field changed, when, and the associated account — direct identifiers such as your name, date of birth, and pump serial number are redacted at the time of writing and are never stored in the audit record. These audit records are deleted along with your other data when you delete your account.
Children's Privacy
The App is not intended for use by individuals under the age of 18. We do not knowingly collect information from children.
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted within the App and at this URL. The effective date will be updated accordingly.