Privacy in the app

The app talks to the clinic’s server, not to us

The app logs in to the clinic’s own server with the clinic’s address and the clinician’s key. The server is either hosted by Anotera (name.anotera.clinic) or sits in the clinic’s own environment. Everything the app shows and stores — clients, appointments, clinical notes, messages, invoices — lives on that server.

Anotera, as the publisher of the app, receives nothing from it beyond what goes to that server. If the clinic runs in its own environment, nothing goes to Anotera at all. If the clinic is hosted with us, we are its data processor — and notes, client cards and messages are encrypted with a key derived from the clinician’s own, which we do not hold. The details are on the terms page.

• No tracking. No advertising, no analytics tools, no third-party SDKs for measurement.
• No push notifications.
• Video consultations use WebRTC (the LiveKit library). The media stream goes between the participants through the clinic’s own video service.

What is kept on the phone and the iPad

What the app shows is fetched from the clinic’s server when it is needed. What is actually kept on the device is this:

• The clinician’s key — in the iOS keychain. It is deleted when you log out.
• Language choice, and which of the device’s calendars are shown (UserDefaults).
• Drafts of notes and audio and video recordings, until they have been sent or deleted. They sit in the app’s own folder with complete file protection — encrypted while the device is locked — and are excluded from iCloud and device backups.

Face ID or a passcode can lock the clinical record once the app has been away for a while.

What the app asks permission for, and why

iOS asks the first time the app wants to use one of them. Each permission has one purpose:

• Microphone. The session can be recorded so that it can be transcribed into a clinical note. The recording stays on the device until the clinician sends it to the clinic’s server.
• Speech recognition. Happens on the device itself, with Apple’s on-device recognition. The app does not send the audio to Apple.
• Camera. Video recording for supervision — only when the client has said yes and the clinician turns it on. The film is sent encrypted to the clinic’s server and deleted from the device.
• Face ID. Locks the clinical record.
• Calendars. The device’s own calendars are shown next to the clinic’s, so that clashes can be seen. They are read on the device and never sent anywhere.

Consent to recording is taken on the client’s card, once. For video calls where the other party is not in the room, it is asked every time.

The clinic is the data controller

The clients’ information in the app is the clinic’s clinical record, and the clinic is the data controller for it. A client who wants access, correction or deletion contacts their clinic. For clinics hosted with Anotera, Anotera is the data processor, under the agreement on the terms page. The data is held in the EU, at Hetzner in Germany or Finland.

What disappears, and who decides

• Logging out removes the key from the device.
• Deleting the app removes what was on the device.
• What lives on the clinic’s server is the clinic’s to decide over. Export and deletion are the clinic’s own buttons.

What it says in the App Store

Under «App Privacy» in the App Store, the app declares the data types that go to the clinic’s server when the clinic is hosted with Anotera: name, e-mail, phone, address, health information (the clinical record), audio and other user content. They are linked to the person, are not used for tracking, and are processed only so that the app works. The declaration and this page have to say the same thing; if they do not, that is a mistake — write to us.

Questions: kontakt@anoteraclinic.com. This text applies from 4 October 2026.