Privacy Policy — SSY Engine

This Privacy Policy explains how the SSY Engine application (the “App”, package se.medtechmaze.ssyengine) handles information. SSY Engine is a professional clinical-utility tool for eye-care practitioners that calculates target intraocular pressure and visualises “Save Sight Years” in the management of open-angle glaucoma.

The data controller responsible for the processing described here is Medtech Maze AB (Sweden) (the “Controller”, “we”, “us”).

1. Summary

Clinical input values you enter are stored on your device and are not transmitted to us unless you choose to email your results.
When you use the in-app email feature, the recipient email address and the clinical values included in that report are sent so the email can be delivered.
We collect limited, app-interaction analytics to understand how the App is used.
All transmitted data is encrypted in transit (HTTPS).
We do not sell your data and do not share it except with the service providers named below, acting on our instructions.

2. Information we process

2.1 Data stored on your device (not collected by us)

The patient and clinical data you enter into the App, including measurement values and case records, are stored locally on your device in the App’s on-device database (Hive). This data remains on your device and is not transmitted to the Controller or any third party, except as described in Section 2.2 when you actively choose to email a report.

2.2 Data transmitted when you email a report

The App includes an optional feature that emails calculation results. When you use it, the following data is transmitted in order to compose and deliver the email:

Data	Purpose
Email address	To deliver the report to the recipient you specify.
Health information (the clinical input values included in the report)	To present the calculation results within the email you requested.

This processing happens only when you actively trigger the email feature. It is delivered through a server-side Cloud Function and our email-delivery processor (see Section 4).

2.3 App-interaction analytics

We collect limited analytics about how the App is used (for example, which features are opened and general usage events) to maintain and improve the App. This is processed through our analytics provider (see Section 4). We do not use this analytics data to identify individual patients.

3. Why we process data and our lawful basis

Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following lawful bases:

Performance of a service you request and our legitimate interests (Art. 6(1)(b) and 6(1)(f) GDPR) — to deliver the email reports you initiate and to operate, secure and improve the App.
Consent (Art. 6(1)(a) GDPR) where required — for example, for analytics in jurisdictions that require consent.

The clinical values entered are professional, work-related inputs used by an eye-care practitioner. Where any such information constitutes special-category health data under Art. 9 GDPR, it is processed only to provide the practitioner-requested functionality (Art. 9(2)(h)) or with consent. As the practitioner using the App, you are responsible for ensuring you have an appropriate lawful basis and any necessary patient consent before entering or emailing patient information.

4. Service providers (processors)

We share data only with the following providers, who act as processors on our behalf and only on our instructions:

Provider	Role	Data involved
Resend	Email delivery	Email address and the report contents you send
Aptabase	App-interaction analytics	Usage events
Google Firebase	Hosting and Cloud Functions infrastructure	Processing of the email request in transit

Some providers may process data outside your country. Where data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

5. Data retention

On-device data: remains on your device until you delete it within the App or uninstall the App. We have no access to it.
Emailed reports: retained by our email processor only as needed to deliver the message and for short operational logging.
Analytics: retained in aggregated/limited form for as long as needed to operate and improve the App.

6. Security

All data transmitted by the App is encrypted in transit using HTTPS. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights

Subject to applicable law, and in particular under the GDPR, you have the right to:

access the personal data we hold about you;
request rectification of inaccurate data;
request erasure (“right to be forgotten”);
request restriction of, or object to, processing;
data portability;
withdraw consent at any time, where processing is based on consent (without affecting prior processing); and
lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Because clinical input data is stored locally on your device, you can exercise access and erasure of that data directly within the App. To exercise your rights regarding data we process (such as emailed reports or analytics), contact us using the details below.

8. Children

The App is intended for use by eye-care professionals and is not directed to children. We do not knowingly collect personal data from children.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date at the top of this page.

10. Contact

Data controller: Medtech Maze AB, Sweden.

Postal address: Polhemsgatan 18, 112 36 Stockholm, Sweden

Privacy contact email: hello@medtechmaze.se