Last updated: 20 July 2026
This Privacy Policy explains how personal data is processed in connection with the ilviDoc mobile application (“the App”).
ilviDoc is a professional clinical documentation application provided to healthcare organizations, such as hospitals, for use by authorized staff. It is not intended for use by the general public.
1. Data controller and processor
The healthcare organization that provides and configures the App generally acts as the data controller for patient and staff data processed through the App.
ilvi GmbH generally acts as a data processor and processes personal data only on the Customer’s documented instructions and in accordance with the applicable data processing agreement.
For questions concerning patient or staff data, please contact the relevant healthcare organization or its data protection officer.
For technical questions concerning the App, please contact:
ilvi GmbH
Am Innovationspark 10
8020 Graz
Austria
Telephone: +43 316 395123
Email: [email protected]
2. Data processed by the App
Depending on the functions enabled by the Customer, the App may process:
- staff identifiers, login data, NFC badge identifiers, roles, and permissions;
- patient identifiers, demographic and administrative data;
- vital signs and other clinical measurements;
- values entered manually, received from connected medical devices, or extracted using local OCR;
- photographs, videos, audio, scanned documents, barcodes, and QR codes;
- notes and other clinical documentation;
- Bluetooth device identifiers and connection data; and
- technical and diagnostic information such as timestamps, App version, device type, operating-system version, synchronization status, and error messages.
The App does not transmit patient or staff data to ilvi for advertising, analytics, profiling, marketing, or other independent purposes.
3. Purpose and legal basis
The Customer determines the purposes and legal bases for processing personal data through the App.
Depending on the applicable law and healthcare context, processing may be required for:.
- patient care,
- clinical documentation,
- legal obligations,
- employment-related purposes,
- public-interest tasks,
- or other lawful purposes
Where health data is processed, the Customer is responsible for determining the applicable legal basis under Article 9(2) GDPR or corresponding national law.
4. Local OCR processing
The App uses Google ML Kit for on-device optical character recognition.
OCR processing is performed locally on the device. Images, extracted text, and patient data are not transmitted to Google or to any external OCR or AI service.
5. Permissions
The App may request the following permissions where required by enabled functions.
Camera
The camera is used for:
- Scanning barcodes, QR-Codes and documents
- performing lokal OCR
- capturing patient photographs or videos
Mikrophone
Used only to record audio as part of patient video documentation where this function is enabled and actively used.
Bluetooth and nearby devices
Used to discover, pair with, and communicate with compatible medical devices.
On Android, the App declares its Bluetooth scanning permission using the neverForLocation flag, indicating that Bluetooth scanning is not used to determine the user’s location.
On some Android devices, however, the operating system or device manufacturer may still require location permission before Bluetooth scanning can function. In such cases, the App may request location permission solely to enable the discovery of compatible Bluetooth devices.
The App does not access, determine, evaluate, store, or transmit the user’s or device’s physical location. Any location permission requested in connection with Bluetooth scanning is used exclusively to meet the technical requirements of the operating system.
NFC
Used to identify or authenticate authorized staff members using a compatible staff badge.
6. Data transmission
Data entered, retrieved, or captured through the App is transmitted only to the Customer’s dedicated backend environment or to systems connected and controlled by the Customer.
Data transmitted between the App and the Customer’s backend is protected using the transport-security mechanisms configured for the Customer’s environment.
7. Local storage and deletion
Patient data may be stored temporarily on the hospital-managed device while it is being used or awaiting transmission.
Locally stored patient data is protected according to the storage method used:
- Patient data temporarily cached for active patient lookups is stored in an encrypted local data store.
- Data awaiting transmission, as well as locally stored patient photographs and videos, is protected by the operating system’s application sandbox and device security mechanisms. This data is not currently encrypted separately at the application level.
If transmission is temporarily unavailable or unsuccessful, the data remains stored locally until transmission can be completed.
Once transmission has been completed successfully, the transmitted data is removed from the local transmission queue and is no longer retained by the App.
Authentication credentials and security tokens are stored using secure operating-system storage, such as iOS Keychain or Android Keystore, where applicable.
8. Technical logs
The App may transmit technical and diagnostic logs to the Customer’s backend for troubleshooting and operational monitoring.
Logs may include:
- timestamps
- App version
- device information
- synchronization status
- technical error details
The App is designed not to include passwords, access tokens, patient photographs, videos, or complete clinical records in diagnostic logs.
Logs are stored on the Customer’s backend and retained in accordance with the Customer’s configuration and policies.
9. Third-party software
The App does not use third-party advertising, user-tracking, analytics, or external crash-reporting services.
Third-party software libraries may be used to provide local functions such as:
- OCR
- barcode scanning
- Bluetooth communikation
- media handling
- NFC
- secure credential storage
These libraries are not used to transmit patient or staff data to their providers for advertising, tracking, analytics, or profiling.
10. Data retention
The Customer determines the retention periods for data stored in its backend systems.
ilvi does not independently determine how long patient records are retained on behalf of the Customer.
Data awaiting transmission remains stored locally only until it has been successfully transmitted or otherwise removed through procedures defined by the Customer.
11. International data transfer
The location of the Customer’s backend and connected systems is determined by the Customer.
ilviDoc does not independently transfer patient or staff data outside the European Union or European Economic Area for ilvi’s own purposes.
Where an authorized subprocessor processes personal data outside the EU or EEA, appropriate legal safeguards are applied as required by applicable law.
12. Data-subject rights
Depending on applicable law, data subjects may have the right to request:
- access to their personal data;
- correction or deletion;
- restriction of processing;
- data portability;
- objection to certain processing;
- withdrawal of consent where processing is based on consent.
Requests concerning patient or staff data should be directed to the relevant Customer as data controller.
If ilvi receives such a request, it will forward it to the Customer or handle it in accordance with the Customer’s instructions.
Data subjects also have the right to lodge a complaint with the competent data protection authority in the country where they live, work, or where the alleged infringement occurred.
13. User accounts
User accounts are created, managed, disabled, and deleted by the Customer through its own user-management or identity-management processes.
Users cannot create an account directly within the App.
Requests concerning account access, deactivation, or deletion must be directed to the responsible administrator or data protection contact within the relevant healthcare organization.
14. Automated decision-making
The App does not use patient or staff data for advertising, profiling, or automated decisions that produce legal or similarly significant effects.
Clinical assessment and decision-making remain the responsibility of qualified healthcare professionals.
15. Changes to this Privacy Policy
This Privacy Policy may be updated if the App’s functions, technical implementation, or legal requirements change.
The date at the beginning of this Privacy Policy shows when it was last updated.