Data controller and roles
The controller of the data collected through VascularReport (accounts and settings of registered doctors) is Dr Giuseppe Carella, Consultant Vascular Surgeon.
For any request concerning your personal data (access, rectification, erasure, withdrawal of consent to the newsletter) you may write to: info@vascular-report.com.
Patient data. The data you enter in reports concern your patients: for those data the controller is you, or the healthcare organisation you work for. VascularReport provides the software; reports stay on your device and, if you choose, on your own Google Drive, and are neither received nor stored by us (see section 3). It is up to you to inform your patients and to assess whether using the software complies with the rules of your organisation.
Data collected and purposes
| Data | Why we process it | Legal basis |
|---|---|---|
| Account email and password | To let you sign in securely | Performance of the requested service |
| Custom phrases, report header, logo, signature, drug and stocking lists, free-report templates | To restore your settings whenever you sign in, including from another device | Performance of the requested service |
| Archive key, encrypted with your archive code | To let you reopen your archive on another device. We cannot read it (see section 3) | Performance of the requested service |
| Newsletter choice (yes/no) and email | To send you service updates, only if you consented | Consent (can be withdrawn) |
| Technical connection data (IP address, date and time, browser type) | To run the site and protect it from abuse; logged by the technical providers listed in section 6 | Legitimate interest in the security of the service |
We can never read your password: it is handled by Supabase, the authentication provider, using standard secure hashing. We do not collect patient data and we do not use your data for profiling or advertising.
Reports stay on your device
The content of reports — patient details, selected findings, generated text — is never sent to or stored on our servers. The report archive stays in the local storage of the browser you are using (on your computer or device) and is always encrypted (AES-256), locally too.
- Reports do not pass through our servers to be synchronised between devices. If you choose, they can travel through your own Google Drive (see below).
- If you clear your browsing data or uninstall the app, locally saved reports are lost: use the copy, print or export functions to keep a copy elsewhere.
- The examination you are filling in and have not yet archived is kept as a draft in the browser, unencrypted, until you archive or discard it, so that it is not lost if the page closes by accident. On a shared computer, archive or discard the examination before leaving the workstation.
The archive key and the archive code
The archive is encrypted with a key created in your browser. So that you can find it on your other devices, a copy of the key is kept online only after being encrypted with the archive code you choose. The code never leaves your device and we do not know it: for this reason nobody — including the data controller — can open your key or your reports. For the same reason, if you forget the code we cannot recover it: you can choose a new one from a device where the archive already opens, or use the recovery key shown in Settings.
Accounts created before 11 November 2026. Previously the key was kept online without the protection of the code. The first time you open the updated application you are asked to choose the code: from then on the unprotected copy is deleted. Until you choose it, the earlier copy remains stored for your account.
Optional backup on your Google Drive
From Settings > Archive saving you can turn on an automatic backup of the archive to
your Google Drive account, in the folder Backup cifrato, file
copia-cifrata.csv: neutral names that reveal neither the content nor the
software. The file is encrypted (AES-256) with your archive key before it leaves
the device: Google stores only unreadable data and does not receive the key. The
transfer takes place directly between your browser and Google, without passing through
our servers. The application can see only the files it created itself
(drive.file permission). It is your choice and can be turned off at any
time; the file already saved stays on your Drive until you delete it. For the use of
Google Drive the terms of your Google account apply; for your patients' data you remain
the controller and you assess whether this use is appropriate.
Link with WoundCare
If you also use the WoundCare app and have saved its archive on your Google Drive, VascularReport can read it from your Drive, with your consent and only in your browser, to show wounds and photos next to the reports. In this case too the data do not pass through our servers. WoundCare has its own privacy notice, available from the app.
Department archives (restricted feature)
Only for doctors enabled on a department archive, a feature is available that sends to that archive the data the doctor chooses to transmit and keeps an encrypted copy there. It is a separate feature, not active for other users, and the related processing is governed by the healthcare organisation the archive belongs to.
Providers and data retention
To run the service we rely on two technical providers, acting as processors:
- Supabase — manages accounts, sign-in and passwords. The database is in the European region eu-west-1 (Ireland).
- Cloudflare — hosts the site (Cloudflare Pages) and stores your personal report settings and the encrypted copy of the archive key (Cloudflare KV). Cloudflare delivers the site through its international network.
Both providers are based outside the European Union: any transfer of data to third countries takes place on the basis of the safeguards provided by the GDPR (standard contractual clauses included in their data processing agreements and, where applicable, adequacy decisions).
If you turn on the optional backup described in section 3, the encrypted archive is also stored on your Google Drive, under a direct relationship between you and Google.
Account data and settings are kept for as long as your account is active; you may ask for their deletion at any time and we will do so within 30 days. Report data, as explained in section 3, neither pass through nor remain on these servers: their retention depends only on your device and your browser.
Your rights
As a data subject, you have the right to:
- access the personal data concerning you;
- ask for their rectification if inaccurate or incomplete;
- ask for their erasure;
- restrict or object to the processing;
- obtain their portability, where applicable;
- withdraw consent to the newsletter at any time, without affecting the lawfulness of processing carried out before withdrawal;
- lodge a complaint with the Italian Data Protection Authority (www.gpdp.it) or with the supervisory authority of your country if you believe the processing infringes the applicable law.
To exercise these rights, write to the address in section 1.
Changes to this notice
This notice may be updated over time, for example when new features or new providers are introduced. The date of the last update is shown at the top of the page; any significant change (for example the introduction of promotional communications through the newsletter) will be clearly highlighted.