Privacy policy

1. Purpose and current use

The utility creates encrypted recovery copies of an authorised CAM installation, stores them in the operator’s Google Drive and downloads verified copies to the operator’s computer.

The current installation is a fictional-data pilot. This policy does not authorise the import of patient records or replace a healthcare practice’s privacy notice, consent process or record-retention obligations.

2. Data and permissions

The Google connection requests drive.file: access to Drive files created by, or explicitly used with, this app. It does not request whole-Drive, Gmail, Google Photos or Contacts permissions.

The installed jobs are pinned to a dedicated CAM backup folder. Within that folder, they access encrypted archive bytes, file and folder identifiers, filenames, sizes, modification dates, checksums and a folder-verification marker. They also read Google Drive storage-quota information.

Encrypted archives contain the selected CAM application’s database, files, retained output versions, software and recovery-related configuration. This can include confidential application credentials inside the encrypted archive. The backup process reads the source files on the server to create that archive; a deliberate recovery operation decrypts a selected copy on the operator’s computer.

Google authorisation tokens are retained on the server and the operator’s computer to permit unattended transfers. The backup utility uses Google data only for the backup, verification, retention, recovery and storage-capacity functions described here.

It does not sell Google data, use it for advertising, send it to AI models or use it to train AI models. CAM encrypted backups’ use of Google API data is limited to these functions in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

3. Storage, providers and access

• Private server: the active CAM installation and temporary encrypted backup copies are on a Hostinger VPS in Malaysia. Active application files are available to the application and authorised server administrators.
• Google Drive: encrypted backups and verification metadata are kept in the operator’s private Google Drive folder. Google’s service terms and infrastructure govern its storage locations.
• Operator’s computer: encrypted backup copies, connection credentials and status information are held in restricted Windows folders. An intentional recovery test also creates a separate decrypted copy in restricted local storage.

Backup archives are encrypted before transfer to Drive. Filenames, sizes, dates and verification metadata are not encrypted by that archive encryption. Transfers use encrypted network connections.

The private recovery key is kept separately from the VPS and is not uploaded by the backup job. Protecting a separate recovery-key copy is the operator’s responsibility.

Folder permissions restrict local access to the operator’s Windows account, SYSTEM and administrators; VPS credentials are root-restricted. These controls do not make a compromised administrator account or device safe. The operator can intentionally decrypt a recovery copy using the key.

Hostinger and Google process information as infrastructure providers for these functions. The utility does not share backup folders publicly or give unrelated third parties access. This does not change any infrastructure provider’s technical access to the systems it operates.

4. Retention and deletion

The configured recovery history keeps all four-hour copies for seven days, plus the newest available copy for 30 daily, 12 weekly and 12 monthly recovery periods. A single archive can satisfy more than one period. The server’s transfer-staging area keeps two recently uploaded copies; the computer keeps its own managed recovery history.

These periods apply to backup copies, not original notes or source records. The utility does not delete original consultation records as part of rotation.

Expired managed Drive copies move to Google Drive Trash rather than being immediately purged by the utility. Google’s Trash rules and storage accounting still apply. Local rotation removes only eligible files in the dedicated managed-copy directory.

Removing a file from Drive does not automatically erase an already downloaded copy, a separate manual backup, an isolated restore, a provider snapshot or an original record. The operator must handle each location separately. Revoking Google access does not delete existing copies or the locally saved connection configuration.

5. Your controls and recovery limits

The authorised account holder can review or revoke the connection through Google Account connections. The operator can also stop the backup schedules and remove credentials or copies from the relevant locations.

New transfers stop when authorisation is no longer valid. Existing encrypted copies remain available, subject to the account’s own access and storage rules, but require the recovery key to decrypt. Losing every usable key copy can prevent recovery.

Storage limits, network failures, provider availability, laptop sleep and expired permissions can prevent new copies. The utility records backup status and errors; its current pilot does not send automatic failure alerts.

6. This information website

These pages have no sign-in, forms, uploads, advertising, analytics, tracking scripts or application cookies. Visiting them does not grant Google Drive access.

Normal web requests disclose connection information, such as the visitor’s IP address and requested page, to the hosting infrastructure. Infrastructure providers may retain technical connection and security logs under their own policies. These pages do not maintain a visitor profile or a separate visitor database. Following an external link uses that provider’s website and policies.

7. Contact, corrections and material changes

The operator is Tom McGee. Questions about access, correction, deletion or this policy can be sent to tmcgee1994@gmail.com. Do not include recovery keys, passwords or patient information in an initial support message.

Material changes to data access or use require updated disclosures and the account holder’s authorisation before the changed use begins. The version date identifies this policy text.

Version 14 November 2026.