Effective Date: September 27, 2026
Developer: M-PAX Group · App: Log4Surg (iOS, iPhone, iOS 17+, Bundle ID net.m-pax.Log4Surg)
Log4Surg is an offline-first operative logbook for UK surgical trainees: fast case entry with exact UK role terminology, ARCP-ready SAC and consolidation reports, validation tracking, and PDF/CSV export. It is designed so that we, the developer, do not operate a server, do not create accounts, and do not receive your logbook.
Short version:
- No developer account, no developer database, no advertising SDK, no analytics SDK, no tracking.
- No patient names — by design. The app has no field for patient names, addresses, NHS numbers or photos, and the database schema has no such columns. Permitted identifiers are hospital number and patient date of birth only.
- Your logbook stays on your device and in your own Apple iCloud Drive (automatic backups to the app’s own folder).
- Reports and case data leave the device only when you tap Share, Export or Print.
- The trainee is the data controller for their logbook; the app processes everything on-device and transmits nothing by itself.
1. Data we (the developer) collect
We collect nothing automatically. Log4Surg contains no third-party analytics, crash-reporting SDKs, advertising SDKs, session replay, or fingerprinting. Crash diagnostics are Apple-only. We do not sell personal data and we do not share personal data with data brokers.
The only personal information we ever receive is what you choose to send us yourself, for example if you email [email protected] for support. We use such messages only to answer you, and we delete them on request. A “Copy diagnostics” button in the app’s About screen copies only app version, iOS version, dictionary version and case count — never case contents — for you to paste into a support email if you wish.
2. Data you enter in the app — where it lives
Anything you record (trainee name, grade, specialty, deanery, programme/NTN, GMC number, placements, hospitals, consultants/supervisors and their GMC numbers, procedures, roles, urgency flags, operation parts, hospital numbers, patient dates of birth, notes, validation status, settings) is stored in two places, both under your control:
- On your device — the on-device database (SwiftData store) protected by iOS complete file protection (
NSFileProtectionComplete); sensitive fields (hospital number, patient date of birth, notes) are additionally encrypted with a key held in the Secure Enclave / keychain. Every feature works offline, including in airplane mode. - In your Apple iCloud Drive — automatic backups of the logbook to the app’s own iCloud Drive folder (your private iCloud, no developer server), plus manual “Export full backup” to Files. Backups count toward your Apple storage quota. If no successful backup exists for more than 14 days, the app shows a non-blocking backup-health reminder.
Apple processes iCloud Drive data under your Apple services relationship — please see Apple’s Privacy Policy for Apple’s handling. There is no developer backend, and no cross-device sync beyond your own iCloud Drive backup/restore. Deleting the app deletes the on-device data; your iCloud Drive backup archives remain until you (the account holder) remove them.
Restore replaces current data from an iCloud Drive backup only after explicit confirmation, and only after a final local backup is taken.
| Category | Examples | Stored where |
|---|---|---|
| Logbook content you enter | Procedures, roles (O/A/S-TS/S-TU/P/T), urgency, hospitals, consultants, placements, hospital numbers, patient dates of birth, notes, validation status | Your device + your iCloud Drive backups. Never on a developer server. |
| Trainee details you enter | Name, grade, specialty, deanery, programme/NTN, GMC number, ARCP date | Your device (+ included in backups and report headers you export). Never on a developer server. |
| Device-private settings | Appearance, app lock & PIN settings, notification choices, indicative-number targets, favourites | Your device only (backed up as part of your archive). Never synced anywhere else. |
| Data the app refuses to store | Patient names, addresses, NHS numbers, photos | Nowhere — no such fields or columns exist. CSV import rejects identifier-like columns (e.g. “patient_name”) with an explanation instead of importing them. |
3. Anonymisation guardrails (structural, not just policy)
- There is no field for patient name, address, NHS number or photo anywhere in case entry, and none in the data schema.
- The Notes field shows a persistent inline warning (“Never enter patient names or anything that could identify a patient — hospital number and date of birth only”). On save, a lightweight check flags common name patterns and asks for confirmation — a nudge, not a guarantee.
- Exported PDFs/CSVs contain only permitted fields. A share-safe export mode strips hospital number and date of birth for anything shown publicly (e.g. screenshots).
- Simulation must not be logged: the entry screen notes “Log real cases only — simulation doesn’t belong in your logbook.”
4. Data minimisation
Log4Surg deliberately does not ask for precise location, contacts upload, HealthKit data, or photo-library access. Logbook content is exactly what you typed — there is no enrichment, matching, or profiling. Reports are computed live on-device from your cases by a single aggregation function; nothing is uploaded for computation.
5. Device permissions
- Face ID / Touch ID & passcode — the optional app lock (with 6-digit PIN fallback, and an optional PIN gate for the Cases tab) protects records on your device. Biometric data never leaves the device and is handled entirely by iOS; the app only learns whether authentication succeeded.
- Notifications — all notifications are local and scheduled on-device: validation nudges (a supervisor with > 25 unvalidated cases, or any case unvalidated for > 30 days), an ARCP-prep reminder 6 weeks before your set ARCP date, and backup-health reminders. They are opt-in (validation nudges excepted as described in-app), and denying permission keeps all records fully usable.
- iCloud Drive — used only for the automatic backups and restore described in section 2. No iCloud backup, no restore; local data stays readable.
- Contacts, Photos, Calendar, Location, HealthKit — not requested.
6. Sharing and export (you send; the app never sends itself)
Log4Surg has no accounts, no messaging and no server upload. Case data and reports leave the device only through your explicit actions: the iOS share sheet (PDF reports, grouped-summary CSV, raw-cases CSV, full backup files), Print, or Save to Files. Nothing is transmitted anywhere by the app except through those actions you initiate.
A warning is shown before exporting raw cases: “This file contains hospital numbers and patient dates of birth.” PDFs carry an anonymisation footer (“Contains hospital numbers and dates of birth only — no patient names”).
Request-validation messages (per case, per consultant, or bulk) are composed in-app listing unvalidated cases — the app does not email silently; you send the message yourself.
7. CSV import
Import accepts the app’s own raw-cases CSV (round-trip) and an eLogbook-export mapping flow (pick file → map each column → preview 5 rows → import). Imports map only permitted columns; identifier-like columns are rejected with an explanation, future dates are rejected, and duplicates (same date + procedure + hospital number + date of birth) are offered as skip/review. Every imported case is tagged as a CSV import and starts unvalidated.
8. Relationship to elogbook.org, ISCP, JCST and GMC
Log4Surg is an independent companion tool. It does not sync with elogbook.org (no public API exists), does not write to ISCP, and is not affiliated with or endorsed by elogbook.org, ISCP, JCST or the GMC. It does not record WBAs (CBD / CEX / DOPS / PBA / MSF — those live in ISCP) and never claims OPCS-4 compatibility.
9. Purchases
The first release of Log4Surg contains no in-app purchase and no subscription: case entry, reports and export are fully available. If a future monetisation model is introduced, this policy and the App Privacy labels will be updated before release. Whatever model is chosen, records already logged will stay viewable and exportable.
Use of the app is governed by Apple’s Standard Licensed Application End User License Agreement: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/.
10. What we do NOT do
- No tracking across apps or websites (App Tracking Transparency: not requested).
- No third-party SDK network traffic — only Apple services the user chooses (iCloud Drive backup, App Store).
- No accounts, no sign-in, no backend storage of logbooks.
- No usage analytics and no advertising.
- No sale of personal data and no use of logbook content for advertising.
- No clinical decision-making: the app stores training records and computes report counts; it does not diagnose, triage or advise on patient care.
11. Apple privacy labels & manifest (for App Store review)
App Privacy: Data Not Collected applies to the developer. User-entered logbook content is stored by the user on-device and in the user’s own iCloud Drive at the user’s direction and is not collected by the developer. The app declares no tracking and includes no third-party SDKs. The app’s privacy manifest reflects this.
Notes for review: the app stores medical training records (operative experience), not patient-care data, and contains no patient names by design. Any “sign-in” or “passcode” in the app is the local app lock (Face ID / Touch ID with PIN fallback), not an account. All features work fully offline; no demo account or test server is needed.
12. Retention, export & deletion (your control)
- Export anytime: Reports tab and More → Data offer grouped-summary CSV, raw-cases CSV, report PDFs (with Print / Save to Files / Share), and full backup export.
- Correct: edit or delete cases freely (including validated ones, matching eLogbook behaviour). Editing a validated case marks it unvalidated again so validation must be re-requested, never silently kept.
- Delete: case deletion requires confirmation; “Reset all data” requires typing the trainee’s surname and offers an export first. Uninstalling removes on-device records; iCloud Drive backups remain until you remove them.
Because there is no developer account or database, privacy access/deletion requests are fulfilled by these in-app steps. If you need help, email us and we will walk you through them.
13. Security
Records are protected by iOS complete file protection, with sensitive fields additionally encrypted via a Secure Enclave / keychain key. The app lock engages on backgrounding after a configurable interval (default 60 seconds). Temporary export files are deleted after sharing or on next launch. Report numbers are produced by one audited on-device computation — the generation timestamp, scope, filters, dictionary version and case count are printed on every report so any number can be traced back.
14. Children
Log4Surg is intended for adult surgical trainees. We do not knowingly collect children’s data as a developer; any hospital numbers or dates of birth a trainee chooses to record are stored only on the trainee’s device / the trainee’s iCloud Drive as described above, and patient names cannot be recorded at all.
15. Changes to this policy
If privacy practices change (e.g. a future optional purchase or analytics feature), this page will be updated with a new effective date, and the app’s privacy manifest / App Privacy labels will be updated before release. Material changes will also be noted in release notes.
16. Contact
Developer: M-PAX Group.
Privacy / support: [email protected]
Support page: https://m-pax.net/log4surg.html
If you are in the UK/EU and have a data-protection question, include “Log4Surg privacy” in the subject line and we will respond. Since we hold no developer-side account data, most requests are resolved with the in-app export / delete steps in section 12. The trainee remains the data controller for their logbook.