Security and privacy at Capnolog

What does the app store?

Your case entries, your notes and your plans, on the phone, encrypted at rest and able to be locked behind Face ID. The log records the kind of case, never whose: there is no field for a name, an MRN, or a birthday, which is a design fact rather than a policy you have to trust.

The fields that can hold patient context — your private note, your plans, and your attending and specialty notes — are encrypted a second time, each under its own key, and those keys stay on the device.

What leaves your device, and when?

Backup and sync go to your own iCloud, on one switch in Settings that is on by default and that you can turn off at any time. Plans and notes ride along only after you confirm once. That backup restores to a new phone, and it is yours rather than ours.

The iCloud backup is end to end encrypted: each one gets its own key, sealed under a master key that lives only in your iCloud Keychain, so only your own devices ever hold it.

What reaches us is an id and your program, never your name — plus your account when you sign in, and anything you send to support. De-identified case counts and usage analytics each sit behind their own switch in Settings.

Every lane that carries anything of yours requires an install that can prove, using the device's own hardware attestation, that it is a genuine Capnolog app on a genuine device.

What can the Chrome extension do, and what can it not?

It prefills the official ACGME Case Log form, one case at a time, inside your own ACGME account in your own browser and at your direction. It never presses Submit or any other save control. You read each field and you press Save.

Three of those are hard invariants rather than intentions, each pinned by a test or a CI gate: it never saves, our backend never contacts acgme.org, and no ACGME credential ever leaves your browser. It never handles your ACGME password and never signs in for you.

One thing does travel, and only if you ask for it: the one-time history import sends your own already-filed ACGME entries, de-identified, to our server so your phone can pull them into your log. They are excluded from every statistic.

The extension is not approved, authorized, or endorsed by the ACGME. We built it, we maintain it, and we have no arrangement with them about it.

How do you report a security issue?

Email support@capnolog.com with “Security report” in the subject, or read /.well-known/security.txt, which is the machine-readable version of the same thing.

We acknowledge within two business days and triage within 24 hours of confirming a real issue. We will not pursue a good-faith researcher who stays inside their own accounts and data, avoids privacy violations and service disruption, and gives us a reasonable time to fix before disclosing.

Please do not test against other users, and never put patient information in a report.

No system is perfectly secure, and we will not tell you otherwise. If a breach affects your data we notify the people and regulators the law requires, in the time it requires, and the controls behind the claims on this page are written down in a security policy rather than only here.