By default, FieldMedic transmits nothing. All information you enter stays on your device, and FieldMedic does not collect, transmit, or store any personal data. (Three narrow exceptions, all described below: a purchase record if you buy through a partner web checkout, an optional security contact address, and the email you confirm to open the Records Portal on a computer.)
If you choose to enable the optional FieldMedic Beacon cloud features (cloud backup, team sync, the records portal), your records are transmitted and stored end-to-end encrypted — encrypted on your device with a key that never reaches us, so neither FieldMedic nor its hosting provider can ever read them. Details in the Beacon section below.
All data entered into FieldMedic — including patient records, vital signs readings, team member details, and kit lists — is stored locally on your device using your device's native storage.
Unless you enable the optional Beacon cloud features (below), this data is not sent to any server, shared with any third party, or accessed by the developer.
On iOS, locally stored data benefits from Apple's hardware-level encryption when your device is locked.
Beacon is an optional subscription that keeps an encrypted copy of your records in the cloud: automatic backup, sync across your team’s devices, and access from a computer via the Records Portal — where you can review and export your records, and import a participant roster from a spreadsheet before a trip. Nothing is uploaded unless you turn these features on, and you can turn them off at any time (your on-device records are unaffected).
End-to-end encryption. Before any data leaves your device it is encrypted (AES-256) with a key derived from a code — your personal recovery code or your team's join code — that is exchanged directly between your devices and never sent to our servers. As a result, neither FieldMedic nor its hosting provider can read your synced data: the cloud stores only unreadable ciphertext, plus limited non-clinical routing labels (a team identifier, a device identifier, timestamps) and the names/roles users declare in team access logs.
Opening the Records Portal. To open your records on a computer you confirm your email address with a six-digit code, then enter your team code. We do this so the team’s access log records a verified address rather than a typed name — every member can see exactly who opened the records, and when. That address is stored with our authentication provider and in the team’s access log. Signing in on a phone does not require an email address.
Where it is stored. Encrypted data is hosted in London, United Kingdom on managed infrastructure provided by Supabase, acting as a sub-processor under a signed data processing agreement. Your data does not leave the UK.
Roles under UK GDPR. When you enable Beacon, you remain the data controller for any patient data you record; FieldMedic acts as your data processor, processing only encrypted data on your instructions. You are responsible for having a lawful basis (and, for health data, an Article 9 condition) to record and share that data, and for sharing join codes and recovery codes only with authorised members of your team. Our Data Processing Agreement sets out the Article 28 terms that apply, and forms part of the Beacon Terms. A copy for your records is available from hello@fieldmedic.app.
Security contact (optional). Beacon accounts are anonymous by default, which means that if there were ever a security incident affecting your stored data we would have no way to reach you. The person who created a team can therefore choose to give us one email address for that purpose. It is optional — everything works without it.
Unlike your records, this address is not encrypted, because we have to be able to read it in order to write to you. For this one address FieldMedic Ltd is the data controller (not your processor), and the only lawful purpose is contacting the team about the security of its data. We do not use it for marketing, we do not share it, and removing it in Settings → Cloud Sync → Security contact deletes it.
Recovery codes. For your privacy, we cannot recover lost codes. If your whole team loses its codes, the encrypted cloud copy is permanently unrecoverable — your on-device data and exported backup files are unaffected.
Stopping and deletion. Turning off backup or leaving a team stops syncing immediately. To have stored encrypted data deleted, contact hello@fieldmedic.app.
FieldMedic does not use any analytics, advertising, crash reporting, or user tracking of any kind. No data about your usage of the app is collected or transmitted.
FieldMedic Pro is a one-time purchase. Depending on where you buy it the payment is handled by a different provider, and in every case FieldMedic never receives or stores your card or bank details.
If you buy through the partner web checkout, we do hold a record of that purchase, because we have to be able to unlock Pro when you sign in. That record is your email address, the partner code you used, a payment reference from Stripe, and the dates. For these purchase records FieldMedic Ltd is the data controller. Signing in also stores your email address with our authentication provider, Supabase. We keep both for as long as your Pro access is valid, so that your purchase can be restored on a new device. You can ask us to delete them at hello@fieldmedic.app — note that doing so also removes your ability to restore Pro.
Buying in the app on iPhone or Android requires no account and no email address, and we hold no purchase record of our own.
Purchase status is verified through RevenueCat, a third-party service, which stores a device identifier to check your entitlement. For purchases made in the app that identifier is anonymous and is not linked to any information identifying you. For a partner web purchase it is linked to your email address in the purchase record described above, which is what allows signing in to restore your access. You can view RevenueCat’s privacy policy at revenuecat.com/privacy.
Patient records and medical information entered into the app are stored on your device, and are transmitted only if you enable the Beacon cloud features — in which case they are end-to-end encrypted before leaving your device, as described above.
You are the data controller for any patient information you record, and are responsible for ensuring its appropriate handling in accordance with UK GDPR, EU GDPR, or any other applicable data protection laws in your jurisdiction. When Beacon is enabled, FieldMedic acts as your data processor for the encrypted data it stores on your behalf; when Beacon is not enabled, FieldMedic processes no patient or clinical data at all. The only personal data we hold in our own right is the purchase record described under Purchases above (and then only if you bought through the partner web checkout), the optional security contact address, and the email address you confirm when opening the Records Portal.
FieldMedic Ltd (registered in England & Wales, company no. 17375229, registered office Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE) is registered with the UK Information Commissioner’s Office under registration C2006592.
The app provides an optional data export feature that saves a backup file to your device. This file is created locally and is only shared if you choose to share it yourself. You are responsible for the handling and security of any exported files containing personal data.
FieldMedic is intended for use by trained medical professionals and is not directed at children under the age of 13.
Any updates to this privacy policy will be reflected on this page with an updated date.
If you have any questions about this privacy policy, please contact: hello@fieldmedic.app
FieldMedic is a clinical reference tool for trained medics. It supports, and never replaces, the clinical judgement of the practitioner using it.