Privacy policy

What Echo Wizard keeps about you, why, for how long, and how to get a copy or have it removed.

Who is responsible

Echo Wizard (echo-wizard.com and app.echo-wizard.com) is run by Diogo Martins, who is the data controller for the information described here. For any privacy question or request, email the contact address (switch on JavaScript to see it).

What we keep, and why

Information	Why	Lawful basis
Email address and a hashed password	To create the account, sign you in and send account emails such as confirmation and password reset.	Contract
Membership status, renewal date and Stripe customer reference	To know whether the tools should open for you.	Contract
Referral code, who referred you and who you referred	To add the free days the referral scheme promises.	Contract
Sign-in sessions with the device's IP address and browser name	To keep you signed in and protect the account.	Contract and legitimate interests (security)
Sign-in attempts and an account audit trail, with IP addresses	To stop password guessing and investigate misuse.	Legitimate interests (security)
Which tool you used, and when	To see which tools are used, so the right ones get attention. The numbers you typed are not part of this record.	Legitimate interests (improving the service)
Where you came from when you signed up, such as the home page or a tool page	To see which pages bring members in.	Legitimate interests (improving the service)

Measurements and patient information

The clinical tools send what you type to the server to draft the report text. That calculation is not kept as a record: once the text comes back to your screen it is gone from the server. Echo Wizard is not a place to store a study.

Most tools need numbers only. Do not type patient names, dates of birth or hospital numbers into a tool unless the field asks for it. When you use a tool that does ask, such as the message to a referring doctor, you are responsible for having a lawful basis to use that information, and it is still not stored.

Auto EF. If you choose to analyse a cine loop with Auto EF, the clip is sent to an external analysis service (autoef.mycardiac.co.uk) and the result comes back to your screen. DICOM files are rebuilt before they leave Echo Wizard, keeping only the imaging data needed to play and time the loop, so names, IDs, dates, institutions and private tags are not sent. Text burned into the pixels of the video is not removed. Crop or mask it before uploading, or export a clip without it.

Who else handles it

Stripe takes card payments and stores your card details. Echo Wizard never sees your full card number. See Stripe's privacy policy.
An email delivery provider sends account emails on our behalf. It receives your email address and the content of the email.
Hosting providers run the website and the app, and may keep short technical logs such as IP addresses for security and reliability.
The Auto EF analysis service, only for clips you choose to send, as described above.

Some of these providers may process data outside the UK. Where they do, they rely on safeguards recognised under UK law, such as adequacy regulations or the UK International Data Transfer Agreement. We do not sell your information and we do not use advertising or tracking cookies.

Cookies

The members app sets one cookie, which keeps you signed in. It is strictly necessary for the service, so it does not need consent. This public website sets no cookies.

How long it is kept

Account, membership and referral details: while the account exists.
Sign-in sessions: until they expire or you sign out.
Sign-in attempts: 90 days.
Audit trail and tool usage: 2 years.
Password reset and confirmation links: until used or expired.
Backups: the last 30 nightly copies, so removed data leaves the backups within about a month.
Payment records held by Stripe: as long as the law requires for tax and accounting.

When you delete your account, your details, sessions, usage and referrals are removed. Audit entries that concerned the account keep only an internal number, not your email.

Your rights

You can ask for a copy of your information, have it corrected or erased, object to its use for legitimate interests, or ask us to restrict its use. Two of these you can do yourself on the account page in the app: Download my data gives you everything stored about you as a file, and Delete my account stops billing and erases the account. For anything else, email the contact address (switch on JavaScript to see it) and we will reply within one month.

If you are unhappy with how your information is handled, you can complain to the Information Commissioner's Office. We would appreciate the chance to put it right first.

Changes

If this policy changes in a way that matters, members will be told by email before the change takes effect. The date at the top shows the latest version.