FAP Tracker on DHIS2FAP Tracker on DHIS2 ("the app") is a mobile app for health workers and students who record household health information in a DHIS2 tracker programme. It was built first for the Family Adoption Programme. The app is published by LibreHealth ("we", "us"). This policy explains what the app does with information, on the phone and when it talks to a server.
- Who is responsible for the records
- What the app handles
- What the app does not do
- Services from other companies
- How the phone keeps records safe
- How long information is kept
- Your choices and rights
- Children
- Changes to this policy
- Contact
Who is responsible for the records
The app has no server of its own. It sends records only to the DHIS2 server you sign in to, which is run by the organisation that gave you your account. For the Family Adoption Programme, that server is fap.plhi.us.
That organisation decides what is recorded, who can see it and how long it is kept, and it is responsible for the records under the law that applies to it, such as India's Digital Personal Data Protection Act, 2023. Families whose information is recorded, and anyone with a question about the records themselves, should contact that organisation.
The app sends nothing to us. The App Store and Google Play may give us summary statistics about installs and, if you allow it in your phone's settings, crash reports. Apple's and Google's own privacy policies cover those.
What the app handles
Your sign-in details
Your server address, username and password, which you get from your organisation. Accounts are created by the organisation; there is no public sign-up. The app keeps your password in the phone's secure storage (the iOS Keychain or the Android Keystore), never backs it up, and sends it only to your server.
If your organisation has set it up, you can sign in with Apple, Google or Microsoft instead. You sign in on that company's own page, it confirms your email address to your server, and your server matches the address to your account. The app then keeps only the access token your server issues, in the same secure storage.
The records you enter
The households, family members, visits, assessments and photos you record, with the fields your programme asks for. These can include names, dates of birth, phone numbers, addresses and health information. The app keeps them on the phone in an encrypted database and sends them to your server over an encrypted connection (https) when you sync. It also downloads the records your account is allowed to see, so that you can work without a connection.
Photos
Photos you take or choose for a field, such as a signed consent form. Before a photo is kept, the app removes its camera details, including the place where it was taken.
A short sync report
After each sync the app sends your server a report with counts of records, sync states and times, your user ID on that server, and the versions of the app and of the phone's system. It contains no record contents. Your organisation uses it to help you when something goes wrong.
What the app does not do
- It shows no advertising and contains no analytics or crash-reporting services.
- It does not track you across other apps or websites.
- It does not use your location, contacts or microphone. It uses the camera and photo library only when you take or choose a photo or scan a QR code.
- It does nothing in the background. It syncs only while it is open.
- We do not sell, rent or share information. We do not receive the records in the first place.
Services from other companies
- Apple, Google and Microsoft sign-in, only if you choose it. The company shares your email address with your server under its own privacy policy.
- Google ML Kit, on Android only. The QR code scanner, used to read a server address, comes from Google's ML Kit. It works on the phone, so the code it reads stays there. ML Kit does send Google diagnostic and usage information: device and app details, identifiers, performance and error codes. On iPhone, the scanner uses Apple's own framework on the phone and sends nothing.
- The App Store and Google Play, which install and update the app under Apple's and Google's privacy policies.
How the phone keeps records safe
- Records are kept in a database encrypted with AES-256 (SQLCipher). Its key is in the phone's secure storage and is never backed up.
- Records and photos are excluded from iCloud and Android backups.
- Photos are kept in the app's private storage, protected by the phone's own file encryption.
- The app opens only with the phone's own lock: passcode, face or fingerprint. It locks when it is opened and after 5 minutes in the background, and it will not open on a phone without a passcode.
- The app hides its screen whenever it is not in front, so the app switcher shows no records.
- The app talks only to https addresses.
- If your server has not accepted your login for 30 days, the app hides all records until a sync reaches the server again. When your organisation disables your account, the phone can no longer sync.
How long information is kept
- On the phone: until you log out. Logging out removes all records, photos and sign-in details from the phone. So that no work is lost, the app does not let you log out while some records have not reached the server. Uninstalling the app also removes everything it kept.
- On the server: for as long as your organisation decides.
- Your account: you can ask for it to be deleted. We delete it within 30 days. The household records you entered belong to the programme and stay with it.
Your choices and rights
- To see, correct or delete records about a family, contact the organisation that runs the programme. It holds the records and decides on such requests under the law that applies to it.
- To delete your own account, use the account deletion page or ask your programme's administrator.
- To stop using the app on a phone, sync, then log out in Settings, or uninstall the app.
- For questions about the app itself, contact us.
Children
The app is meant for health workers and students, not for children. Records about families can include children; the programme collects them under its own consent process.
Changes to this policy
When the app changes what it does with information, we update this page and the date at the top.
Contact
LibreHealth, gitlab.com/librehealth
Email: sunbiz@gmail.com