TRACE — Privacy Policy

Last updated: 5 August 2026

TRACE is a personal logbook for doctors — a place to record the cases, procedures and activities that go into an appraisal or portfolio.

This policy explains exactly what happens to what you put in it. It is written to be accurate rather than reassuring: where something leaves your device, it says so plainly.

The short version

• Your logbook stays on your devices and in your own iCloud. We never receive it, and we cannot read it.
• There is no account, no password and no sign-up. We do not know who you are.
• We collect no analytics, no usage statistics and no crash reports. There is no tracking of any kind in this app.
• If you dictate, your voice is sent to Google to turn speech into filled-in fields. That is the one time your words leave your device, and TRACE asks you to agree before it happens.
• Do not record anything that identifies a patient. TRACE is designed so it never needs it.

Who is responsible for your data

You are. Your logbook is yours: it is stored on your devices and synced through your own Apple iCloud account. It never reaches our servers, so we are not in a position to access, disclose or delete it — only you can.

TRACE is provided by Suleman Mulla, an individual developer — not a company — contactable at privacy@tracelogbook.com.

Note for professional and organisational users: if you record any information about identifiable patients, you are likely acting as a data controller for it under UK GDPR, and your own employer's information governance rules apply. TRACE is built so you do not need to record such information at all.

What TRACE stores, and where

On your device

Everything you enter — your logbook entries, your professional profile (name, role, specialty, rotation, hospital, registration number), and your settings.

These are stored inside the app's own private storage area, which other apps cannot read. Logbook files are written with full file protection, meaning they are encrypted by the operating system and unreadable while the device is locked.

In your iCloud

If you turn on sync, your entries are copied to the private database of your own iCloud account so that your iPhone, iPad and Mac stay in step. This is your personal Apple storage. We have no access to it. Your professional profile syncs the same way.

Apple's handling of iCloud is governed by Apple's Privacy Policy.

You can turn sync off at any time in the app.

What we receive

Nothing from your logbook. Ever.

The only server we operate is a small service that checks whether your subscription is valid and, if it is, issues a short-lived pass allowing the assistant to work. That service:

• receives a subscription identifier from Apple and your IP address, as any internet request necessarily does;
• keeps no logs at all — logging is switched off;
• briefly stores a count of sessions started in the current hour, keyed to your subscription identifier, purely to stop a stolen pass running up a bill. These counters delete themselves after two hours and contain nothing else;
• never receives, and cannot receive, anything you record in the app.

The AI assistant, and what it means for your privacy

TRACE can fill in your logbook while you talk. To do that it uses Google's Gemini, which requires sending what you say to Google.

When you type

TRACE removes identifiers before sending — names, NHS numbers, dates of birth, postcodes and hospital numbers are stripped out automatically.

When you speak

Your audio is sent to Google as you say it. It cannot be filtered first, because there are no words to check until after the audio has gone. TRACE shows you this warning before it ever opens the microphone, and you must acknowledge it once before dictation will work.

This is why you should never say anything that identifies a patient. Say "a 74-year-old admitted with chest pain", not a name, date of birth or hospital number. A logbook records what you did; it does not need to record who it was done to.

What Google does with it

Our Gemini access is on a paid Google Cloud account, and we have signed Google's Cloud Data Processing Addendum. Under those terms Google does not use what you send to train or improve its models, and it is not reviewed by people. Google acts as a data processor and may process the data outside the UK under the standard contractual clauses in that agreement.

Google's terms: Google Cloud Privacy Notice

If you would rather not

The assistant is entirely optional. You can:

• choose "Fill it in by typing instead" when the warning appears;
• mute the assistant at any time by tapping the mark at the top of the screen;
• turn it off permanently in Settings.

TRACE works fully as a manual logbook with the assistant switched off, and in that mode nothing you write ever leaves your device except through your own iCloud.

Exports

You can export your logbook as a PDF or an Excel file.

Before writing the file, TRACE checks it for anything that looks like a patient identifier and tells you what it found, so you can choose to remove it. It shows you counts, never the identifiers themselves.

Export files are written to temporary storage with full file protection and are deleted when the app next starts. Once you share a file, it is beyond our reach and yours — treat an exported logbook as you would any other document containing professional information.

Deletion and retention

You can delete an individual entry, empty the bin immediately, or use Delete everything in Settings, which clears your entries, the bin and any unfinished draft across all your devices.

Deleting the app removes everything stored on that device. To remove synced data, delete everything from within the app first, or remove TRACE's data from your iCloud settings.

Support requests

If you report a problem, TRACE prepares an email to us containing a technical summary: the app version, your device model and operating system, whether the assistant is on, which voice you use, and the number of entries in your logbook — not their contents. It may also attach a connection log recording timings and audio routing.

These contain nothing you have written and no patient information. You can read the whole message before you send it, and edit or delete any part of it.

We only receive this if you choose to send it.

Payment

Subscriptions are handled entirely by Apple. We never see your card details, billing address or name — only an anonymous identifier confirming that a valid subscription exists.

Apple's handling is governed by Apple's Privacy Policy.

Security

• Logbook data is written with full file protection (encrypted at rest, tied to your device passcode).
• Optional App Lock requires Face ID, Touch ID or your passcode to open the app. This protects the screen; the encryption above protects the data.
• Sensitive settings are stored in the system Keychain.
• All network connections use HTTPS.
• The app contains no third-party code, no advertising libraries and no tracking software of any kind.
• No API keys or credentials are stored inside the app.

No system is perfectly secure. If you believe you have found a security problem, please write to privacy@tracelogbook.com.

Your rights

Under UK and EU data protection law you have rights of access, correction, erasure, restriction, portability and objection.

Because your logbook is held on your own devices and in your own iCloud, you exercise most of these directly: you can view, edit, export and delete everything from within the app, without asking us.

For anything we do hold — which is limited to the short-lived subscription counters described above — or to complain, write to privacy@tracelogbook.com.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Children

TRACE is intended for qualified healthcare professionals and is not designed for or directed at children.

Changes to this policy

If this policy changes in a way that affects how your information is handled, the change will be noted in the app before it takes effect. The date at the top always shows the current version.

Contact

privacy@tracelogbook.com