Настоящая политика опубликована компанией iDataMap Corporation Pty Ltd и идентична политике на странице idatamap.com/privacy. Официальный текст — на английском языке.
Privacy Policy
1. Who we are
WaveMed and vWaveMed (the “Apps”) are published by iDataMap Corporation Pty Ltd (ACN 126 872 580 · ABN 14 126 872 580), Australia (“iDataMap”). This part of the policy covers both Apps on Android and iOS.
Part 2 of this page is iDataMap’s corporate privacy policy for our websites and cloud-connected services. It describes a different system; within the Apps it applies only to the optional Cloud Portal described in section 6, and to nothing else. Where the two parts differ in scope, Part 1 governs the Apps and Part 2 governs the portal service.
2. What the Apps do with your information
The Apps let you record personal medical information — such as allergies, medical conditions, medications, immunizations, care notes, documents, photos and emergency contacts — and carry it with you, stored on your device and written to your own RadPatch, RadTag or RadCard NFC tag so that it can be read in an emergency.
All of this information is processed and stored locally:
On your device — in the App’s private storage, protected by your device’s security. You can additionally enable an app lock using your device’s own biometric or PIN; this authentication is handled entirely by your device.
On your NFC tag — encrypted with AES-256 before it is written. The tag is a storage medium that you own and physically control.
The Apps also keep small amounts of convenience data on your device only: your recent place searches (up to ten entries, so you can re-select a place quickly) and a cache of map tiles you have already viewed (so the map still displays offline). Neither ever leaves your device.
None of the record-keeping features described in this section transmit anything to iDataMap: we operate no server that receives, stores or processes the records you keep in the Apps. The one server-connected feature — the optional Cloud Portal — is described separately in section 6. The Apps embed no third-party advertising, analytics or tracking SDK, and no third-party software development kit of any kind — no outside code runs inside the Apps.
3. Sharing is always your action
The Apps include features that let you share information yourself — for example, sharing a report PDF, or sharing your current location with a note through the system share sheet (SMS, WhatsApp, or another messenger you choose). Such sharing happens only when you explicitly initiate it, only with the recipients you choose, and through apps under your control. The Apps never share anything automatically.
Likewise, if you choose a ride service (for example Uber, or a local taxi or map app suggested for your country) from the map screen, the App simply opens that provider’s app or website with the destination point you picked. Any account, booking or payment happens entirely within that provider’s service, under that provider’s own privacy policy.
This is a hand-off, not an integration: no ride or navigation provider’s code, SDK or library is built into the Apps, nothing is installed on your device by us, and no information ever flows back from that provider into WaveMed or vWaveMed.
4. Device permissions and how they are used
NFC — to read and write your RadPatch, RadTag or RadCard tag. · Location — to display your position on the map, show nearby healthcare facilities, calculate a route and travel time, and let you share a location you choose. Your location is processed on the device and leaves it only in the ways described in sections 3 and 5. · Camera / Photos — to attach pictures or documents to your local records. · Calendar — to add medication or appointment reminders to your device calendar at your request. · Biometrics — for the optional local app lock. All permissions are optional at the operating-system level and are used solely for the features described.
5. Network use: map content and lookups — never your identity or health data
The Apps work fully offline for their core purpose. When you use the map features, the App makes standard, account-less web requests so the map can be drawn and your searches answered. Each request contains only the technical minimum needed to fulfil it — the map area being viewed, the text you typed into the place search box, or the coordinates you asked to route between — together with an IP address, like any internet request. These requests contain no name, no account, and nothing from your health records, and they go directly from your device to the service concerned; iDataMap operates no server in between and receives nothing.
The services used, depending on app version and the feature you use, are: map tiles from OpenStreetMap (openstreetmap.org), MapTiler (maptiler.com) and, for satellite imagery, Esri (esri.com); place search and typing suggestions from Nominatim (OpenStreetMap Foundation), Photon (komoot GmbH) and MapTiler geocoding; nearby healthcare places from the Overpass API (OpenStreetMap data); routes and travel times from OSRM (Project OSRM). In the MapTiler edition, when you share a location, the App may also fetch a small map image of the point you chose from MapTiler so the picture can accompany your message. Converting coordinates into a readable address is performed by your device’s built-in geocoding service (provided by Apple or Google as part of the operating system). These are ephemeral, real-time content requests processed under each service’s own privacy policy; none of them involves an account or an identifier linking the request to you as a person. Where a map or search service is accessed under an iDataMap API key (the MapTiler edition), that provider records only aggregate request volumes for billing; it does not give iDataMap any user-level data. Help pages or product information may also be loaded from idatamap.com.
6. The optional Cloud Portal — the one server-connected feature
The home screen contains a Cloud Access button. It opens the RadCard patient portal (radcard.idatamap.com) — a server-backed service operated by iDataMap — in a browser window inside the App. The portal is the same service you could reach in any web browser; the App simply provides a convenient way to open it. It is entirely optional: every record-keeping, NFC, map and report feature of the Apps works fully without it, and nothing connects to the portal until you tap Cloud Access and sign in.
What is transmitted. To sign you in, the App sends the e-mail address and date of birth you enter as your portal credentials to radcard.idatamap.com over an encrypted connection (HTTPS/TLS). For your convenience these sign-in details are also saved on your device so you do not have to retype them; you can remove them by clearing the App’s data. Once you are signed in, the documents and information you view, upload or send inside the portal are processed by the portal service under Part 2 of this page.
No automatic synchronisation. The Apps never upload your on-device records to the portal by themselves. The local record store and the portal are separate systems; information moves between them only when you yourself upload or download it while signed in.
Accounts. Portal accounts cannot be created in the Apps: they are provisioned with cloud-enabled RadCard products and services. To close a portal account or have its data deleted, use the portal itself or contact dev@idatamap.com; Part 2, sections 11 and 12, describe retention and your rights for portal data.
7. Data retention and deletion
Because your data exists only on your device and your tag, you are in full control of it. You can edit or delete records in the App at any time, erase or rewrite your NFC tag from within the App, and remove all app data — including the recent-search list and the offline map cache — by deleting the App. iDataMap holds no copy and therefore cannot access, restore, or delete your data for you. Deletion of portal data is described in section 6 and Part 2.
8. Children
The Apps are intended for users aged 18 and over, and are not directed to children. We do not knowingly collect information from anyone — including children — because the Apps’ record-keeping features transmit nothing to us and portal accounts are provisioned only to adults. A parent or guardian may of course record information about a family member in their own care on their own device and tag; that information remains under the guardian’s local control as described above.
9. Not a medical device
The Apps are information-management tools. They are not a medical device and do not diagnose, treat, cure, or prevent any medical condition. Always consult a qualified healthcare professional for medical advice.
10. Changes to this policy
If a future version of the Apps changes how data is handled (for example, an optional cloud backup), we will update this policy before that version is released and, where required, ask for your consent in the App.
11. Your rights, and how to complain
Because we never receive the information you store in the Apps’ local records, iDataMap does not act as a data controller for that content. The privacy rights you have under the Australian Privacy Act 1988 (Cth), the GDPR and comparable laws — access, correction, export and erasure — are exercised directly by you, in the App and on your own tag, with no request to us required. For information you submit through the optional Cloud Portal, iDataMap is the data controller and your rights are exercised as described in Part 2.
We do not sell or share your personal information, and we do not use it for advertising or tracking.
If you have a privacy question or concern, contact us at dev@idatamap.com. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. Users in the EEA or the United Kingdom may also lodge a complaint with their local data protection supervisory authority.
12. Contact
iDataMap Corporation Pty Ltd (ACN 126 872 580 · ABN 14 126 872 580)
Suite 14, Cnr Calley Drv & South St, Leeming WA 6149, Australia
Email: dev@idatamap.com
Web: www.idatamap.com
1. Introduction and corporate scope
This part outlines how iDataMap Corporation Pty Ltd (“the Company”, “we”, “us”, “our”) collects, processes, protects and manages Personal Information across our websites — including idatamap.com, iTeleCONSULT and radcard.com — and our cloud-connected services, including the RadCard and RadPatch platforms (collectively, “the Services”).
1.1 On-device product lines
The WaveMed and vWaveMed applications run entirely on your own hardware. The Company does not collect, track or store your location data or telemetry on external servers, and your information never leaves your device unless you choose to send it — or sign in to the optional Cloud Portal, which is part of the Services this part governs. The specific terms for those applications are set out in Part 1 of this page, which forms an integral part of this policy and governs the Apps wherever the two parts differ.
1.2 Scope
This part governs the information collected, processed or stored about you through your use of the Services, and details the categories of information collected, the bases and methods of processing, the parties to whom information may be disclosed, the rights and settings available to you, and the safeguards we apply.
1.3 Medical disclaimer (not a medical device)
Our hardware products and software applications are administrative and informational data-management tools. They are not medical devices. They do not diagnose, treat, cure, mitigate or prevent any medical condition. Users must consult a qualified healthcare professional for all medical advice, diagnoses, prescriptions and treatment plans.
1.4 Amendments and updates
We review and update this policy periodically to reflect changes in our practices, product updates or evolving privacy laws. Your continued use of the Services after an update is posted constitutes acceptance of the revised terms.
2. Categories of information we may collect and process
2.1 Definitions
- “Personal Information” means information about an individual, or from which an individual is directly or indirectly identifiable, matching the definitions in the Australian Privacy Act 1988 (Cth) and the General Data Protection Regulation (GDPR).
- “Process” means any operation performed on Personal Information — collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure or destruction.
2.2 Categories of Personal Information
Across our websites and cloud-backed platforms the Company may process:
- Identity details — full legal name, username, account login details and password.
- Demographic information — gender, date of birth, salutation and language preferences.
- Contact details — postal and billing address, telephone and mobile number, email address.
- Consent records — records of consents given, with date, time, method and subject matter.
- Location information — geographic coordinates of your device. This category applies to cloud-connected services only; for the WaveMed platform, location is processed on the device as described in Part 1.
- Purchase and payment details — subscriptions, licences, prices, invoices, payment methods, accountholder names, amounts and dates.
2.3 Technical and auxiliary data
We automatically collect technical metrics when you interact with our websites or cloud-connected services: usage metrics, browsing activity, device identifiers, network and connection metadata, tracking technologies such as scripts and pixels, and mobile analytics. Where such identifiers can be linked, directly or indirectly, to an identifiable person, they are treated and protected as Personal Information under this policy. These technologies are not present in the WaveMed and vWaveMed apps, which contain no analytics or tracking software of any kind.
3. Sensitive information and minors
3.1 Sensitive Personal Information
The Company does not solicit or routinely collect data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or alleged criminal offences.
Health information — for example medical imaging, clinical histories or health reports — is processed only where you upload it to a cloud-connected portal yourself, or store it on a local platform as described in section 2. Such health data is special-category information: we process it solely on the basis of your explicit consent (GDPR Article 9(2)(a)) or where processing is required or permitted by law, and never for advertising or profiling.
3.2 Minors and child privacy
The Services are intended for adults, or for minors acting under the direct supervision of a parent or legal guardian. Children under 16 — or under 13 in the United States, or such other age as applies in their jurisdiction — must not submit Personal Information through the Services without verifiable parental or guardian consent, and minors under 18 may not make purchases. If we discover that we have collected Personal Information from a child without the required consent, we will delete it promptly. The WaveMed and vWaveMed apps are intended for users aged 18 and over and are not directed to children.
4. How information is collected
We collect information you provide directly (account creation, correspondence, subscription orders), information arising from our relationship and transactions with you, and service data collected automatically. We also generate internal administrative records such as interaction logs, subscription statuses and system metrics.
Where the Services include areas in which users can post or share information publicly, iDataMap has no control over how others use information you choose to expose there.
5. Purposes of processing
Subject to applicable law, we process information to perform our contracts with you, operate and improve our infrastructure, communicate with you (relying on opt-in consent for non-essential messages), maintain IT governance and security, administer our finances, and establish or defend legal claims.
6. Lawful bases, and product-specific exclusions
Depending on the context we rely on: your consent; the necessity of processing to perform a contract; compliance with legal obligations; protection of vital interests; or our legitimate business interests.
Exclusion — the WaveMed platform. The bases above concern server-side processing and do not apply to the runtime of WaveMed and vWaveMed. Outside the optional Cloud Portal (Part 1, section 6), those apps have no server-side processing of your data at all, as described in Part 1.
7. Disclosures and cross-border transfers
Subject to applicable law, we may disclose cloud-stored information to judicial or regulatory authorities, to professional advisers under confidentiality obligations, to authorised processors under data-processing agreements, and to a successor entity in the event of a merger or acquisition. We do not sell your personal information.
Cross-border transfers. For server-backed services, processing may involve transferring information outside Australia under recognised safeguards such as standard contractual clauses and the cross-border disclosure provisions of the Australian Privacy Principles.
Exclusion — the WaveMed platform. These provisions are inapplicable to the on-device features of WaveMed and vWaveMed: we never receive, and therefore never transfer, their users’ mapping or health information. They do apply to information submitted through the optional Cloud Portal.
8. Security
8.1 Technical and organisational safeguards
We maintain security measures designed to protect cloud-based information against accidental destruction, alteration, loss and unauthorised access or disclosure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and any other regulator where required by law.
8.2 RadCard cryptographic protocol
For records carried on the RadCard platform, the Company enforces a zero-persistent-footprint architecture:
| Stage | What happens |
|---|---|
| 1. Hardware inserted | The card is connected to a terminal. Data remains encrypted with AES-256 or AES-128. |
| 2. PIN authentication | The patient enters their PIN. Data is decrypted transiently, in volatile memory only. |
| 3. Hardware removed | All local caches are cleared immediately, leaving no temporary files, metadata or footprints on the host computer. |
9. Accuracy and correction
Information processed on our servers is reviewed for accuracy. Inaccurate data will be corrected or erased within statutory timeframes once you notify us and your identity is verified.
10. On-device software — rights exercised directly
For our on-device product lines (WaveMed, vWaveMed, RadPatch and RadCard), your rights of access, portability, correction and erasure are exercised directly through the application interface, your own hardware, or by uninstalling the software — no request to the Company is needed. Because we hold no central repository for these products, we cannot extract, audit or delete that data on your behalf.
11. Retention
Personal Information stored on our servers is deleted from active systems within thirty (30) days of account closure, subject to statutory retention obligations such as tax, audit or legal-defence requirements. Residual copies in backups are overwritten on a rolling cycle not exceeding ninety (90) days. For on-device applications the Company applies no retention oversight: records remain on your hardware until you delete them.
12. Your rights, and how to complain
In line with the Australian Privacy Principles and the GDPR you have rights of access, rectification, erasure, restriction of processing, objection and data portability in respect of information we hold on our servers.
To exercise a right, contact dev@idatamap.com. We verify identity before acting on a request and respond within thirty (30) days, or within one calendar month where the GDPR applies.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au. Users in the EEA or the United Kingdom may also complain to their local data protection supervisory authority.
13. Contact
iDataMap Corporation Pty Ltd (ACN 126 872 580 · ABN 14 126 872 580)
Suite 14, Cnr Calley Drv & South St, Leeming WA 6149, Australia
Email: dev@idatamap.com
Web: www.idatamap.com