Legal
Privacy Policy
The short version
HealthFlow7 is an analysis tool that runs entirely on your own computer. The HL7 messages you load into it — including any patient data they contain — stay on your machine or on a database server you control. SquidSpark never receives them, and has no ability to.
There is no telemetry, no analytics, no usage tracking and no crash reporting. The application makes exactly three kinds of outbound network connection, all described below, and two of them only happen because you asked for them.
What the application stores, and where
All of this is on your own machine (or a database server you nominate). None of it is transmitted to SquidSpark.
| What | Where | Notes |
|---|---|---|
| HL7 messages you import | %LOCALAPPDATA%\…\com.companyname.hl7insight.app\Data\hl7insight.db, or your own SQL Server | Stored in full, including the complete raw message text |
| Field statistics | Same database | Derived counts and observed values, which can include real field values |
| Application settings | settings.json in the same folder | Database connection strings and AI provider API keys; secrets are encrypted for your Windows account — see Security below |
| Licence state | license.json in the same folder | Licence key, tier, machine identifier, trial record |
| Trial record (duplicate) | Registry: HKEY_CURRENT_USER\Software\SquidSpark\HL7Insight\TrialInfo | Deliberately survives uninstalling the application — see Trial records below |
| Browser cache | WebView2 subfolder | Created by the embedded Microsoft Edge WebView2 component used to render the interface |
To remove everything, delete the application-data folder above and the registry key. Uninstalling alone does not remove either.
Data sent off your machine
1. Licence activation and validation
Connections to the SquidSpark licence server (https://license.squidspark.com).
When you activate a licence, the application sends:
- the licence key you entered
- a device identifier — a SHA-256 hash of the Windows
MachineGuid, truncated to 32 characters. It is not reversible and is used to tie one licence to one device. - the computer's name (
Environment.MachineName) - the Windows account name of the signed-in user (
Environment.UserName) - the product identifier
The computer name and Windows account name are sent so the licence can be identified and released later. A Windows account name is often a person's name or initials, so this is personal data. It is used solely for licence administration and support, is not sold or shared, and is not used for marketing or profiling.
On every application start, if a licence key is stored, the application validates it. That request sends only the licence key and the product identifier — no device identifier, no computer name and no user name.
When you deactivate a device, the application sends the licence key and the device identifier so the seat can be freed.
If the licence server cannot be reached, the application keeps working on its cached entitlement and no data is sent.
2. AI provider (optional, off by default)
HealthFlow7 can generate narrative summaries and explanations using an AI provider. This is disabled by default and does nothing until you configure a provider and supply your own API key. SquidSpark does not provide, proxy or see this service.
- You choose the provider: OpenAI, Azure OpenAI, Anthropic, or a local model via Ollama.
- Ollama runs on your own machine, so choosing it means message content never leaves it at all.
- "De-identify before sending" is on by default. With it on, message content is scrubbed of names, identifiers, addresses, contact details and dates of birth before being transmitted.
- When you send data to a third-party provider, that provider's privacy policy and terms govern what happens to it, not this one.
Important limitation. The de-identification is thorough for the standard PHI-bearing fields of common segments, but it is not certified and it is not guaranteed. Sites put identifiers in unexpected places. Review the substitution map and a sample of output before relying on it, and consider a local model if message content must never leave your machine.
3. HL7 endpoints you nominate
The MLLP sender and the resubmission feature transmit HL7 messages — including any patient data they contain — to the host and port you enter. These go directly from your machine to that system. SquidSpark is not involved and never receives a copy.
Resubmission run history is stored locally and never records message bodies. It does record the receiving system's rejection (NACK) text verbatim, and some systems echo patient details into that text, so treat run history as potentially containing patient data.
What we do not do
- No telemetry, analytics, usage statistics or feature tracking.
- No crash or error reporting.
- No advertising identifiers, no profiling, no automated decision-making.
- No sale or sharing of personal data.
- No access, by SquidSpark, to the HL7 messages or databases you work with.
Patient data and healthcare regulation
HL7 v2 messages routinely contain protected health information. When you use HealthFlow7:
- You remain the controller of that data. It is your data, on your systems, under your policies.
- SquidSpark does not receive, process, store or transmit it, and has no technical means of doing so. The application has no upload path.
- Because of that, SquidSpark does not act as a processor or business associate in respect of patient data, and we do not enter into Business Associate Agreements. There is nothing for such an agreement to govern: the application has no upload path, and we have no technical means of receiving, storing or transmitting your messages. If a procurement process asks for a BAA as a matter of routine, this section is the answer — the data never reaches us.
If you enable an AI provider, patient data may leave your environment for that provider. That is your decision and your responsibility to assess, including any agreement you need with them.
Security
- The database, settings and licence files are protected by the file permissions of your Windows user account and by any disk encryption you have enabled. The application does not add its own encryption at rest.
- AI provider API keys and the SQL Server password are encrypted in
settings.json, using Windows DPAPI tied to the Windows account that saved them. No encryption key is stored by the application or shipped with it — Windows derives it from your account credentials. A copy of the file taken to another machine, another Windows account, or a backup restored elsewhere cannot be decrypted. Only the password is encrypted inside a connection string; the server and database names stay readable so the setting remains diagnosable. - This does not protect against code running as the signed-in user, which can ask Windows to decrypt exactly as the application does. No local-only scheme can, short of a passphrase typed at every launch, which this product does not require.
- Integrated Security avoids storing a database password at all and is preferable where your environment allows it.
- Connections to the licence server use HTTPS. MLLP connections use TLS only if you enable it; MLLP is plain TCP by default, and the "allow invalid certificates" option disables certificate validation entirely and should never be used against a system carrying real patient data.
Trial records
A 14-day trial can be started once per machine. The trial record is written to both the application-data folder and the Windows registry, and the registry copy is intentionally left behind when the application is uninstalled. This exists solely to stop the trial being restarted by reinstalling. It contains a start timestamp and the device identifier described above — no personal data beyond that, and no message content. You can remove it by deleting HKEY_CURRENT_USER\Software\SquidSpark\HL7Insight.
Data retention
- Data on your machine is kept until you delete it. Deleting a workspace deletes its messages and statistics. Resubmission run history keeps the most recent 50 runs by default and trims older ones automatically.
- Licence records held by SquidSpark — the licence key, device identifier, computer name and Windows account name described above — are retained for the life of the licence, then for up to 7 years afterwards to meet Canadian tax and accounting obligations.
- Support correspondence is kept for 24 months from the last message in the thread.
Your rights
The personal data SquidSpark holds about you is confined to the licence records described above. Wherever you live, you may ask us to:
- access the personal information we hold about you and be told how it is used and who it has been disclosed to;
- correct information that is inaccurate or incomplete;
- delete information we no longer need to keep;
- withdraw consent, noting that withdrawing consent to licence validation means the paid modules will lock and the application reverts to the free tier;
- receive a copy of the information you gave us in a portable format; or
- complain about how we have handled it.
Practical controls in the product:
- Use the free tier and never contact our servers at all.
- Deactivate a device from within the application to remove that device's activation record.
- Delete the application-data folder and the registry key described above to erase all local data.
How to exercise a right: email privacy@squidspark.com. We will verify your identity — usually by confirming the email address on your licence — and respond within 30 days. There is no charge for these requests.
If you are in the EU or UK, you also have the rights to restrict or object to processing, and to lodge a complaint with your local supervisory authority. If you are in California, you have the rights to know, delete and correct, and the right not to be discriminated against for exercising them; we do not sell or share personal information as those terms are defined under the CCPA/CPRA and have not done so in the preceding 12 months. If you are in Quebec, you have the rights the Act respecting the protection of personal information in the private sector provides, including de-indexation and data portability.
If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376) or to the regulator in your own jurisdiction.
Because SquidSpark holds no patient data, requests concerning patients must be directed to the healthcare organisation that controls it.
Children
HealthFlow7 is professional software for healthcare integration staff. It is not directed at children and is not offered to them. Note that patient data processed by you using this tool may of course relate to children; that data never reaches SquidSpark.
Changes to this policy
Material changes will be reflected here with an updated effective date, and noted in the release that carries them.