PathAssist is developed and published by NexL Solutions ("we", "us"). This policy explains what the application does with information. The app is distributed directly (from our website / as a downloadable package), not through an app store, and is unlocked with a licence (see section 5).
PathAssist stores the following in the application's private storage (local storage and IndexedDB within the app sandbox). None of it is transmitted to us or to any third party.
| What | Why |
|---|---|
| Reporting profile — doctor name, qualifications, registration number, clinic / hospital name and address, department, and an optional signature image | To populate report headers and footers |
| Specimen identifiers you enter — accession number, specimen number, age, sex, referring clinician, dates, clinical history and gross description | To produce the report |
| Saved synoptic reports and drafts, and the values you enter into them | So you can reopen, edit, copy and print previous reports |
| Case archive entries — title, slide ID, accession number, organ, diagnosis, description, tags, specimen status | Your personal teaching / interesting-case library |
| Photographs you attach to case archive entries | Stored as image files inside the app's private database |
| App preferences — theme, accent colour, font size, favourites, teaching mode, personal abbreviation dictionary | To remember how you like the app configured |
To stop a single paid licence being copied onto unlimited devices, PathAssist checks your licence
with our server (a Cloudflare Worker at nexl-license.drgirish.workers.dev) at
first activation and then with a periodic re-check (about weekly) when
online. Between those checks the app runs fully offline. These requests send, and the server
stores, only:
When you buy a licence, the name and email you provide at purchase are stored with the licence record so support can manage it (for example, to move a licence to a new phone or to re-issue a lost key).
What is never sent to the server: your reports, drafts, cases, photographs, patient identifiers, clinical history, voice notes, or anything you type into a protocol. The licence check cannot see any of it.
PathAssist is unlocked with a paid licence. Without a valid, active licence, the clinical reporting tools (the CAP synoptic protocols, the IHC and biomarker decision tools, Voice Notes and Guided Case) are locked; your saved cases and reports remain readable and can still be exported (see section 8). Payment is handled by a third-party payment provider (for example Razorpay / BillDesk) on our website — we never see or store your card or bank details; the provider handles the transaction under its own privacy policy and issues a receipt. Our server only records that a licence was created and, later, which devices activated it.
| Permission | Purpose |
|---|---|
INTERNET | To activate and periodically re-check your licence with our server (section 3), and to open external links (such as cap.org or rcpath.org) or share sheets that you tap. The clinical content works offline between licence checks. |
RECORD_AUDIO (Microphone) | Only for Voice Notes / dictation, and only while you have actively started dictation. The audio is not recorded to a file by us or sent to us (but see section 7.1 on the device's speech service). |
| Camera / photo access | Requested by the Android system only at the moment you choose to add a photograph to a case. Images are saved only inside the app. |
The dictation feature uses your device's own speech recognition service through the standard Android speech recognition interface. On most Android devices this service is provided by Google. Depending on your device, its manufacturer, and your Android settings, your speech audio may be transmitted to and processed by that provider's servers to convert it to text.
This processing is outside our control and is governed by the privacy policy of the speech recognition provider on your device (for example, Google's Privacy Policy). We do not receive, store or have access to this audio or the resulting text.
Because of this, you should not dictate patient-identifying information. Dictation is optional — every field in the app can be typed instead.
When you choose to share or copy report text via the Android share sheet, email or messaging apps, the app hands the text you selected to the application you chose. From that point the information is handled by that application under its own privacy policy. This only happens when you actively tap share/copy.
PathAssist ships with de-identified mode switched on. In this mode the patient name and MRN / UHID fields are hidden and are never written to the device's storage. Cases and reports are identified by accession or specimen number instead. In normal use, therefore, the application holds no direct patient identifiers at all — and, as section 3 explains, none of this reaches our server regardless of the setting.
De-identified mode can be switched off in Settings if your workflow requires a patient name on the report. If it is switched off, those identifiers are stored on the device, and the responsibilities below apply in full.
PathAssist is a professional tool for qualified pathologists and laboratory staff. It is designed so that identifiable patient information is not required in order to use it.
If you choose to enter patient-identifying information, clinical images, or any other personal data belonging to a patient, you are the data controller for that information. You are responsible for complying with the professional, institutional and legal obligations that apply to you — including applicable data protection law, your employer's or hospital's policies, and patient confidentiality requirements.
We recommend leaving de-identified mode on, using a slide or accession number rather than a patient name, securing your device with a screen lock, avoiding photographs in which a patient label is legible, and not dictating identifiable information.
Your clinical data is held in the application's private storage, which Android isolates from other apps; its practical security depends on your device (screen lock, encryption, OS updates, whether it is rooted or shared). We do not hold any copy of your clinical data, so there is no server-side copy of it to be breached — but equally there is no backup held by us: if you lose or wipe the device, that data is gone. Use Settings → Export my data to keep your own backup.
The licensing data in section 3 is retained on our server for as long as the licence exists, plus a limited security/audit log. You can clear all on-device data at any time (Android Settings → Apps → PathAssist → Storage → Clear data, or uninstall). To delete your licence record or ask what licensing data we hold, contact us at the address below.
PathAssist is a professional medical tool for qualified healthcare practitioners. It is not directed at, or intended for use by, children, and we do not knowingly collect information from them.
PathAssist provides reference material, checklists and calculations to support professional practice. It does not make diagnoses, does not provide medical advice, and is not a medical device. All content — including staging, grading, protocol and biomarker content derived from published guidance — must be verified against the current official source before use, and all diagnostic decisions remain the responsibility of the reporting pathologist.
If the app's behaviour changes in a way that affects this policy, we will update this page and revise the effective date above. Material changes will also be noted in the app's release notes.
This policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023 where applicable.
Questions about this policy, or requests regarding your licensing data: dr.girish.s@gmail.com