EchoProb is a web-based clinical decision support (CDS) tool created by Andrew Malashock, RDCS, FASE. EchoProb accepts numeric echocardiographic measurements and returns probability-weighted grading assessments based on published guidelines. It is exempt from FDA device regulation under the 21st Century Cures Act (2016) Section 3060.
| Data Type | Examples | Storage | Retention |
|---|---|---|---|
| Account data | Email, name, credential, institution | Supabase (PostgreSQL, AWS us-east-1) | Until account deletion |
| Echocardiographic measurements | EROA, VC, RegVol, LVEF, TAPSE | Not stored. Processed in memory, returned to your browser, then discarded. | None (stateless) |
| Study snapshots | Saved module results and numeric measurements, de-identified | Your device (browser localStorage) and Supabase (account-scoped, RLS-protected) so your studies sync across devices. A client-side scrub redacts common PHI patterns before any sync. | Until account deletion |
| Quiz Mode attempts | Submitted grade, score, difficulty | Supabase | Until account deletion |
| API audit logs | Endpoint, user ID, module, IP, status | Supabase | 90 days, then deleted |
| Billing data | Subscription status, trial dates | Supabase (status only); Stripe (payment details) | Per Stripe retention policy |
| Analytics | Anonymous page views, feature events | Plausible Analytics (EU-hosted, cookieless) | Per Plausible retention policy |
You are instructed at first login and at study creation to never enter protected health information. Use de-identified case labels (e.g., "Case A" or "EP-042"), not patient names or MRNs.
When you submit measurements, your browser sends them to our serverless grading function. The function processes the values in memory, computes a probability distribution, returns the results to your browser, and discards the input values. Measurement data is never stored, logged, or persisted on our servers.
EchoProb uses the following cookies and similar technologies:
We do not use advertising cookies, tracking pixels, or third-party remarketing.
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication | Account data, quiz attempts, audit logs |
| Netlify | Hosting, serverless functions | HTTP requests (no measurement data persisted) |
| Stripe | Payment processing | Email, subscription status |
| Sentry | Error monitoring | Error stack traces (no PII or measurements) |
| Resend | Transactional email | Email address (welcome email) |
| Plausible Analytics | Usage analytics (cookieless) | Anonymous page views, feature events |
EchoProb is not currently HIPAA-compliant and does not process, store, or transmit PHI. For institutional deployments requiring HIPAA compliance, a Business Associate Agreement (BAA) is planned for Q4 2026. The architecture is HIPAA-ready: measurement data is stateless, audit logging is in place, and all data is encrypted in transit.
You may:
When you delete your account, we permanently remove your profile, quiz history, learning stats, referral records, and audit log entries. Study snapshots stored on your device are not affected (they were never on our servers).
| Data | Retention | Deletion |
|---|---|---|
| Account data | Until deletion or 2 years of inactivity | Account deletion (Profile page or email request) |
| Study snapshots | You control (device storage) | Clear browser data or delete in-app |
| Quiz attempts | Until account deletion | Cascade deleted with account |
| API audit logs | 90 days | Scheduled cleanup |
| Rate limit records | 5 minutes | Auto-purged |
EchoProb is hosted in the United States (AWS us-east-1 via Supabase, Netlify CDN). If you access EchoProb from outside the US, your data may be transferred to and processed in the US. By using EchoProb, you consent to this transfer.
For EU/EEA users: we process data under legitimate interest (providing the service you requested) for essential functions, and under consent for analytics. You may exercise your GDPR rights by deleting your account in the app or contacting us.
EchoProb is a professional clinical tool. It is not intended for users under 18.
We will update this policy as features change (particularly for institutional licensing, HIPAA BAA, and international deployments). Material changes will be communicated via email or in-app notice. The effective date at the top of this page will always reflect the latest version.
Questions about this policy: amalashock@gmail.com