2.3 Local database and privacy

2.3.1 Privacy at a glance

IOLResearch uses a document-based database. The information entered by the user is written only to the selected database document.

The database location is selected when the document is created:

• On My iPad: the database remains locally stored on that iPad.

• iCloud Drive: Apple synchronises the database through iCloud.

• Another file provider: storage and synchronisation are governed by the selected provider.

• Export or sharing: a separate copy may be created at the destination selected by the user.

Important: “Not transmitted by IOLResearch” does not mean that the file can never leave the device. Selecting iCloud Drive, another cloud provider, an export option, a backup service, or a sharing destination may create or synchronise additional copies under the user’s control.

2.3.2 Data minimisation

IOLResearch is designed to collect only the information required to organise a study and calculate its visual outcomes. A subject record may contain:

• A study-specific numeric pseudo-identifier.

• Sex, when required by the study.

• Year of birth.

• The intraocular lens implanted in each eye.

• Procedures and their associated protocols.

• Follow-up periods.

• Measurements and study results.

The application does not require the subject’s name or complete date of birth for its standard workflow.

Why does IOLResearch collect only the year of birth?

The subject’s day and month of birth are not collected. IOLResearch uses the year of birth to obtain an approximate age while avoiding the storage of a more identifying full date of birth.

When the unknown birth date is represented by the midpoint of the recorded year, the maximum temporal approximation error is approximately ±6 months. This level of precision is normally sufficient for age-based summaries while reducing the amount of personal information stored.

Clinical research note: Age calculated from the year of birth is approximate. If a protocol requires exact age on a specific date for eligibility, safety, or outcome calculation, investigators should follow the approved study protocol and verify the value using the authorised source system.

This design supports the GDPR principle of data minimisation, under which personal data must be adequate, relevant, and limited to what is necessary. The GDPR also requires data protection by design and appropriate safeguards such as pseudonymisation and encryption. GDPR Articles 5, 25 and 32

In the United States, the HIPAA Safe Harbor method similarly excludes the day and month from dates directly related to an individual, allowing the year to be retained. Additional requirements apply, including the treatment of ages over 89 and the removal of all other listed identifiers. HHS de-identification guidance

Do not use a direct clinical identifier as the subject code. Use a study-generated pseudo-identifier rather than a name, initials, medical record number, national identification number, or another code already associated with the patient.

2.3.3 Pseudonymised does not mean anonymous

Although IOLResearch avoids common direct identifiers, its database contains health and research information. The combination of a pseudo-identifier, year of birth, sex, intraocular lens information and study results may still permit identification when combined with information held elsewhere.

The database should therefore be treated as pseudonymised personal health data, not as anonymous data.

The document should remain subject to:

• The study protocol.

• Institutional access controls.

• Ethics committee requirements.

• The applicable retention policy.

• GDPR or national data-protection requirements.

• HIPAA requirements when the organisation and processing activity fall within its scope.

Using a reduced dataset supports compliance, but it does not by itself make a study GDPR- or HIPAA-compliant.

2.3.4 How the database is protected on the iPad

Apple devices use a file-encryption system called Data Protection. Apple states that third-party application files receive this protection automatically. Each file is encrypted using a per-file or per-extent key and hardware-supported encryption. Apple Platform Security

When an active device passcode is configured, iPadOS automatically encrypts and decrypts protected files as they are written to and read from storage. Apple Developer Documentation

This protection is provided by iPadOS. It should not be interpreted as a separate password applied directly to the IOLResearch database document.

For appropriate on-device protection:

• Configure a strong iPad passcode.

• Enable automatic screen locking.

• Keep iPadOS updated.

• Do not share the device passcode.

• Use institutional device-management controls when required.

• Avoid storing research databases on shared or unmanaged devices.

2.3.5 Protection when using iCloud Drive

If the database is saved under On My iPad, it is stored locally. If it is saved in iCloud Drive, Apple synchronises it across devices signed in to the same Apple Account. Apple Files guidance

Apple provides two levels of protection for iCloud:

• Standard Data Protection: iCloud Drive data is encrypted in transit and while stored on Apple’s servers. Apple retains the relevant service encryption keys so that it can provide account and data recovery.

• Advanced Data Protection: iCloud Drive is protected using end-to-end encryption, and the encryption keys remain available only to the user’s trusted devices.

These differences are described in Apple’s iCloud data security overview.

For databases containing clinical research data, the investigator or institution must decide whether cloud storage is permitted by the study protocol, informed-consent documentation, institutional policy, data-processing agreements and applicable law.

Saving a database in iCloud Drive is a user-directed transmission to Apple’s cloud service. It is not an automatic upload performed by IOLResearch.

2.3.6 What happens when a database is deleted?

IOLResearch does not retain a separate server-side copy of the information entered into a local database. Consequently, when the database is the only existing copy, deleting that document removes all subjects, procedures, protocols, follow-ups and results stored inside it from IOLResearch.

However, deletion may not immediately be permanent:

• Files deleted from On My iPad or iCloud Drive normally move to the Files app’s Recently Deleted location.

• Apple allows these files to be recovered for up to 30 days unless they are manually removed from Recently Deleted.

• Device backups, institutional backups, exported files and copies previously shared with another person may continue to exist.

• Removing an iCloud download from an iPad is not the same as deleting the file from iCloud Drive.

Apple explains these behaviours in its file deletion and recovery guidance.

To permanently remove every available copy, the authorised user should:

1. Delete the IOLResearch database document.

2. Remove it from Recently Deleted.

3. Check iCloud Drive and any other selected file provider.

4. Delete authorised exports or shared copies when their retention is no longer required.

5. Manage backups in accordance with the institution’s retention policy.

Warning: Deleting a database cannot be undone after the file has been permanently removed and no backup or exported copy remains. Always follow the approved study-retention policy before deleting research data.