Privacy Policy

For the InteLIS Mobile Android application (com.deforay.vlsm), published by the Deforay Developers Team.
Effective 2 September 2026.

This policy explains what information the InteLIS Mobile app handles, why, and what control you have over it. It covers the app itself. It does not cover the InteLIS server your organisation runs, which is a separate system with its own operator.

1. Who is responsible

The app is developed and published by the Deforay Developers Team, reachable at hello@deforay.com.

InteLIS Mobile is a client application. When you sign in you supply the address of an InteLIS server, and the app communicates only with that server. That server is operated by your ministry of health, national laboratory network, or the organisation that issued your account. It is not operated by us, unless we separately host your instance under a written agreement. The operator of that server is the controller of the data you submit through the app. For questions about how test requests and results are used or retained, contact your InteLIS administrator.

2. Who the app is for

InteLIS Mobile is intended for staff at health facilities, sample collection sites and laboratories that use InteLIS. It is not a consumer app and is not directed at children. Patients do not use the app themselves.

3. Information you provide

• Server address — the host name of the InteLIS server you connect to.
• Sign-in credentials — the username and password issued to you by your organisation. These are sent to your server for authentication. The app does not store your password after sign-in.
• Test requests — the details you enter when registering a Viral Load, Early Infant Diagnosis or COVID-19 test request. Depending on the form, this includes the patient's identifier such as an ART number, name, age or date of birth, sex, contact number, facility, sample details, and clinical information relevant to the test. This is submitted to your server.
• Test results — results you record for a request, which are submitted to your server.
• App PIN — a four-digit code you choose to lock the app.

4. Information the app sends automatically

Every request to your server carries the app version, the device operating system version, and a device identifier generated by the operating system for this app installation. Your server uses these to identify the installation and to reject app versions it no longer supports. They do not identify you personally on their own.

5. Information stored on your device

The following is kept locally on your phone or tablet so the app can work offline and stay signed in:

• An authentication token for your session, your server address, and the account details returned by your server at sign-in, such as your name, user role and facility.
• Test requests and results you have entered or retrieved, in a local database, so you can work without a network connection and synchronise later.
• A record of past synchronisations, showing when requests were sent and results were fetched.
• Your app PIN.
• Filter and form preferences you set within the app.

Signing out clears your session. Uninstalling the app removes all of its local data. The app does not write files to shared device storage.

6. Biometric and app lock

The app requires a PIN and lets you unlock it with your device biometrics, such as fingerprint or face unlock, where the device supports them. Biometric verification is performed entirely by the Android operating system. The app never receives, sees, or stores your fingerprint or face data. It is told only whether the device verified you successfully.

7. Diagnostics, analytics and notifications

The app contains no analytics, crash reporting, advertising or push notification components. It does not send any information to Deforay or to any third party. The only network destination is the InteLIS server you sign in to.

Because the app is open source, you can inspect exactly what it does in the source repository.

8. Permissions the app requests

The app does not request access to your location, camera, microphone, contacts, call logs, SMS messages or shared file storage.

9. What we do not do

• We do not sell or rent your information.
• We do not show advertising or use advertising identifiers.
• We do not receive, store or share patient data or test results. They go only to the server you sign in to.
• We do not track you across other apps or websites.

10. Data security

Traffic between the app and your server uses HTTPS where your server provides it. The app defaults to https:// when you enter a server address, and only uses plain http:// if you enter it explicitly. Because the server is chosen and operated by your organisation, the security of data at rest, and its retention, are governed by that organisation's policies.

Data stored on the device is protected by the app PIN and by the device's own lock screen and storage encryption. Keep your device locked and do not share your PIN.

11. Your choices and rights

• Access, correction or deletion of patient records, test requests or results — contact your InteLIS administrator, who operates the server holding that data. We cannot access it on your behalf.
• Local data — sign out to clear your session, or uninstall the app to remove its local database and settings.
• Biometric unlock — decline it when prompted and use the PIN instead.

12. Changes to this policy

If this policy changes, the updated version is published at this address with a new effective date. Material changes are also noted in the app's release notes on Google Play.

13. Contact

Questions about this policy or about the app: hello@deforay.com.

Questions about your account, patient records or results held by your organisation: contact your InteLIS administrator.