OphthoRuler Join the beta

Legal · Version 2.13 · Effective 28 September 2026

Research-Use and Medical Disclaimer

Key limits, responsibilities, and risks

Version 2.13 · Effective 28 September 2026 · Alberta, Canada

Contents

  • Summary
    1. Not a medical device
    1. No regulatory or standards certification
    1. Confirm that your use is permitted
    1. Consent, disclosure and withdrawal
    1. Encryption and its limits
    1. The measurements can be wrong
    1. No warranty and limited liability

Summary

OphthoRuler EyeStudio is experimental research software. It is not a medical device, it has not been submitted for medical-device authorisation, it is not certified against any privacy or health-data standard, and it may be wrong. It encrypts the photographs and study records it holds. If you lose both your password and your recovery code, the encrypted data cannot be recovered. You are responsible for obtaining the approvals and authority your research requires, protecting participant data, checking the Software’s output, and reviewing anything you publish.

1. Not a medical device

⚠️ No medical-device authorisation

The developers have not submitted the Software for review, clearance, approval, licensing, registration, or conformity assessment as a medical device, and no such authorisation or CE marking has been obtained. It is not built under a medical-device quality system.

  • Do not use it to diagnose, screen, monitor, treat, or manage anyone.
  • Do not use it to plan, size, or evaluate a surgical or medical procedure.
  • Do not base any decision about a person’s care on a value it produces.
  • Do not describe it, or anything it produces, as clinical, diagnostic, or validated.
  • Do not use it in place of a qualified clinician using approved instruments.

The app states no normal range and no threshold for any linear measurement, and no classification that corresponds to a clinical category or to any treatment. The only scale it presents is the 0 to −4 underaction scale on the motility chart, which describes the photographs supplied and is not an examination finding. Where it computes reference limits, diagnostic accuracy, or predicted risks, those describe only the sample you gave it. Published values for these measurements come from other instruments and other populations and are not calibrated to measurements made this way. They must not be used to classify or manage any individual.

2. No regulatory or standards certification

The Software makes no claim to satisfy, and has not been assessed against, any standard for clinical software, medical devices, health information, privacy, information security, or electronic records. That includes ISO 13485, IEC 62304, ISO 27001, SOC 2, HIPAA, FDA 21 CFR Part 11, EU Annex 11, ICH Good Clinical Practice, and ALCOA+.

It keeps no tamper-evident audit trail. Do not use it as the system of record for a regulated trial, for a regulatory submission, or for any purpose where the integrity of the record is a legal requirement.

3. Confirm that your use is permitted

📌 Check before collecting data

Whether you may use this Software depends on your REB/IRB, your institution, your professional college, your employer, and applicable law. Some of these may not permit participant data to be held in software that is uncertified, unaudited, and synced between personal devices. The Software does not check any of this or tell you that your use is allowed. It records only that you said it was.

  • Obtain and maintain the REB/IRB approval or documented waiver required for each study.
  • Determine whether your protocol must be amended to add this Software.
  • Complete any required privacy impact assessment, security review, or vendor review.
  • Comply with applicable privacy and health-information law, which may include Alberta’s Health Information Act and PIPA, PIPEDA, PHIPA, FOIP, HIPAA, US biometric statutes such as Illinois’ BIPA, and the EU or UK GDPR.
  • Nothing in this Software or its documentation is legal advice.

Before using real-person data, obtain and document valid informed consent covering this use, unless your REB/IRB and applicable law authorise a waiver or the use of previously collected data. Keep the consent or waiver documentation.

📌 You must also disclose the risks of this Software specifically

Where consent is obtained, participants must be told what this Software does with their photographs and what the risks are. That means telling them that face and eye images identify them; that the data are held on ordinary personal devices, encrypted but not guaranteed; that copies leaving the app as exports, figures, archives, shared files, or camera-roll copies are not encrypted, and camera-roll copies may go from the phone’s photo library to iCloud; that data are synced, exported, shared, and published; that automated models process the images; and that a leak, loss, or re-identification is possible and cannot be undone. The Participant Disclosure document sets out the minimum points to cover.

If a participant withdraws, follow the withdrawal terms approved for the study and applicable law. Where erasure is required, it must cover exports, archives, shared copies, and camera-roll copies. Ordinary deletion inside the app hides a record but does not erase the image.

5. Encryption and its limits

⚠️ What is encrypted, and what stays visible

Photographs and the contents of your study records are encrypted at rest under a password that only you hold, and you must set that up before you can use the app. What stays readable is the structure of the database: how many participants, encounters, and photographs there are, their dates, and internal identifiers. On Mac that layer relies on FileVault, which the app recommends but does not require and cannot turn on. Without FileVault, anyone who can read the disk can read everything the app does not encrypt. Encryption protects files that are taken from you. It gives no protection on an unlocked machine where you are logged in. Data recorded before you set up encryption stay unencrypted until the app finishes encrypting them, and the app shows you the count.

⚠️ Keep both recovery methods safe

Your password and your 12-word Emergency Recovery Kit exist only where you keep them. Neither the developers nor Apple can reset them. If you lose both, every encrypted photograph is permanently lost, including any records your ethics approval may require you to retain. Print the kit and keep it offline, and never store it in e-mail, cloud storage, or your photo library.

  • On iPhone you can turn on saving copies of every capture to your photo library. It is off by default. A copy in the photo library is an unencrypted image outside the app, and turning it on sends participants’ faces to iCloud Photos if you use it. Leave it off unless your ethics approval covers it.
  • Exports, figures, archives, and share panels always produce plain files containing identifiable faces. Backups can be encrypted, and are by default once encryption is set up, but any destination you mark unencrypted is written without encryption.
  • The app lock uses the device’s own authentication (Face ID, Touch ID, or the device passcode or Mac password) to lock the app on that device. It is not encryption, and it does not protect the files from anyone who can read them.
  • No security audit or penetration test has been done. No security is guaranteed.
  • macOS runs a scheduled local backup, on by default, only while the app is open. It is provided for convenience and is not guaranteed. iPhone has no backup of its own, but the phone’s iCloud or computer backup includes the app’s data, as the Data and Security Statement describes. Losing everything is possible, and some actions cannot be undone.
  • Nothing is sent to the developers, so they cannot recover lost data.

6. The measurements can be wrong

  • Everything is measured from a flat photograph of a three-dimensional face, so head pose, distance, and lens all distort it.
  • Millimetres depend on calibration. Without a physical size reference the app assumes an average corneal diameter of 11.71 mm, which is wrong for any individual whose cornea differs. Area measurements scale with the square of that error.
  • The landmark and pupil models were trained on other populations, fail silently, and are systematically biased in ways that vary with anatomy, skin tone, age, and image quality.
  • The motility chart summarises registered pupil excursion on a 0 to −4 underaction scale whose bands are taken from the clinical percentage method. The scale describes the photographs supplied and is not an examination finding, and no band corresponds to any diagnosis.
  • Statistics, reference ranges, diagnostic accuracy, and predicted risks describe only the sample you gave the app.
  • Generated manuscript text is assembled automatically. You are its author, and you are responsible for every word you publish.

📌 Check every value you rely on

Inspect the landmarks and verify the calibration. Have an appropriately qualified statistician review any analysis you publish.

7. No warranty and limited liability

⚠️ Supplied as is

THE SOFTWARE AND EVERYTHING IT PRODUCES ARE PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE OPHTHORULER DEVELOPERS ARE NOT LIABLE FOR ANY LOSS ARISING FROM THE SOFTWARE, INCLUDING LOST, CORRUPTED, OR LEAKED DATA, INVALID RESULTS, RETRACTED PUBLICATIONS, OR REGULATORY ACTION. TOTAL LIABILITY IS CAPPED AT THE AMOUNT YOU PAID FOR THE SOFTWARE DURING THE PREVIOUS 12 MONTHS. IF YOU PAID NOTHING, THE CAP IS ZERO.

ℹ️ What is never excluded

Nothing excludes liability for fraud, wilful misconduct, gross negligence, death or personal injury caused by negligence, or anything else the law does not allow to be excluded. If you are in the EEA, the UK, or Switzerland, clause 27 of the Terms replaces the cap above with the limits your own law allows.

The Terms do not require you to defend or indemnify the OphthoRuler Developers. You remain responsible for your own use of the Software and for any obligations you may owe directly to Participants, institutions, regulators, or others under applicable law. The full Terms of Use and Research-Use Licence govern. This page is a summary and does not replace them.

Text fingerprint (SHA-256): 4109133a2a29baf87adb2d013b0863bbabd3b56e168726868998096edf07d96d