Terms of Use and Research-Use Licence

The agreement between you and the OphthoRuler Developers

Version 2.13 · Effective 28 September 2026 · Alberta, Canada

Contents

• 1. This agreement, and how you accept it
• 2. Definitions
• 3. What the Software is
• 4. Not a medical device: no clinical use
• 5. How the measurements can be wrong
• 6. Machine-learning models
• 7. Statistics, reference ranges and risk models
• 8. Generated manuscripts, figures and publication
• 9. Licence, and what you may not do
• 10. Who may use the Software
• 11. Ethics approval and legal compliance
• 12. Participant consent and disclosure
• 13. What you must not put into the Software
• 14. How the Software handles your data
• 15. Security is not guaranteed
• 16. Data loss, and actions that cannot be undone
• 17. Not a regulated system of record
• 18. Third-party components and sample data
• 19. Export control, sanctions, and trade compliance
• 20. Apple App Store terms
• 21. Feedback, bug reports, and contributions
• 22. Changes, updates, and ending the licence
• 23. Disclaimer of warranties
• 24. Limitation of liability
• 25. Assumption of risk and release
• 26. Your responsibility for your use
• 27. If you are outside Canada
• 28. Governing law and where disputes are decided
• 29. General
• 30. Contact

1. This agreement, and how you accept it

This is a binding agreement between you and the OphthoRuler Developers covering your use of OphthoRuler EyeStudio (the “Software”). Read it before you use the Software with any real person’s data.

You accept this agreement by completing the acknowledgements presented when you first open the Software, and whenever a revised version is presented to you. Selecting those acknowledgements and continuing confirms that you have had an opportunity to read, and agree to, this agreement and the documents presented with it. If you do not agree, do not use the Software.

You must be legally capable of entering into a binding contract. If you have authority to accept on behalf of an institution, laboratory, department, or research group, “you” means both you and that organisation. If you do not have that authority, you accept only in your personal capacity and must obtain any separate institutional approval required before using the Software.

⚠️ Each user must accept this agreement

Acceptance is personal. No licence is granted to a colleague, student, trainee, assistant, or contractor until that person accepts this agreement through the Software’s acceptance screen. You must not give an unlicensed person access to the Software. Doing so breaches this agreement and may result in termination of your licence under clause 9.

You are responsible under this agreement for anyone to whom you give access. Before doing so, you must ensure that the person has accepted the agreement and has been given notice of clauses 4, 5, 6, 13, 14, and 23 to 26. Clause 26 explains your responsibility for access you provide.

ℹ️ People who are not parties

The OphthoRuler Developers give no advice, assurance, or undertaking to anyone who is not a party to this agreement, including any Participant, any institution, and any reader of anything you publish. No such person should rely on the Software or on any Output for any purpose.

These documents may be revised under clause 22. A revision applies to you only after it is presented to you and you accept it. Each version is numbered and dated. The copy in Settings is the version you accepted, together with its date and the build against which you accepted it. The latest published version is also available at https://ophthoruler.com/terms.

2. Definitions

• Software: OphthoRuler EyeStudio, comprising the macOS application, the iOS application, the shared ORKit component, every bundled machine-learning model, every bundled sample study, and any update, patch, or pre-release build of any of them.
• The OphthoRuler Developers: the individual developers, authors, maintainers, and contributors of OphthoRuler EyeStudio, each of them individually and all of them collectively, together with their respective employers, academic institutions, supervisors, students, agents, successors, and assigns.
• Output: anything the Software produces or helps you produce: landmark annotations, calibrations, measurements, derived and encounter-level values, statistical estimates, p-values, confidence intervals, reference ranges and centiles, diagnostic accuracy and risk-model results, figures, tables, generated manuscript text, exports, archives, and reproducibility bundles.
• Participant: any living or deceased individual whose photograph, image, measurement, or other data you record in, import into, or process with the Software.
• Study Data: everything you put into or generate inside the Software: photographs, participant codes, demographics, notes, tags, encounter records, tabular study variables, annotations, calibrations, measurements, analysis plans, and Outputs.
• REB/IRB: a research ethics board, institutional review board, research ethics committee, or any equivalent body with authority over research involving humans in your jurisdiction and at your institution.
• Personal Health Information: information about an identifiable individual’s health, health care, or health-care payment, however the law that applies to you describes it, including “health information” under Alberta’s Health Information Act, “personal health information” under Ontario’s PHIPA, “protected health information” under HIPAA, and “data concerning health” under the GDPR.

3. What the Software is

The Software is an experimental research instrument for oculofacial anthropometry. It helps a researcher place landmarks on photographs of the eyes and face, calibrate an image to millimetres, compute distances and angles from those landmarks, organise them into studies, and run statistical analyses over the result.

It is built and maintained as a research project and supplied free of charge for bona fide research and educational use. It is not a commercial product and carries no service levels, no uptime commitment, and no support entitlement. Defects are addressed as time and priorities allow, and no undertaking is given that any particular one will be.

ℹ️ What the Software provides, and what it does not

As at the revision date shown above, the Software encrypts photographs and the contents of your study records at rest under a password only you hold, Setting up encryption is part of getting started and cannot be bypassed. The Software does not conceal the shape of the database those records sit in, does not keep a tamper-evident audit trail, and does not correct for out-of-plane head pose (clause 5). Clause 14, clause 17, and the Data and Security Statement describe the position precisely. Read them before deciding whether the Software is suitable for your study. An ethics board or privacy office is likely to ask about several of these properties first.

4. Not a medical device: no clinical use

⚠️ The Software is not a medical device

OphthoRuler EyeStudio is not a medical device. The developers have not submitted it for review, clearance, approval, licensing, registration, or conformity assessment as a medical device, and no such authorisation or CE marking has been obtained. No quality management system (ISO 13485, IEC 62304, MDSAP, or otherwise) governs its development.

⚠️ It must never be used for clinical purposes

You must not use the Software, or any Output, to diagnose, screen for, predict, prevent, monitor, treat, alleviate, or manage any disease, injury, or condition in any person; to plan, select, size, or evaluate any surgical or medical procedure; to determine eligibility for any treatment; to triage or prioritise any patient; or to make, inform, or support any other decision about the care of any individual.

Nothing the Software displays is a clinical finding, a diagnosis, a screening result, medical advice, or a recommendation about any person’s care. Output is never a substitute for examination, measurement, and judgement by a qualified clinician using instruments that are validated and approved for clinical use.

Stated intended purpose

The intended purpose of the Software, including within the meaning of Article 2(12) of Regulation (EU) 2017/745, and as the representation of intended use for the purposes of the Food and Drugs Act (Canada) and of 21 CFR 801.4, is the measurement of geometric quantities in photographs, and the statistical analysis of those measurements, for scientific research and education. It is not intended for any medical purpose, and in particular not for the diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of any disease or condition, nor for the selection, planning, sizing, or evaluation of any procedure.

The Software states no clinical thresholds

The Software does not present, and is not intended to present, any normal range or threshold for any linear measurement, and no classification, cut-off, or centile threshold that corresponds to a clinical category or to the selection of any treatment. The one graded scale it presents, the 0 to −4 underaction scale on the motility chart described in clause 5, summarises the photographs supplied and corresponds to no diagnosis. Where a measurement’s description names a quantity that also appears in the clinical literature, it does so only to identify what is being measured.

⚠️ Anything you read elsewhere is not calibrated to this

Published normal ranges and grading bands for these measurements were established with other instruments, other techniques, and other populations. They are not calibrated to measurements made this way, and applying them to Output from this Software to classify, grade, stage, or select treatment for any person is a misuse of both. The Software has never been validated against any clinical reference standard for any purpose.

You must not represent it as a medical device

Whether software is regulated as a medical device turns largely on how it is represented and what it is held out as being for. You must not describe, label, market, deploy, integrate, or hold out the Software, or any Output, as being for any medical purpose, as a diagnostic or screening tool, as clinical decision support, or as a validated measuring instrument. Doing so may make you a manufacturer or importer of an unlicensed medical device under the law that applies to you, with the regulatory consequences that follow.

📌 Clinical use is prohibited without exception

Nothing in this agreement permits clinical, diagnostic, or patient-care use, and no approval, authorisation, or instruction obtained from anyone else can make such use permitted here. It is prohibited absolutely, falls outside the licence granted in clause 9, is a fundamental breach of this agreement, and is expressly outside anything the OphthoRuler Developers accept responsibility for. You remain responsible for such use under clause 26.

5. How the measurements can be wrong

Every measurement the Software produces is an estimate derived from a two-dimensional photograph. It carries error you cannot see, and the following limitations are inherent to the method and are not defects to be fixed.

a. The Software measures pixels in a flat image of a three-dimensional face. Head yaw, pitch, and roll, camera distance, lens, and perspective all distort the result. In-plane roll is normalised for canthal tilt, and the motility chart and the levator comparison register photographs onto one another by an in-plane similarity fit of the canthi; no out-of-plane (yaw or pitch) correction is applied anywhere. The capture screen reads the head’s angle off the camera preview and warns when it is off; it does not prevent the photograph or correct it.

b. Conversion from pixels to millimetres depends on calibration. Unless you calibrate against a physical size reference in the photograph, the Software assumes a corneal white-to-white diameter of 11.71 mm taken from population literature. That assumption is wrong for any individual whose cornea differs from the population mean, and every millimetre value derived from it is proportionally wrong.

c. Errors in calibration propagate. A linear measurement scales with the calibration error; an area measurement such as palpebral fissure area scales with the square of it.

d. Results depend on gaze direction, lighting, pupil size, expression, eyelid position, makeup, and whether the brow was held. Levator function requires the brow to be held during upgaze; canthal tilt requires both eyes to be visible and correctly landmarked.

e. The motility chart summarises registered pupil excursion on a 0 to −4 underaction scale whose bands are taken from the clinical percentage method (−1 to −3 for roughly a quarter, half, and three-quarters of the expected excursion, −4 for a pupil that does not cross the midline). It describes the photographs supplied and is not an examination finding. It depends on the gaze positions actually held, on the pupil and canthal landmarks, and on the registration, and no band corresponds to any diagnosis.

f. The Sample Studies are entirely computer-generated data with no photographs, and exist to demonstrate the interface. Nothing in them may be reported as a research finding. If your library holds a demonstration study containing photographs, the Third-Party Notices say what may and may not be done with those images.

g. Flags shown against a measurement (uncalibrated, estimated calibration, degenerate geometry, missing dependency, or manually edited input) mark values the Software itself considers unreliable. An unflagged value is not thereby warranted to be correct; the absence of a flag means only that no automatic check happened to fire.

📌 Verify before you rely

You are responsible for independently checking every landmark, calibration, and value you rely on, publish, or act upon. Never rely on an unverified Output.

6. Machine-learning models

The Software runs machine-learning models on your device to place facial landmarks, refine eyelid contours, and segment the iris and pupil. No image, model input, or model output is sent to the OphthoRuler Developers, to any server, or to any third party for inference. All inference is local.

These models were trained by third parties on datasets that are unlikely to resemble your participants. They can fail, and they do so without warning: a model can return a confident and plausible but wrong landmark, and nothing in the Software will tell you so.

a. Model accuracy varies systematically with skin tone, eyelid and periorbital anatomy, age, ancestry, ptosis severity, eye colour, spectacles, lighting, and image quality. Performance measured on one population does not transfer to another. Systematic bias in a landmark model becomes systematic bias in every measurement and every statistic computed from it.

b. The iris and pupil segmentation model was trained on eye-filling smartphone iris images captured for biometric recognition rather than on flash macro or full-face photographs, and it produces incorrect results on some photographs taken this way, particularly extreme close-ups and downgaze where the lid occludes the pupil.

c. Running a model in batch across a cohort applies the same systematic error to every photograph at once. The batch runner offers to delete all existing labels first; that deletion cannot be undone.

d. The Software does not re-run models on its own. At start-up it surveys the library and reports photographs whose landmarks came from a superseded model version or whose measurements are behind their set’s current revision; re-running a model is something you ask for, on a scope you choose, and the batch runner records which version produced each result. Start-up does still stamp landmarks and measurements that belong to no recorded run into one, and after an update that changes a built-in measurement definition or the uncertainty model it may, once, re-bind the affected stored records to the revised definition or recompute their stored uncertainties. Derived values can therefore change between builds without a re-run.

e. Bundled models may be added, changed, replaced, or removed in any update. Measurements computed by different model versions are not guaranteed to be comparable, and re-running an analysis after an update may not reproduce your earlier result.

📌 Every model output needs a human check

Model output is a preliminary landmark placement that needs human review before it is treated as a result. You must visually inspect landmarks on every image whose measurements you rely on or publish, and you must record which model version produced them.

7. Statistics, reference ranges and risk models

The Software includes a statistical engine (mixed models, ANCOVA, reliability and agreement statistics, circular statistics, diagnostic accuracy with ROC and AUC, and logistic risk models) together with a “decision engine” that recommends an analysis for your design and blocks reporting when it detects a problem.

Parts of the engine have been cross-validated against R and against published canonical datasets, and that work is documented. That is a statement about numerical agreement on specific test cases. It is not a warranty that any result is correct, that the recommended model is right for your data, or that the engine is fit for your purpose.

a. The decision engine’s recommendations, warnings, and blocks are heuristics. They will miss problems they were never written to detect. A result that passes every check may still be invalid; a blocked result is not necessarily wrong.

b. Reference ranges, percentile limits, and centile curves computed by the Software are descriptive summaries of whatever data you gave it. They are neither normative values nor population norms, and they are not a basis for calling any individual’s measurement normal or abnormal. Their validity depends entirely on your sample’s size, selection, and representativeness.

c. Diagnostic accuracy Output (AUC, sensitivity, specificity, predictive values, and Youden thresholds) describes performance on your sample against whatever you nominated as the reference standard. It says nothing about performance in any other population, and does not validate anything for clinical use.

d. Risk-model Output (odds ratios, predicted probabilities, calibration, and optimism-corrected performance) is exploratory. A predicted risk shown by the Software must never be communicated to any individual as their risk, and must never inform their care.

e. The engine changes between versions. Analyses run on different versions may differ. Record the engine version, which the Software stamps into generated reports and reproducibility bundles.

📌 Responsibility for statistical analysis

You are responsible for choosing an appropriate design and analysis, for checking assumptions, for handling multiplicity, missing data, and clustering, and for the correctness of everything you report. Obtain qualified statistical review of any analysis you publish.

8. Generated manuscripts, figures and publication

The Software can generate manuscript sections, tables, figure legends, and a reproducibility bundle populated with your numbers. This is automated text assembly. It is not a substitute for scholarly work by the authors.

a. You are the sole author of anything you publish. The OphthoRuler Developers are not authors, contributors, or guarantors of your work, and take no responsibility for it.

b. You must read, check, and rewrite generated text before submission. Generated text may misdescribe what was computed, may omit caveats that matter for your data, and may assert things that are not true of your study.

c. You are responsible for complying with the authorship, disclosure, artificial-intelligence-use, and reproducibility policies of your institution, your funder, and every journal or conference you submit to, including disclosing that measurements and text were produced with software of this kind.

d. When the decision engine blocks reporting, the Software disables the export of a reproducibility bundle, and any generated manuscript that is produced while a block stands is marked as a draft that is not ready to report. That mark appears on the manuscript and not on every accompanying table, figure, or data file. Removing or ignoring it, or reporting a blocked result by extracting the underlying numbers, is a breach of this agreement.

e. Figures and exports may contain identifiable facial images. Censor bars, periocular cropping, and metadata stripping reduce but do not eliminate identifiability, and are not de-identification. Clause 13 applies to everything you export.

9. Licence, and what you may not do

Subject to your acceptance of this agreement and your continuing compliance with it, the OphthoRuler Developers grant you a personal, revocable, non-exclusive, non-transferable, non-sublicensable licence to install and use the Software on Apple-branded devices you own or control, for bona fide research and educational purposes only. The licence is personal to you: it extends to no other person, and anyone who has not accepted this agreement has no licence at all (clause 1).

The Software is licensed to you and not sold. All intellectual property in the Software remains with the OphthoRuler Developers and their licensors. No rights are granted except those expressly stated here.

You may not

a. use the Software for any clinical, diagnostic, screening, treatment, patient-care, or other medical purpose (clause 4);

b. use it for any purpose that is unlawful where you are, or that your institution, REB/IRB, professional body, or employer prohibits;

c. use it to identify, re-identify, track, surveil, profile, or authenticate any individual, or to build, train, evaluate, or improve any facial-recognition, biometric-identification, emotion-inference, or demographic-inference system;

d. capture, import, or process any image of any person without the consent, waiver, authorisation, and approvals required by clause 11 and clause 12;

e. sell, rent, lease, sublicense, distribute, host, or provide the Software as a service to anyone else, use it to provide a paid service to third parties, or allow anyone who has not accepted this agreement to use it;

f. reverse engineer, decompile, or disassemble the Software except to the extent that restriction is unenforceable under applicable law;

g. remove, obscure, alter, or circumvent any notice, disclaimer, watermark, flag, warning, or safety gate the Software displays, including the draft watermark on blocked reports and the flags on unreliable measurements;

h. represent the Software or any Output as validated, certified, approved, clinical, or diagnostic (clause 4);

i. use the bundled sample or demo data for anything other than learning the Software, or extract, republish, or redistribute the images of any demonstration study in your library.

ℹ️ Breach ends the licence

The licence terminates automatically, without notice, if you breach any part of this agreement. Clauses 4 to 8 and 11 to 30 survive termination.

10. Who may use the Software

The Software is made available to researchers, research trainees, and educators working under the supervision of a research institution or an equivalent governance structure, and to individuals evaluating it without any real participant data.

It is not offered to patients, to the general public, or for personal, family, or household purposes, except that clause 20(b) permits access by accounts associated with you through Family Sharing, and anyone using it that way is bound by this agreement. It is supplied free of charge; no fee is or has been payable for it.

10.1 Territorial availability and mandatory rights

⚠️ Use the Software only where permitted

You may use the Software only where its distribution and your intended use are lawful. Availability through an app store does not establish that a particular research use is permitted in your jurisdiction or at your institution. If applicable law or an institutional requirement prohibits your intended use, do not use the Software for that purpose.

Clause 28 selects Alberta law and courts to the fullest extent permitted by law. Mandatory rights that cannot lawfully be waived remain in effect. The consumer and jurisdiction-specific provisions in clause 27 apply where relevant.

ℹ️ Mandatory rights remain in effect

Nothing in this agreement excludes, restricts, or modifies a right or remedy that applicable law does not permit the parties to exclude, restrict, or modify.

10.2 Consumer status

ℹ️ This clause does not decide your legal status

Nothing in this clause determines your status under any consumer-protection legislation, and nothing in this agreement excludes, restricts, or modifies any right or protection such legislation confers on you where it applies. Where a provision of this agreement would be unenforceable against you under that legislation, it does not apply to you and the rest of the agreement continues.

You represent that you have the training and competence to judge whether the Software’s Output is plausible in your domain, and that you are not relying on the OphthoRuler Developers for that judgement.

11. Ethics approval and legal compliance

📌 The Software never checks whether your use is lawful

The Software does not know your jurisdiction, your institution, your protocol, your consent status, or your approvals. It never determines, verifies, certifies, or asserts that anything you do with it is lawful, ethical, approved, or compliant. It records only that you said it was. Nothing in the Software, its documentation or these documents is legal advice.

Before you capture, import, or process any person’s data, you are responsible for:

a. obtaining and maintaining approval from your REB/IRB or equivalent for every study you run, and for the specific use of this Software within it, including any amendment needed to add photography, an app, or on-device machine learning to an existing protocol;

b. determining whether your use is permitted at all in your jurisdiction, at your institution, and under your professional obligations, and whether local rules prohibit uncertified software, foreign software, or software without a privacy impact assessment;

c. complying with every privacy and health-information law that applies to you. Depending on who and where you are, that may include Alberta’s Health Information Act and Personal Information Protection Act, PIPEDA, Alberta’s FOIP Act, Ontario’s PHIPA and other provincial statutes, HIPAA, US state biometric-privacy laws such as Illinois’ BIPA and Texas’ CUBI, the EU and UK GDPR, and any other applicable regime;

d. completing any privacy impact assessment, security review, data-protection impact assessment, threat-risk assessment, or vendor review your institution or regulator requires, including, if you are a custodian under Alberta’s Health Information Act, any assessment that must be submitted to the Office of the Information and Privacy Commissioner before a new information system is used;

e. complying with research-ethics norms binding on you, including the Tri-Council Policy Statement (TCPS 2) in Canada, the Declaration of Helsinki, Good Clinical Practice where it applies, and your funder’s and sponsor’s requirements;

f. determining what regulatory authorisation or exemption your study requires, and obtaining it, noting that no authorisation obtained for your study makes any use of the Software permitted that clause 4 prohibits;

g. data governance for the whole life of the data: retention schedules, storage location and cross-border transfer, access control, secure disposal, and honouring withdrawal of consent.

⚠️ Your local rules may prohibit this entirely

Your REB/IRB, institution, professional college, or employer, or the law of your country or province, may not permit research data to be held in software like this at all: uncertified, unaudited, and synced between personal devices. Confirm that the proposed use is permitted before you begin. If in doubt, ask your REB and your privacy office first.

12. Participant consent and disclosure

Before using any person’s image or data, you must have a documented basis permitted by applicable law and your REB/IRB. Ordinarily this will be valid, informed consent that specifically covers the proposed use. A waiver of consent, use of previously collected data, or use involving a deceased person is permitted only where it is expressly authorised by your REB/IRB and applicable law.

Consent, or the authority for proceeding without it, must be obtained, documented, and retained in the manner your REB/IRB and applicable law require. Consent to clinical photography, treatment, or a different study does not by itself authorise this use.

📌 You must disclose the specific risks of this Software

Where consent is obtained, your consent process must tell each participant, in language they understand, what this Software does with their data and what can go wrong with it. The Participant Disclosure document supplied with the Software sets out the minimum points that must be covered. It forms part of this agreement, and you must incorporate its substance into your own consent materials, adapted as your REB/IRB directs.

The points that must be disclosed include, at a minimum: that photographs of the face and eyes are inherently identifiable; that the photographs and records are held on ordinary personal devices and encrypted there, which lowers the risk of a leak without removing it; that copies leaving the app as exports, figures, archives, shared files, or camera-roll copies are not encrypted; that copies may be saved automatically to the device’s photo library and from there to a cloud photo service; that data are transferred between the researcher’s own devices; that data may be exported, shared, and included in figures and publications; that automated models process the images; that a bright light is shone close to the eyes for pupil photographs; that no security can be guaranteed and a leak, loss, or re-identification is possible; and how the participant may withdraw and what withdrawal can and cannot undo.

You must also honour withdrawal. Erasing a participant destroys the key that their photographs were encrypted with, so every encrypted copy that key protected (on this device, on the device you sync with once the change reaches it, and in encrypted backups restored afterwards) should become unreadable, whether or not they are also deleted, for as long as the encryption holds. The Software records the erasure outside the encrypted store and carries that record into every backup made afterwards. Once a device has learned of an erasure, by performing it, by syncing with a device that did, or by restoring any backup made after it, no later restore of an older backup can bring that participant back there, whatever keys the older backup carries. Two things reach further than the Software can. First, a machine whose only contact with the data is material from before the erasure (a fresh computer restoring an old backup on its own terms) has never learned of it, carries the pre-erasure keys, and can open them, so destroying backups made before an erasure remains part of a complete withdrawal. Second, nothing cryptographic touches unencrypted copies at all: plain backup destinations, exports, figures, archives, shared files, and camera-roll copies must still be found and deleted by hand. Ordinary deletion of a single photograph remains ordinary deletion; see clause 16.

13. What you must not put into the Software

⚠️ No personal identifiers, no Personal Health Information

Do not enter names, initials, dates of birth, medical record, hospital, health-card, or insurance numbers, addresses, telephone numbers, email addresses, government identifiers, or any other direct identifier anywhere in the Software, including participant codes, demographics, notes, tags, study names, folder names, encounter labels, column names, categorical levels, file names, or free text. Identify participants by study code only.

Keep the key linking study codes to identities somewhere else entirely, secured and retained under your REB/IRB-approved data-management plan.

The Software is not a system of record for Personal Health Information and must not be used as one. It is not designed, built, tested, or certified for that purpose, it makes no claim to satisfy any health-information, privacy, or security standard, and no approval from an REB/IRB, an institution, or anyone else changes either fact or makes such use permitted under this agreement.

Photographs of the face and eyes, and measurements derived from them, are regulated information in their own right under the law that applies to you, whether or not any identifier accompanies them. Recording them in the Software does not make them any less so. Working out what your law requires of you before you record anything, and meeting it, is your responsibility alone.

📌 The identifier check is a courtesy and not a control

The Software applies a simple pattern check that tries to catch obvious names and dates. It runs on participant codes wherever you enter or change one, on the demographics field, and on tabular column names and levels. It does not run on notes, tags, encounter labels, study names, or folder names, which are free-text fields you are just as likely to type a name into. It is a heuristic, biased toward certain formats and languages, and it misses far more than it catches. It is not de-identification, it is not a control, and you must not rely on it.

Faces are identifiers

A photograph of a person’s face, periocular region, or iris is itself identifying information and, under many laws, biometric or special-category data attracting heightened protection. A study code in place of a name does not make a facial photograph de-identified or anonymous. Cropping to the eyes, applying a censor bar, and stripping metadata reduce risk but do not anonymise anything, and iris texture visible in a high-resolution photograph is itself a biometric. Treat every image, export, figure, and archive accordingly.

14. How the Software handles your data

Read this clause carefully. It describes what the Software does, including the parts that are weaker than researchers usually assume.

The Data and Security Statement supplied with the Software gives the full detail and forms part of this agreement. In summary:

a. Everything stays on your own devices. The Software has no server, no cloud account, no analytics, and no telemetry. The OphthoRuler Developers never receive your Study Data, cannot access it, cannot recover it, and have no ability to help you if it is lost or exposed.

b. Photographs are encrypted at rest under a key derived from a password only you hold, and so are the contents of your study records: participant codes, demographics, notes, tags, study and folder names, labels, landmark geometry, measurements, and the whole tabular study-variable dataset. Setting this up cannot be skipped or postponed. What is not concealed is the shape of the database holding them: how many participants, encounters, and photographs exist, the dates attached to them, internal identifiers, and the names of the measurements the Software itself defines. On macOS that layer depends on FileVault, which the Software recommends but does not require, does not verify at setup, and cannot enable. Photographs and records that pre-date your encryption setup stay unencrypted until a background pass finishes sealing them, and the Software shows you how many remain. The Data and Security Statement sets out exactly what is covered and what is not.

c. On iPhone, the Software can save a copy of every photograph you capture into the device’s own photo library. This is OFF unless you turn it on. The copy carries the same metadata stripping as the one kept inside the Software, but it is an ordinary unencrypted image once it is in the photo library: it leaves the Software’s control entirely and will be uploaded by iOS to iCloud Photos or any other photo-syncing service you use, possibly storing participants’ faces outside your country. Turn it on only if your ethics approval and your consent materials cover it.

d. Backups can be encrypted; everything else you export cannot. Once encryption is set up, backup destinations default to encrypted and each has its own switch. A destination you mark unencrypted is written as plain files by decrypting on the way out, which is your choice to make. A destination’s setting governs only what is written afterwards: snapshots already on that drive stay as they were written, so plain ones stay readable until you delete them. Image exports, figures, study archives, and reproducibility bundles are always plain files containing full-resolution facial photographs. On macOS the Software holds persistent write access to any folder you nominate as a backup destination so scheduled backups can run unattended; choose those folders deliberately, and note that a folder synced to a cloud service carries participants’ photographs into it. The iPhone share panels send composited images containing faces to whatever destination you choose, under that destination’s own terms.

e. Sync between your Mac and your iPhone runs over the local network or a direct device-to-device link, and the transfer is encrypted. Device keys are stored in a permission-restricted file rather than the system keychain. Pairing by typed code offers materially weaker protection than pairing by QR code against an attacker who is present on your network during pairing; prefer the QR code.

f. On import and on capture the Software rewrites every photograph with its pixels and no metadata block at all (EXIF, TIFF, IPTC, XMP, maker notes, and the embedded thumbnail are all removed, not only GPS) and bakes in orientation. The capture date and time, camera model, lens, and exposure are read first and kept in the Software’s own encrypted record, not in the file. Removing metadata does not de-identify an image.

g. Photographs are stored and named by a hash of their own contents. The same photograph imported twice is stored once, and deleting one record does not necessarily erase the bytes another record still refers to.

📌 Responsibility for Study Data

As between you and the OphthoRuler Developers, you alone are the controller, custodian, and steward of all Study Data, and you alone hold every obligation attaching to it. The Software runs entirely on your own devices; the OphthoRuler Developers operate no service, receive no Study Data, hold no copy, and carry out no processing operation on your behalf. On that basis they are, as a matter of fact, neither your processor nor a joint controller, and are a supplier of a product. This records the factual position. It does not purport to decide anyone’s status, which is a question of fact under the law that applies to you. If the OphthoRuler Developers were ever to process personal data on your behalf, a written agreement meeting the requirements of that law would be put in place first.

15. Security is not guaranteed

⚠️ No security guarantee of any kind is given

The OphthoRuler Developers do not warrant, represent, or guarantee that the Software is secure, that it is free of vulnerabilities or malicious code, that its cryptography is correctly designed or correctly implemented, that it resists any particular attacker, or that your Study Data will not be accessed, copied, altered, leaked, published, ransomed, or re-identified. The Software has not undergone any independent security audit, penetration test, or cryptographic review.

ℹ️ How to read anything these documents say about security

Where these documents describe what a security measure does (encryption, key handling, erasure, sync, or backups), they describe what it is designed and intended to do, and they do not describe a guaranteed outcome. Such measures may reduce the likelihood or the impact of an incident; none of them prevents one, and none is represented as effective against any particular attacker, technique, or future advance. Nothing in these documents is a representation, warranty, or condition about the security of the Software or of your Study Data, and clause 23 applies to every such description.

Device and account security, physical security, screen locks, full-disk encryption, backup security, network security, malware protection, access control, and secure disposal are entirely your responsibility.

What the encryption does, and what it cannot do

a. It is intended to reduce the risk that someone who obtains the files without your password can read them (a stolen laptop, a recovered disk, a copied backup), but it does not eliminate that risk, and no assurance is given that it will hold against any particular attacker. It gives no protection against someone using your unlocked device while the vault is open or against malware running under your user account.

b. The protection is no stronger than your password. Anyone who obtains the encrypted files can guess at it offline, without limit of time, and the Software cannot stop them. It enforces a minimum length and refuses passwords that match common patterns, but that is a minimum and does not measure safety: a password the Software accepts may still be guessable. Choose one you have never used elsewhere.

c. The optional app lock uses the device’s own authentication (Face ID, Touch ID, or the device passcode or Mac password) and locks the app on that device. It is a convenience and physical-access protection and is not encryption: it does not protect against anyone who reads the files directly.

d. The Software keeps your unlock key in the system keychain of each device, marked for that device only and never synchronised to iCloud, so you are not asked for the password every time. It is stored nowhere else, and never in a file on disk: where the keychain will not hold it, nothing is stored and that device asks for the password at every launch. Someone with your unlocked account may still be able to open the vault without knowing the password. Turning on the option to require the password at every launch removes the stored key from that device.

If Study Data are lost, exposed, or breached, responding is entirely your responsibility: containment, assessment, notifying your privacy officer, your REB/IRB, your institution, affected participants, and any regulator such as the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada, and any remediation or compensation. The OphthoRuler Developers have no ability to detect, investigate, contain, notify, or remediate anything, and accept no obligation to do so.

If you discover a security vulnerability in the Software, please report it privately to m9zo8bcek.1zrk6eq9lryuv6rr3ogth6vtwbh6opgsoh7@d7lm6a46gzwefglka and give a reasonable time for it to be addressed before disclosing it publicly. Nothing in this agreement obliges anyone to fix it.

16. Data loss, and actions that cannot be undone

Software loses data. Plan for it, and do not keep the only copy of anything here.

⚠️ If you lose the password and the Emergency Recovery Kit, the data cannot be recovered

The data are encrypted, so if the keys are lost the data cannot be recovered. Your password and your 12-word recovery code exist only where you keep them. The OphthoRuler Developers never receive or hold the keys and cannot reset them, and there is no back door, support route, or recovery mechanism. If you lose both, there is no way back to any encrypted photograph, whether through the OphthoRuler Developers, through Apple, or through any support route. Print the Emergency Recovery Kit and keep it offline: a locked drawer, and an unplugged USB drive as a second copy. Do not keep it on any internet-connected device, and never in e-mail, iCloud, Dropbox, or your photo library. Delete the saved file once you have printed or copied it. Your obligation to retain research records for the period your REB requires depends on your doing this properly. Note also that the recovery code alone restores data from a backup or another paired device; it cannot restore data onto a fresh device that has none.

a. On macOS the Software runs a scheduled local backup of the library, on by default, and only while the app is open. It is a convenience and is not guaranteed: it can silently miss a run, and while destinations are encrypted by default, any destination you have marked unencrypted receives plain files containing full-resolution facial photographs. One destination inside the application’s own folder always receives backups and cannot be switched off; any other destination is one you add. You must secure every destination and include it in your retention and erasure plans. On iPhone the Software makes no backup of its own; the phone’s own iCloud or computer backup includes its data, as the Data and Security Statement describes. Keeping independent, tested backups of anything you cannot afford to lose remains your responsibility, and those backups carry the same REB/IRB and privacy obligations as the originals.

b. Several actions are irreversible: permanently erasing a study or its images, deleting all existing labels before a batch model run, and purging image bytes. Undo does not reach them and no confirmation makes them recoverable.

c. Ordinary deletion is not erasure. Deleted studies, participants, encounters, and photographs are hidden but retained, and the underlying image bytes remain on disk until you explicitly purge them. If a participant withdraws consent, hiding their record does not remove their data.

d. Start-up maintenance does not re-run models or discard labels; it surveys the library and reports what a re-run would touch. It does still rewrite some of your work: landmarks and measurements that belong to no recorded run are stamped into one, and after an update that changes a built-in measurement definition or the uncertainty model the affected stored records may, once, be re-bound to the revised definition or have their stored uncertainties recomputed. Check by hand anything you intend to rely on.

e. Opening one library from two copies of the app at once has previously corrupted data. A library written by a newer build may become unreadable to an older one, and an update that changes the data schema may make a library unopenable.

f. Sync resolves differences between devices and can overwrite or delete records on one device based on the state of another. The archive hand-off deletes the iPhone’s copy of a study once the Mac reports it holds the data.

📌 Take a copy before every update

Before updating either app, before any batch run, and before any bulk edit, take a copy you control, such as a study archive or a verified library backup on macOS. Note that study-archive export is a macOS function: the iPhone cannot export an archive, so an iPhone-only user’s protection is the Mac it syncs to. The OphthoRuler Developers cannot recover anything for you and hold no copy of anything.

17. Not a regulated system of record

The Software keeps no tamper-evident audit trail. It does not record an unalterable history of who changed what, when, or why. Records can be edited, deleted, and regenerated without trace, and computed values can change between versions of the Software.

⚠️ Do not use it where record integrity is regulated

The Software is not designed or validated to meet any electronic-records or electronic-signature requirement, and does not satisfy US FDA 21 CFR Part 11, EU Annex 11, ICH E6 Good Clinical Practice, ALCOA+ data-integrity expectations, or any equivalent. Do not use it as the source-data system for a regulated clinical trial, for a submission to any regulator, for any legal or forensic purpose, or anywhere the integrity and traceability of the record is legally required.

If your study needs an auditable record, keep it in a system that provides one and treat the Software’s Output as a derived measurement only.

18. Third-party components and sample data

The Software includes machine-learning models, code, and data created by third parties, listed with their licences and citations in the Third-Party Notices document and on the Software’s model cards. Those components are governed by their own licences, which you must comply with, and are supplied by their authors without warranty.

Licence and attribution information is taken from the source repositories identified in the Third-Party Notices as they appeared on the revision date. If you believe a notice is incomplete or incorrect, contact m4jocdc3m.fgrrqe5mlncuu1raxop1hedtxhhwnpdco3y@yvlkhanvgjpeyil9a so it can be investigated and corrected. Third-party components remain subject to their own licence terms.

The Software ships sample and demonstration studies containing synthetic data only, supplied for the sole purpose of learning the interface; it bundles no photographs. You must not report on them or treat any value in them as a real measurement. Where your library holds a demonstration study containing photographs, you must not extract, copy, redistribute, publish, or analyse those images.

Using the Software with images or datasets you obtained from anyone else (a public face database, a colleague, a registry, or a hospital archive) is your responsibility. You must hold the rights and the ethical approvals needed to use them in this way, and must comply with the terms of whatever database they came from, several of which prohibit redistribution or use in facial-analysis software.

19. Export control, sanctions, and trade compliance

The Software contains cryptographic functionality used to protect data transferred between your devices, including X25519 key agreement and ChaCha20-Poly1305 authenticated encryption. Cryptographic software is controlled in many countries.

The Software may be subject to Canada’s Export and Import Permits Act and the Export Control List, including Category 5 Part 2 (Information Security) of the Dual-Use List, to the United States Export Administration Regulations, and to equivalent controls elsewhere.

You represent, warrant, and agree that:

a. you are not located in, ordinarily resident in, or a national of any country or territory subject to a comprehensive embargo or sanctions administered by Canada, the United States, the United Nations, the European Union, or the United Kingdom, and you will not use the Software in or from such a place;

b. you are not a person or entity designated on any restricted-party, denied-party, specially designated national, or sanctions list maintained by any of those authorities, and you are not owned or controlled by such a person;

c. you will not export, re-export, transfer, release, or make the Software or its cryptographic functionality available, directly or indirectly, in breach of any applicable export-control, sanctions, or trade law;

d. you will not use the Software in connection with the development or production of nuclear, chemical, or biological weapons, missiles, or any other prohibited end-use;

e. you are responsible for obtaining any permit, licence, authorisation, registration, or notification that your own jurisdiction requires before you import, install, use, or carry the Software across a border, including any import restriction on cryptography.

📌 Crossing borders with study data

Taking a device containing participant photographs into another country may be a cross-border transfer of personal information requiring its own legal basis, and may expose the data to border inspection. That is your responsibility to assess before you travel.

20. Apple App Store terms

Where you obtained the Software through Apple’s App Store or TestFlight, the following apply and prevail over anything inconsistent elsewhere in this agreement:

a. This agreement is between you and the OphthoRuler Developers only, and not with Apple Inc. The OphthoRuler Developers, not Apple, are solely responsible for the Software and its content.

b. The licence granted to you is a non-transferable licence to use the Software on any Apple-branded products that you own or control, as permitted by the Usage Rules in the Apple Media Services Terms and Conditions, except that the Software may be accessed and used by other accounts associated with you via Family Sharing or volume purchasing.

c. The OphthoRuler Developers are solely responsible for providing any maintenance and support services for the Software. Apple has no obligation whatsoever to furnish any maintenance or support services.

d. The OphthoRuler Developers are solely responsible for any product warranties, whether express or implied by law, to the extent not effectively disclaimed. In the event of any failure of the Software to conform to any applicable warranty, you may notify Apple, and Apple will refund the purchase price (if any) for the Software to you; and, to the maximum extent permitted by applicable law, Apple will have no other warranty obligation whatsoever with respect to the Software, and any other claims, losses, liabilities, damages, costs, or expenses attributable to any failure to conform to any warranty will be the OphthoRuler Developers’ sole responsibility.

e. The OphthoRuler Developers, not Apple, are responsible for addressing any claims by you or any third party relating to the Software or your possession and use of it, including product liability claims, any claim that the Software fails to conform to any applicable legal or regulatory requirement, and claims arising under consumer protection, privacy, or similar legislation. This agreement may not limit the OphthoRuler Developers’ liability to you beyond what is permitted by applicable law.

f. In the event of any third-party claim that the Software or your possession and use of it infringes that third party’s intellectual property rights, The OphthoRuler Developers, not Apple, will be solely responsible for the investigation, defence, settlement, and discharge of that claim.

g. You represent and warrant that you are not located in a country that is subject to a U.S. Government embargo, or that has been designated by the U.S. Government as a “terrorist supporting” country, and that you are not listed on any U.S. Government list of prohibited or restricted parties.

h. The OphthoRuler Developers may be contacted at Jeremy Moreau, RGH Eye Clinic, 7007 14 St SW, Calgary, Alberta T2V 1P9, Canada · m1io8pcyn.0tr6jepgl86uj1rpgojhhbrthmhkapzbo9n@9vlrqatxgguejvl3t · 0kd2yn8bw3dx-t60ae08z892-lh3ce0m74tb p8140+s9 for any question, complaint, or claim about the Software.

i. You must comply with applicable third-party terms of agreement when using the Software.

j. Apple Inc. and its subsidiaries are third-party beneficiaries of this agreement, and upon your acceptance of it Apple will have the right (and will be deemed to have accepted the right) to enforce this agreement against you as a third-party beneficiary of it.

21. Feedback, bug reports, and contributions

If you send the OphthoRuler Developers feedback, a bug report, a suggestion, or a feature request, you grant a perpetual, irrevocable, worldwide, royalty-free licence to use it in the Software and its documentation without obligation or compensation, and you confirm you have the right to give that licence. Contributions of code are not covered by this clause and are accepted only under a separate contributor agreement.

⚠️ Never send participant data

Do not include any photograph, participant record, study archive, log, screenshot, crash report, or database containing any real person’s data in anything you send. Reproduce the problem with the sample data instead. Sending participant data is a disclosure of that data, is a breach of this agreement by you, and is probably a breach of your protocol. Material containing participant data that reaches the OphthoRuler Developers will be deleted as soon as it is identified, will not be used for any purpose, and you will be told. You remain responsible for any notification or reporting the disclosure requires.

22. Changes, updates, and ending the licence

The OphthoRuler Developers may change, update, suspend, restrict, or discontinue the Software, or any feature of it, at any time and without notice, and are under no obligation to provide updates, fixes, support, migration paths, continued compatibility, or continued availability. The Software may stop working entirely, for example when an operating system changes.

The OphthoRuler Developers may revise this agreement, the Disclaimer, the Data and Security Statement, and the Participant Disclosure. A revised version governs only after the Software presents it to you and you accept it. Until then, the version you previously accepted continues to govern your use.

Each version is numbered and dated. Revisions are published at ophthoruler.com and included in a released build, where the acceptance screen identifies the version being offered. Publication alone does not amend the agreement you accepted.

📌 Revisions are not retroactive, and you may decline them

A revision does not affect any right or liability that accrued before it took effect, and does not revive a claim already barred. If you do not agree to one, your remedy is to stop using the Software and delete it. If you need to get data out or erase it first, the paragraph below applies.

ℹ️ The copy inside the app is the copy you accepted

Settings shows the version you accepted, when you accepted it, and the application build in use at the time. That copy is evidence of your agreement. The website at https://ophthoruler.com/terms may show a later version, but that later version does not bind you until it is presented and accepted.

You may end this agreement at any time by deleting the Software. The OphthoRuler Developers may terminate it immediately if you breach it. On termination the licence ends and you must stop using the Software; your obligations regarding data you already collected continue, as do the clauses stated to survive.

📌 Declining, and your obligations to Participants

The acceptance screen blocks the Software until it is accepted, so declining a revised agreement currently means you cannot open the app, including to export or erase data you already collected. If you need to meet an obligation to a Participant and do not wish to accept, write to mxbog9cbe.lprgvebwl2juyhrhgoashcqtpqhx9pemoy3@mzl9ba9ng56erklwz and a means of retrieving or erasing your data will be provided. Nothing in this agreement is intended to stand between a Participant and their right to have their data erased, and no acceptance is required for the OphthoRuler Developers to help you honour one.

23. Disclaimer of warranties

⚠️ Supplied as is

THE SOFTWARE AND ALL OUTPUT ARE PROVIDED “AS IS” AND “AS AVAILABLE”, WITH ALL FAULTS AND WITHOUT WARRANTY, CONDITION, REPRESENTATION, OR GUARANTEE OF ANY KIND, EXPRESS, IMPLIED, STATUTORY, COLLATERAL, OR OTHERWISE.

To the maximum extent permitted by applicable law, the OphthoRuler Developers expressly disclaim all warranties and conditions, express or implied, including any implied warranty or condition of merchantability, merchantable quality, durability, fitness for a particular purpose, accuracy, precision, reliability, completeness, quiet enjoyment, non-infringement, title, security, availability, or arising from a course of dealing, usage, or trade practice.

Without limiting that, no warranty is given that: the Software will meet your requirements or be suitable for your study; any measurement, statistic, model output, or generated text is accurate, unbiased, reproducible, or valid; the Software will operate uninterrupted or error-free; defects will be corrected; the Software is free of harmful components; your data will be preserved, recoverable, or kept confidential; or that use of the Software complies with any law, regulation, standard, guideline, ethics requirement, or institutional policy applicable to you.

No advice or information, whether oral or written, obtained from the OphthoRuler Developers or through the Software (including the Statistics Guide, help pages, measurement explanations, model cards, specifications, published papers, or repository documentation) creates any warranty, and none of it is legal, ethical, statistical, regulatory, or medical advice.

ℹ️ Rights that cannot be excluded

Some jurisdictions do not allow the exclusion of certain warranties or conditions. Nothing in this agreement excludes, restricts, or modifies any guarantee, warranty, term, condition, or right that applicable law does not permit to be excluded, restricted, or modified. Where such a right applies and cannot be excluded, the OphthoRuler Developers’ liability is limited, to the extent the law permits, to the greater of supplying the Software or equivalent software again and the amount in clause 24(c). Resupply is not offered as an exclusive remedy where the law does not permit it to be.

24. Limitation of liability

⚠️ Allocation of risk

THE SOFTWARE IS SUPPLIED FREE OF CHARGE FOR RESEARCH USE. YOU ACCEPT THAT THE ALLOCATION OF RISK IN THIS CLAUSE IS A FUNDAMENTAL BASIS ON WHICH IT IS MADE AVAILABLE AT ALL, AND THAT WITHOUT THIS CLAUSE IT WOULD NOT BE MADE AVAILABLE TO YOU.

To the maximum extent permitted by applicable law:

a. The OphthoRuler Developers will not be liable for any indirect, incidental, special, exemplary, punitive, or consequential loss or damage whatsoever, however caused and on any theory of liability, whether contract, tort (including negligence), strict liability, statute, equity, or otherwise, and even if advised of the possibility of it or if a limited remedy fails of its essential purpose;

b. in particular, the OphthoRuler Developers will not be liable for: loss, corruption, destruction, or inaccessibility of any data; unauthorised access to, disclosure of, leakage, publication, theft, or re-identification of any data; loss of profits, revenue, funding, grants, or business; loss of, or damage to, reputation, standing, or academic career; retraction, correction, or rejection of any publication; invalidation, suspension, or termination of any study; loss of REB/IRB approval or of accreditation; regulatory investigation, audit, enforcement, fine, or penalty; the cost of breach notification, credit monitoring, remediation, or substitute software; wasted time or research delay; or any claim made against you by a participant, an institution, a funder, a journal, a regulator, or anyone else;

c. subject to clause 24.1, the OphthoRuler Developers’ total aggregate liability arising out of or in connection with this agreement, the Software and all Output, for all claims combined, will not exceed the total amount you paid for the Software during the 12 months before the event giving rise to the claim. If you obtained the Software without payment, that amount, and the cap, are zero.

These limitations apply to every claim of every kind, whether or not the OphthoRuler Developers knew or should have known of the possibility of the loss, and they apply for the benefit of every individual within the definition of the OphthoRuler Developers, each of whom may rely on this clause directly.

24.1 Liability that is never excluded, limited, or released

ℹ️ This applies to clauses 23, 24, and 25 alike

Nothing in this agreement, including the disclaimer of warranties, this limitation, and the release in clause 25, excludes or limits the liability of the OphthoRuler Developers for, or releases them from: (a) their fraud or fraudulent misrepresentation; (b) their wilful misconduct; (c) their gross negligence; (d) death or personal injury caused by their negligence; (e) their liability under legislation prohibiting false or misleading representations; or (f) any other liability that applicable law does not permit to be excluded, limited, or released. Where such liability arises, the rest of this agreement continues to apply to every other claim.

24.2 Telling us about a claim

If you become aware of anything you consider may give rise to a claim, notify the OphthoRuler Developers in writing at the address in clause 30, with reasonable particulars, within 90 days of becoming aware of it. Failing to give that notice does not bar your claim, but the OphthoRuler Developers are not liable for any part of the loss that could have been avoided or reduced had the notice been given. Nothing in this agreement shortens any limitation period, which the law of some places, including Alberta, does not permit in any event.

25. Assumption of risk and release

Clauses 4 to 8 and 14 to 17 describe how the Software can fail. Having been given those descriptions, you choose to use it, and you knowingly assume the risks they describe, including the risk that a measurement is wrong, that an analysis is invalid, that data are lost, and that participant images are exposed or re-identified.

To the maximum extent permitted by applicable law, you release the OphthoRuler Developers from every claim, demand, action, and cause of action arising out of or relating to the Software, any Output, or your use of either, that had accrued to you when you accepted this agreement; and you waive any claim arising afterwards to the extent it arises from a limitation, characteristic, or behaviour of the Software described in clauses 4 to 8 and 14 to 17.

ℹ️ What this release does not touch

This release does not apply to any liability preserved by clause 24.1, and it does not release any claim arising from conduct or from a defect that clauses 4 to 8 and 14 to 17 do not describe.

26. Your responsibility for your use

You remain responsible for your own acts and omissions and for the acts and omissions of anyone to whom you give access to the Software. This includes responsibility for obtaining the approvals and authority required by clauses 11 and 12, keeping identifying information out of the Software as clause 13 requires, handling Study Data lawfully, and complying with the restrictions in this agreement.

ℹ️ No indemnity or duty to defend

This agreement does not require you to defend, indemnify, hold harmless, or reimburse the OphthoRuler Developers in respect of a third-party claim. It does not, however, release you from liability you may owe directly under applicable law to a Participant, institution, regulator, or other person. Those persons are not parties to this agreement, and their rights are not determined by it.

27. If you are outside Canada

This agreement is written under Alberta law. If you use the Software outside Canada, mandatory local law may also apply. The following provisions supplement this agreement and prevail over inconsistent terms to the extent required by that law.

Data protection in the EEA and the United Kingdom

a. Study Data may include special categories of personal data under Article 9(1) of the GDPR, including data concerning health. Images or measurements are biometric data within Article 4(14) only when they result from specific technical processing relating to physical, physiological, or behavioural characteristics and allow or confirm unique identification; Article 9(1)’s biometric category applies when those data are processed for that purpose. You must identify and document an Article 6 legal basis and, where Article 9 applies, an Article 9(2) condition. Research-ethics consent is not automatically explicit consent under Article 9(2)(a), and the correct basis depends on applicable Union or Member State law and your institutional status.

b. Replacing a name with a study code produces pseudonymised personal data under Article 4(5). It does not produce anonymous data and does not take the processing outside the Regulation. Nothing in this agreement that speaks of de-identified data means otherwise.

c. You must determine before processing whether Article 35 or a supervisory authority’s published list requires a data protection impact assessment. A DPIA is required where the proposed processing is likely to result in a high risk, including the examples in Article 35(3); it is not automatically required for every study using the Software.

d. You must not use the Software for biometric identification: do not derive an iris code or other biometric template, and do not match any photograph against any gallery. Doing so falls outside the licence and may engage Article 9(1) of the GDPR, as well as other biometric and artificial-intelligence rules depending on the purpose and context.

e. Under Article 33, a controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. Article 34 requires notice to affected individuals where the breach is likely to result in a high risk, subject to its exceptions. Chapter V applies when a controller or processor subject to the GDPR makes personal data available to a separate controller or processor in a third country or international organisation. Travel with a device and use of cloud services require a fact-specific transfer and security assessment; they are not automatically the same legal event.

The Artificial Intelligence Act

The Software’s landmark and segmentation models run locally and are never trained or updated by your use. They do not identify or verify anyone, perform no remote biometric identification, categorise no one by any protected or sensitive attribute, and infer no emotion. Where the Software records ancestry, skin tone, or other demographic variables, you enter them as study variables and the Software never infers them from an image. Generated manuscript text is produced by fixed templates populated with your own numbers and not by a generative model. Article 4 requires providers and deployers to take measures, to their best extent, to ensure an appropriate level of AI literacy among relevant staff and other people operating the systems on their behalf.

Liability in the EEA, the United Kingdom, and Switzerland

ℹ️ This replaces the cap in clause 24 where you are

The Software is supplied to you free of charge. The OphthoRuler Developers are liable without limitation for damage caused intentionally or by gross negligence, for injury to life, body, or health, for fraudulent concealment of a defect, under any applicable product-liability legislation, and for any other liability that cannot lawfully be excluded. For breach caused by simple negligence of an obligation whose fulfilment makes proper performance of this agreement possible in the first place and on which you may regularly rely, liability is limited to the damage that is foreseeable and typical for an agreement of this kind. All other liability for simple negligence is excluded. Nothing in this agreement limits liability in a manner prohibited by the mandatory law that applies to you.

Consumers

If you are a consumer under the law of your own country, the mandatory protections of that law continue to apply to you and are not affected by the choice of law or forum in clause 28. Any term of this agreement that is unfair or void under that law does not bind you, and the rest of the agreement continues.

28. Governing law and where disputes are decided

This agreement, and any dispute or claim arising out of or in connection with it, the Software, or any Output (including non-contractual claims) is governed by and construed in accordance with the laws of the Province of Alberta and the federal laws of Canada applicable therein, without regard to conflict-of-laws rules.

You and the OphthoRuler Developers submit to the exclusive jurisdiction of the courts of the Province of Alberta, sitting in Calgary, Alberta. Any dispute or claim arising out of or in connection with this agreement, the Software, or any Output (including non-contractual claims) must be brought there and nowhere else. You agree not to commence or continue any such proceeding in any other court, and to consent to its stay or dismissal if one is commenced. Either party may apply to any court for urgent relief to protect intellectual property or to restrain a breach of clause 13.

The United Nations Convention on Contracts for the International Sale of Goods does not apply.

ℹ️ Rights you keep wherever you are

To the extent applicable law does not permit an exclusive foreign forum, or gives you a statutory right or remedy that cannot be excluded, that right or remedy is unaffected. The governing-law and forum terms continue to apply in all other respects to the fullest extent permitted by law.

To the fullest extent permitted by applicable law, you and the OphthoRuler Developers each agree to bring any claim individually rather than as part of a class, collective, or representative proceeding. This does not apply to any claim you are entitled to bring under legislation that makes such a waiver void or unenforceable, does not apply where you are ordinarily resident in a place whose law does not permit it (including the Province of Québec) and does not affect any right of a qualified or representative body to bring proceedings on your behalf where the law provides for that. If this paragraph does not apply to you, the rest of this clause and this agreement continue in force.

29. General

• Severability: If any provision is held invalid, illegal, or unenforceable, it is to be read down or severed only to the minimum extent necessary, and the rest of the agreement continues in full force. The parties intend every limitation, exclusion, and release to apply to the maximum extent the law allows.
• Survival: Clauses 4 to 8 and 11 to 30 survive termination or expiry, however caused, including your obligations to Participants under clauses 11 and 12.
• Entire agreement and non-reliance: This agreement, together with the Participant Disclosure, the Data and Security Statement, and the Third-Party Notices, is the entire agreement about the Software, and replaces every earlier version and every other statement, representation, or understanding. You confirm that you have not relied on any statement, benchmark, validation claim, security description, specification, repository documentation, publication, model card, help page, or demonstration that is not set out in these documents; that you have not treated any description of a security measure in these documents as an assurance of its effectiveness; and that you have made your own assessment of whether the Software suits your purpose and satisfies your own security requirements. Nothing in this clause limits liability for fraud or fraudulent misrepresentation, or any liability preserved by clause 24.1.
• No waiver: A failure or delay in enforcing any right is not a waiver of it, and no single or partial exercise prevents any further exercise.
• Assignment: You may not assign or transfer this agreement or any right under it. The OphthoRuler Developers may assign it, including to an entity formed to hold the Software.
• No partnership: Nothing creates a partnership, joint venture, employment, agency, collaboration, or research relationship, and nothing makes the OphthoRuler Developers members of your research team or parties to your protocol.
• No advisory duty: The OphthoRuler Developers owe you no duty of care, no fiduciary duty, and no professional, clinical, statistical, security, or advisory duty, and none arises from supplying the Software, from anything in these documents, from any help page, model card, or reply to a question, or from any assistance given voluntarily. Nothing they provide is professional advice of any kind, and nothing is offered as an assurance that the Software is fit for your study, your participants, your institution’s requirements, or your legal obligations. Those judgements must be made by you, and clause 10 records that you are competent to make them. This does not limit liability for fraud or fraudulent misrepresentation, or any liability preserved by clause 24.1.
• Third-party beneficiaries: Clauses 23 to 26 are given to the OphthoRuler Developers and to each individual developer, author, maintainer, and contributor of the Software. Whoever accepts this agreement on their side does so both personally and as agent and trustee for each of them, and each may enforce those clauses directly and in their own name as if a party. Apple Inc. and its subsidiaries may enforce this agreement under clause 20. No one else may.
• Records of acceptance: The Software records which revision of these documents you accepted, a digest of their exact text, the acknowledgements you confirmed, the date, and the build you accepted against. You can view and export that record at any time from Settings. It is evidence of what you accepted on that date. A later version published at https://ophthoruler.com/terms does not bind you until it is presented and accepted under clause 22.
• Notices: Notices to the OphthoRuler Developers go to meaoemcua.1srexeqolxeu89rzjo3rh2mt66h62pu5omk@7wlcqa5bgjoe6clcd. Notices to you may be given in the Software itself.
• Force majeure: Neither party is liable for a failure caused by something beyond its reasonable control.
• Language: This agreement is drafted in English. Where a translation is published, the English version governs except where mandatory local law provides otherwise, in which case the local-language version prevails to the extent that law requires. If the law of the place where you are requires an agreement of this kind to be presented to you in another language, you must not download, install, or use the Software until you have obtained a version in that language and accepted it. Write to mcio57cv2.vxr0rebelh4u7brxooknhn7tbkhg8p1qohb@cslv6alegmmeeolw8 to request one before you begin. Using the Software without having done so is unauthorised: no licence is granted for it under clause 9, and clause 10.1 applies. Whatever language this agreement is in, you must provide participant-facing material (consent forms, information sheets, and the disclosure required by clause 12) in a language each Participant understands.
• Headings: Headings are for convenience only and do not affect interpretation. “Including” means “including without limitation”.

30. Contact

• Developer: Jeremy Moreau
• Address: RGH Eye Clinic, 7007 14 St SW, Calgary, Alberta T2V 1P9, Canada
• Telephone: 0c12ot86h31f-zh0k305j8cw-5g32a0si40u 461nu+gu
• E-mail: mlpo6fckw.twrjze00l7nu9qruao7jhu7tm9hr4ptyoft@kllt2amngidek3lai
• Current documents: https://ophthoruler.com/terms

Questions, complaints, and claims about the Software, notices under this agreement, and requests for a copy of it in another format go to that e-mail address or that postal address.

ℹ️ This is not legal advice

These documents were prepared for the Software and are not legal advice to you. They do not tell you whether your intended use is lawful, ethical, or approved. Consult your own counsel, your privacy office, and your REB/IRB before using the Software with any real person’s data.

Text fingerprint (SHA-256): f7671c667958245b2aac5bf53865e6f5991435d20c1fcfcba5a2fc4f113eacbd