Who we are
Blood Pressure Tracker (also called KeepBP) is a personal web app for logging blood pressure readings. Contact: support@bloodpressuretracker.app.
What we collect
- Account: email address and/or username, and a password hash (we never store your password in plain text).
- Blood pressure readings: systolic, diastolic, optional pulse, and timestamps you enter or import.
- Optional report fields: if you generate a doctor PDF or an expiring share link, we may receive patient name, date of birth, phone, clinician name, notes, position/arm/cuff, and date range you type into the form for that request. PDF fields are used to build the file; share-link options are stored (encrypted when
DATA_ENCRYPTION_KEYis set) until the link expires or you revoke it. - Session: a signed session cookie so you stay logged in.
- Audit events: security/activity events (e.g. login, import, export, delete) with timestamps — not your blood pressure values.
- Technical: standard server logs (e.g. IP address, timestamps) may be processed by our host for security and reliability. We do not run third-party advertising trackers.
- Optional analytics: when Google Analytics 4 is enabled by the operator (via an environment variable), the browser may load Google’s analytics script. See “Cookies and analytics” below.
Where data is stored
In production, account and reading data are stored in Postgres on Render. Production traffic is served over HTTPS. SQLite remains available for optional local or development use when Postgres is not configured.
Security
- In transit: HTTPS encrypts data between your browser and the server.
- Passwords: hashed with bcrypt.
- At rest: When
DATA_ENCRYPTION_KEYis set (as it is in production), KeepBP applies AES-256-GCM field encryption to reading PHI and to FHIR tokens held in the server session. That is current practice on production; see Security. Treat this as a personal tracker, not a hospital-grade vault.
How we use data
We use your data only to run the app: authenticate you, store and show your readings, import CSV/FHIR data you request, generate PDFs you ask for, and (if you create one) serve an expiring read-only share link to your clinician. We do not sell your personal data.
The site operator may access a private admin roster of account emails, usernames, and signup dates (not passwords or blood pressure readings) to operate and support the service.
Cookies and sessions
We use an HTTP-only session cookie (bp.sid) to keep you signed in. It is required for the logged-in app to work. We do not use advertising cookies.
Cookies and analytics (optional Google Analytics 4)
If the site operator configures a Google Analytics 4 measurement ID, the app may load Google’s gtag.js script and set analytics cookies/storage to collect aggregated usage metrics (for example page views and anonymous product events such as “signup success” or “reading saved”). Measurement IDs and event names do not include your blood pressure values, email, or password.
GA4 is designed with IP anonymization / non-logging of full IP addresses as a default for standard web collection. Analytics stays off when no measurement ID is configured. Google processes data under Google’s Privacy Policy.
Third parties
Hosting is on Render. Optional features may call Cloudflare Turnstile (bot protection), Google Analytics 4 (when enabled), or Epic/MyChart FHIR APIs when you choose to connect. Those services process data under their own policies when you use those features.
Your choices
You can log out anytime. After email verification, you can download a JSON export of your readings under Your account, or permanently delete your account (password + typing DELETE; step-up required if MFA is enrolled). Optional authenticator/passkeys are managed under Security settings. You can also contact us at the email above for help.
Children
This app is not directed at children under 13. Do not create an account for a child without appropriate parental/guardian oversight.
Changes
We may update this policy. The “Last updated” date at the top will change when we do.