Privacy & security

Every score, equation and algorithm runs locally in your browser. The values you enter are not sent to a server, not logged and not stored by us. There is no account and no patient record on our side.

The only exception is the optional AI reader on the Patient data page, described below, which you have to choose for each upload.

Medical numbers and dates in a Save / Print bar are used only to build the file or printout on your device.

On the Patient data page you can upload a lab, echo or cath report, a PDF or a photo so that calculators are filled in automatically. For every upload you choose how it is read:

• Read on this device (the default): text recognition in English and Arabic runs inside your browser. The recognition engine is downloaded from this site on first use; the file itself never leaves the device.
• Read with AI: the picture, PDF or text is sent over HTTPS to this site's server and from there to an AI model (Anthropic Claude, through Netlify AI Gateway) for that single request, and the extracted values are returned. Before sending, the patient's name, address, phone and record numbers are removed on your device from text files, pasted text and PDFs that contain text (these are then sent as text, not as the original file); photos and scanned PDFs are sent as pictures and the model is instructed not to read those identifiers, and nothing is returned for them. Cardio.tools does not store or log the file or the values. Use it only where your local policy allows sharing patient information with such a service, and crop identifiers out of photos where you can.

Pictures are picked through your device's own file picker; the site itself has no camera access.

There are no analytics, advertising, cookies or tracking pixels. Fonts and all other assets are served from this site, so opening Cardio.tools makes no requests to Google or any other third party. Reference links (DOI, PubMed, guideline sites) only contact those sites when you click them.

The counter at the top of the page is the only thing the site counts itself. Each page you open adds one page view, and one user is added per browser session (remembered only in the tab's session storage). No IP address, page, device details, identifier or anything you type is stored with it, and the totals are kept only as counts per hour.

The site is not available in some countries. Each request is checked against the country our host (Netlify) derives from your IP address; the country is used only for that check and is not stored.

• The cardiac arrest code timer saves its running state and event log in your browser's local storage, so a reload does not lose the code. Press Reset on the CPR page to clear it.
• Patient data you upload or type on the Patient data page (an automatic medical number, vital signs, coronary history, labs, echo values and coronary angiography findings) is kept in your browser's local storage, so each calculator you open can be filled in. No names, addresses, phone or hospital record numbers are kept: each patient gets a medical number counted on this device (1, 2, 3… / today's date). It stays until you press Clear patient. Save or print it if you need a record, then clear it, especially on shared computers. The uploaded file itself is not kept.
• The tools you add to ⭐ Favourite are kept as a list of tool names in your browser's local storage. Press the star again to remove one.
• After the first visit the app caches its own pages and files on the device (and the on-device reading engines once a report is read) so it works offline. No inputs are cached.

Clearing this site's data in your browser settings removes all of these.

The optional feedback form is the only thing that sends data: the rating, your message, the page you were on and, if you choose, your email address. It is delivered through Netlify Forms and read only to improve the site. Please never include patient-identifiable information.

• Served only over HTTPS with HTTP Strict Transport Security.
• A strict Content Security Policy allows only this site's own scripts (plus a per-request nonce for the app's startup script), blocks framing and plugins, and limits every connection to this origin. The text-recognition and PDF engines are served from this site as well.
• Camera, microphone, location, payment and other device features are disabled for the site.

Found a vulnerability or an error in a calculator? Email m_a_ghazy@med.asu.edu.eg (see also security.txt).

Cardio.tools is decision support for healthcare professionals. Each tool lists the publications and ESC / ACC / AHA guidelines it implements; verify critical decisions against the original sources, the clinical findings and local protocols.