Privacy
How MedTech Terminal handles data
Effective 2026. Data controller: S.Fadhlullah.
Nothing is sent to our servers
This product is a static site. There is no application server, no database we operate, and no analytics. Capital, burn and regulatory inputs, saved scenarios, trial dates and subscription windows live only in your browser (IndexedDB), encrypted with AES-256-GCM. The encryption key is derived from a passphrase you choose (PBKDF2, 600,000 iterations). We never receive that passphrase and hold no key that can decrypt your vault.
What does leave the browser
Only one third-party request, and it never includes your financial data: a redirect to Stripe when you subscribe. The engine needs no live feeds. Stripe sees only the payment you make on their hosted Payment Link. After payment, Stripe sends your browser back to this site; access is then written into the local vault. Manually visiting the activation URL can also grant access — an accepted tradeoff of having no server-side webhook.
Backups
Optional encrypted JSON export/import lets you copy the vault and scenario portfolio to another device. The backup file is protected by a passphrase you set at export time. Restoring a backup never overwrites trial or paid-access dates, so an old file cannot rewind an expired subscription.
Data-loss risk
If you forget your vault passphrase, or clear this origin's storage, the data is permanently unrecoverable — including by us. That is the direct consequence of us not holding a decryption key. Export a backup before resetting a device.
Contact
Office 1852, 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW, United Kingdom.