Privacy

The HL7 and FHIR data you work with runs entirely in your browser. Anything you paste, type, or upload is processed locally on your own device and is never sent to our servers. Like most websites, FHIRProof does keep basic server-side analytics about which pages are visited — details below.

What we collect about your messages

Nothing. HL7 messages and files you load are parsed by JavaScript running in your browser. They are not transmitted, stored, or logged anywhere. When you close or refresh the tab, that data is gone.

How this is enforced

This isn't just a promise. FHIRProof is served with a strict Content-Security-Policy that includes connect-src 'none', which tells your browser to block all outbound network connections from the page (fetch, XHR, WebSockets, beacons). The page is technically unable to send the contents of your messages anywhere. The page analytics described below are recorded by the server from the ordinary HTTP request — they never include the data you paste into the tools.

Verify it yourself

Open your browser's developer tools (F12), switch to the Network tab, then paste a message. You will see the tree render with no network requests.

Cookies & analytics

FHIRProof embeds no third-party analytics or advertising scripts, and the tools set no tracking cookies. Donation links are plain external links you choose to click. A session cookie is only set if you sign in to the private admin area.

To understand which tools are useful and roughly how much the site is used, our own server records a lightweight page view for each page you load. Each record contains:

• the page path you visited (without any query string);
• the date and time of the visit;
• your IP address, used only to estimate unique visitors;
• your browser's User-Agent and referring URL, if your browser sends them.

This data is first-party, stays on our own server, is never sold or shared, and is used only for aggregate traffic statistics. It never includes the HL7/FHIR content you process in the tools. If you'd prefer not to be counted, blocking the site or using your browser's privacy mode is sufficient.

Contact

Questions about privacy? Reach out via the Support page.