Question about data protection

[cnludlow]

@gabrielperales @mcelearr @shadows666 @TroyMaeder. Some people might raise concerns about the data being hosted on the internet. Hypothetically, would it be possible to host the application on an internal server (e.g., a hospital's intranet)?

[gabrielperales]

@cnludlow Yes, very easily. And also like a desktop app.

[mcelearr]

@cnludlow I see this as the key question that the 'tech team' need to answer. Gabriel and I have been thinking about it and we have a plan. Under the Data Protection Act, we have the following responsibilities:

Only collect information that you need for a specific purpose

We are collecting it for a specific purpose - not trawling

Ensure it is relevant and up to date and only hold as much as you need, and only for as long as you need it. Also, allow the subject of the information to see it on request

We can put a user agreement warning screen at the start of the app which explains the clinician's responsibilities. I can't imagine a clinician having a problem signing an agreement such as this.

Keep it secure

Things become a bit more complicated at this stage. Secure cloud computing is possible but can become complicated/expensive. We have ideas on how to this and have identified a few possible services but I don't think we should go down this road. Instead, the 4-week sprint should have one of it's main objectives as turning the app into a downloadable desktop application using Electron. This is the same tool used to build Slack and the Atom editor (two pieces of software that developers will know VERY well). Apps can be packaged for Mac, Windows, and Linux and the all the user data will be stored locally using Pouch DB.

Once we have 50-100 users using the desktop app and the concept has been proved, THEN we can consider the cost of secure cloud storage. The only drawback is that it prevents clinicians working together on the same project (unless it's on the same computer).