Privacy policy

Oxynet is provided by Andrea Zignoli, self-employed, Via A. Milani, Parona, 37124 Verona, Italy, VAT number 04833240239 (“Oxynet”, “we”). Contact: andrea.zignoli@unitn.it.

Write to that address about anything in this policy, including to exercise your rights.

• Oxynet analyses the exercise test files you send it. It does not need to know who was tested, and it does not keep names, dates of birth or file names.
• The file you upload is read and discarded. The parsed recording is kept 24 hours so you can analyse it, then deleted.
• We never use your uploads to train our models, and we never sell data.
• No advertising, no analytics trackers, no marketing email.

When you upload a file through the API, an AI assistant or the Oxynet skill, Oxynet writes it to a temporary file, reads it, and deletes the temporary file as soon as it has been read. The original file is never stored, and its name is used only to read the file extension.

Exports from metabolic carts often contain the tested person's name, date of birth, sex, height or weight. Oxynet may read those fields in memory while interpreting the export, but it does not store any of them, nor the date of the test.

What is kept is the parsed recording: the time series of the measured channels (for example oxygen uptake, ventilation, end-tidal gases and heart rate), the detected file format, how the recording was sampled, the external load and the protocol inferred from it, quality flags, and any thresholds the instrument recorded. Each recording gets a random identifier and can be reached only with the API key that uploaded it.

For how long: 24 hours, or longer only if you ask for it when you upload, up to 7 days. An hourly sweep deletes expired recordings, and you can delete one at any time. A deleted recording is gone from our storage, including its version history, within about two days.

Why: to compute the analyses you ask for, which is the service you requested. On a free key you must upload only de-identified data (see the terms). Where a recording still relates to an identifiable person, you are responsible for having a lawful basis to share it with us, and we process it only to return your results. Clinical use of patient data needs a written data processing agreement with us.

The browser app at app.oxynet.net lets anyone analyse a file without an account. A file uploaded there is read and discarded in the same way, and nothing about it is stored: the results are sent back to your browser only.

To prevent abuse, the browser app:

• uses Cloudflare Turnstile, a check that loads a script from Cloudflare in your browser and sends Cloudflare a token and your IP address to tell people from automated programs;
• keeps, in the server's memory only, a short-lived session token with a small allowance of analyses, and a count of how many sessions each IP address started in the last five minutes. Neither is written to storage, and an IP address is held for at most ten minutes.

Your browser keeps the session token in its local storage. The browser app sets no cookies. Why: our legitimate interest in keeping a free service available and protected from abuse.

Free keys. When you sign in with Google or GitHub to get a free key, we receive and keep the email address they confirm and an account identifier, together with the date you accepted the terms and which version, your key's limits and expiry date, and a one-way fingerprint of the key. The key itself is never stored, which is why it is shown to you only once. We use your email address only to keep to one free key per person, to stop abuse, and for service or security notices about your key. Never for marketing.

While you sign in, the sign-up page sets two cookies that only that page can read and that the sign-in needs: one lasts at most 10 minutes, while you are at Google's or GitHub's page, the other at most 15 minutes, back on ours. Neither is used for anything else.

Keys issued by Oxynet record the name of the person or organisation they were issued to, which analyses and models they may use, a monthly limit and an expiry date.

Connecting an AI assistant. Some assistants, such as Claude, connect through a sign-in page where you paste your key once. The assistant then holds an encrypted token that lets it act with your key for up to 30 days, renewable for up to 180. It does not reveal your key, and revoking or replacing the key stops it.

Why: to provide the key you asked for, and our legitimate interest in preventing abuse. For how long: a free key's record is deleted 12 months after the key expires or is revoked.

For each key we count analyses per month, to apply its limit, and per hour which analysis was run, through which route (API, AI assistant, the Oxynet skill or the browser app), which assistant, which file format, and whether it succeeded or why it was refused. These counts are attached to the one-way fingerprint of the key, never to the key itself, and they never include file contents, file names, recording identifiers, IP addresses or free text.

Why: to apply limits and to understand how the service is used. For how long: 13 months per key, after which only totals across all keys are kept.

Our servers keep logs to diagnose faults and to keep the service secure. A log records the request, the recording identifier, the key's fingerprint, the detected file format, the size of the file and the outcome. It never contains file contents, file names, keys, the name a key was issued to, email addresses or analysis results. The web server also records each request line and a network address. Logs are deleted after 30 days.

www.oxynet.net sets no cookies, runs no analytics or advertising trackers and has no forms. It remembers your light or dark theme in your browser's local storage. If you write to us through an email link, we receive your message in our mailbox.

If you use Oxynet through an AI assistant such as Claude, ChatGPT or Gemini, or through a coding agent running the Oxynet skill, that assistant's provider processes what you send it under its own terms and privacy policy, which we do not control. The skill sends only a file you name and asks you to anonymise it first.

Data is encrypted in transit and at rest. Recordings are partitioned by key, so one key cannot read another's. Keys issued by Oxynet are handed over through encrypted one-time links; free keys are stored only as a one-way fingerprint.

You may ask us for access to your personal data, to correct or delete it, to restrict or object to its processing, and for a copy in a portable format. Write to andrea.zignoli@unitn.it; we answer within one month. Recordings are not linked to a person, so to act on one, give us its recording identifier.

You may also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live.

When what Oxynet does with data changes, we update this page and its date. The current terms of use are on their own page.