Privacy notice – ShoulderView

Last updated: 26 October 2026 · Version 1

In short

• No cookies, no ads, and no tracking across websites.
• We count visits anonymously and do not store IP addresses.
• The findings on the model are kept in the link, after the # sign. That part is never sent to us, unless you choose to attach it to a comment.
• If you send a comment, we keep what you wrote, plus an email address only if you choose to give one.
• ShoulderView is an illustration to help explain. It is not an image of your own shoulder and not a diagnostic tool.

1. Who runs the site

ShoulderView (shoulderview.com) is developed and run by Dr. Michael Tamar, shoulder surgeon. He is responsible for the little data the site collects, mainly the comments sent through the comment box.

For any privacy question or request: michael@drtamar.co.il

2. What the site does, and what it does not do

ShoulderView shows common shoulder MRI findings on a generic 3D model, in plain language. You choose the findings on screen by hand. You do not upload scans, images or reports, and you do not enter a name, ID number or any other identifying detail.

The site does not diagnose, does not give medical advice and does not replace an examination by a doctor.

3. What we collect and why

3.1 Anonymous visit counts

When the page opens, it sends us one short message. We keep:

• date and time
• country (a two-letter code that Cloudflare derives from the IP address; the address itself is not stored)
• interface language
• device type: phone, tablet or computer (worked out from the browser identification, which itself is not stored)
• the site you came from, the site name only (for example google.com), not the full address
• the link's source tag (?ref=… or utm_source), if there was one. We add these tags to links we share, to see which channel works. A link sent with the "Share" button carries such a tag too (?ref=share). Sharing itself sends nothing to us.
• whether the link carried model settings: yes or no only, not the findings themselves

There is no unique identifier and no cookie, so two visits by the same person cannot be linked. Search engines and bots are not counted.

Purpose: to know how many people use the site, in which languages and from which sources, so we can improve it.

3.2 The comment box

Giving this information is voluntary, and there is no legal duty to give it. If you send a comment, we keep:

• the kind of comment (suggestion, something is wrong, translation, other) and your message
• your email address, only if you fill it in, and only to reply to you
• interface language, country, device type, screen size and the viewing angle on screen
• the model settings (the code after #f= in the link), only if you tick "Attach the model settings"

Please do not write personal medical details or anything that identifies you. If you set the model to match your own findings, leave the box unticked, and the settings will not be sent.

If you do not send a comment, nothing is sent. If you leave out your email, we cannot reply, and that is the only difference.

Purpose: to read the comments, fix and improve the site, and reply when asked.

3.3 Error reports

When a technical error happens in your browser, an automatic report is sent to us, at most five each time the page is opened. It contains the error message, the place in the code (file and line), the interface language, the device type, and the browser and operating system family (for example "Chrome / Android").

Purpose: to find and fix faults.

3.4 What is stored on your device

The site uses no cookies. Your browser's local storage (localStorage) holds at most two values:

• the language you picked, only if you picked one in the menu, so the site opens in that language next time
• a note that you have already seen the "drag to turn, pinch to zoom" hint, on touch screens only, so it does not show again

These values are not sent to us. You can delete them in your browser settings.

3.5 Findings in a link someone sent you

The model settings are kept in the address itself, after the # sign (#f=…). Browsers never send that part to the server, so it does not reach us and we do not store it, unless you choose to attach it to a comment (section 3.2).

Anyone who has the link can see the settings, so share it only with people you choose. The link contains no name, ID number or other identifying detail.

3.6 Outside services

• Cloudflare hosts the site and delivers it to you. Like any web server, it receives your IP address and browser details to deliver the page and protect it from attacks, under its own terms.
• drtamar.co.il: the link in the credit line leads to a separate website with its own privacy policy.

All of the site's files, including the font, are loaded from shoulderview.com itself. There are no ads, no Google Analytics and no social-media pixels on the site.

4. Legal basis (for visitors from the EU / EEA)

• Visit counts, error reports and hosting by Cloudflare: legitimate interest (Art. 6(1)(f) GDPR) in running a working, secure site and understanding how it is used, anonymously and without building profiles.
• The comment box: your consent (Art. 6(1)(a)), given when you send. You can withdraw it at any time and ask for your comment to be deleted.
• Values kept in your browser: needed to remember a choice you made, or a hint you have already seen.

There is no automated decision-making and no profiling.

5. Who sees the data

• Dr. Michael Tamar, on an admin page protected by a secret key. He may export comments to his own computer to deal with them.
• Cloudflare, Inc., as hosting provider (processor), under its data processing agreement.

We do not sell, rent or share data with others for marketing. Data is handed to an authority only where the law requires it.

6. Where the data is kept

The data is kept in a Cloudflare database (D1) located in Western Europe. Cloudflare is a US company. Transfers to it are covered by a data processing agreement that includes the EU Standard Contractual Clauses, and it takes part in the EU-U.S. Data Privacy Framework. The data is read in Israel, which has an EU adequacy decision.

7. How long we keep it

The data is deleted automatically at the end of the period:

8. Your rights

Under the Israeli Privacy Protection Law, 1981 (including Amendment 13) and the GDPR, you can:

• see the data about you
• ask for it to be corrected or deleted
• withdraw consent you gave

Visitors from the EU / EEA can also restrict processing, object to processing based on legitimate interest, and receive a copy in a common format (portability).

How: write to michael@drtamar.co.il. To help us find your comment, give the email address you used, or the date and text of the comment. We will answer within 30 days.

Visit counts and error reports contain nothing that identifies you, so we cannot pick out "your" data in them.

Complaints: in Israel, to the Privacy Protection Authority (Ministry of Justice, on gov.il). In the EU / EEA, to the data protection authority of your country.

9. Security

Traffic to the site is encrypted (HTTPS). Only the site owner can access the data, using a secret key. We keep only minimal data, with no IP addresses and no identifiers. No method is completely secure. If there is a breach, we will act as the law requires.

10. Children

The site is meant for patients and their families. Children under 16 are asked not to send comments without a parent.

11. Changes

When the site changes, for example when new features are added, we will update this notice and the date at the top.