This page says exactly what Endure stores, what leaves your device and when, who can see what, which services sit behind the app, and what Endure is not. It is written to be read, not skimmed past.
LAST UPDATED SEPTEMBER 2026 · PROTOTYPE
Everything you enter stays on your device unless you switch sharing on. Sharing is off by default.
When sharing is on, each check-in sends the answers, the score, the day type and hours, the conditions you tapped, and your specialty, role, practice setting, organization code, and region. Never your notes.
No account, no email, no name. Shared rows carry a random code for your installation, not you.
No analytics, no advertising, no sale of data, on this site or in the app.
You can delete everything from your device in Settings, at any time, in one tap.
On your device
What Endure stores, and where
Endure runs in your phone's browser, whether you open it from the home screen or from a browser tab, and it keeps its data in that browser's storage for the app's address on your device. Nothing here is copied to a server unless you choose sharing below.
Check-ins: your eight answers, the computed Reserve and domain scores, the conditions you tapped, the day type, hours worked, and any custom condition labels you typed.
Notes and reflections: anything you write, in full, only here.
Your profile: specialty and subspecialty, role, practice setting, an organization code if you entered one, and a region if your organization spans several cities.
Settings: theme, whether sharing is on, and similar preferences.
In Settings you can export all of it as one file for safekeeping, restore from that file, and delete all of it. Deletion is immediate and permanent on that device.
Leaving your device
What leaves, and when
1. Sharing, if you switch it on
The sharing switch is off until you turn it on. While it is on, each check-in you save sends one row to Endure's database. Turning it off stops that from the same moment, and nothing else changes on your side.
The check-in
Your eight answers, the Reserve score and six domain scores, the day type, hours worked, the built-in conditions you tapped, the date of the day, and whether the entry was backdated or edited.
About you, as categories
Specialty and subspecialty, role, practice setting, organization code, and a region only if your organization spans several cities. "Prefer not to say" sends nothing for that field.
Housekeeping
A random code generated once for your installation, the time the row was sent, the app version, and the version of the question set, so the scoring can be re-checked later.
Never
Your notes or reflections. Free text of any kind. Custom labels you typed, unless you share one on purpose (below). Your name, email, phone number, or precise location.
2. Two things you send on purpose, one at a time
A custom condition label. After you type a custom condition, you can share that label with Endure so it can be considered as a built-in chip for everyone. It travels with the same random installation code and the app version, nothing else, and it goes to Endure for review only, never into any organization's report.
A note for leadership. When you write a note, you can tick a box to contribute an anonymous copy toward the Conditions Report. That sends the date, the optional condition tag, and the words. It deliberately carries no installation code, no specialty, and no exact time, so a contributed note cannot be linked to anyone's check-ins.
3. Nothing else
The app has no reminder or notification service running today. If one ships, it will be described here first, it will store only what a reminder needs, and turning it off will delete what it stored.
Who sees what
Three audiences, three very different views
Who
What they can see
You
Everything, and only you. Your notes, your check-ins, your Levers, on your device.
Endure's team
Shared rows, as anonymous rows, during the prototype, to check the scoring and harden the instrument. Rows carry a random installation code, not an identity, and we never try to work out who is behind one.
An organization
Only when an organization runs Endure, and only aggregates in groups of five or more clinicians: which conditions are costing Reserve and which are protecting it. A group under five rolls up into its parent group or is not shown. No organization sees anything during the prototype.
Your employer
Nothing about you. Ever.
Advertisers, data brokers
Nothing. Endure has no advertising and does not sell or license data.
Behind the app
The services we use
Hosting. The app and this site are served by a commercial hosting provider. Like any website host, it sees the basic connection information needed to deliver a page (your device's network address and browser type) for the time it takes to serve it. It never sees check-in content, which is stored on your device.
Database. Shared rows, contributed labels, and contributed notes are stored in a managed database service that Endure controls. It holds nothing about you that is not listed on this page.
Two startup resources in the app, being removed. Today the app itself loads a styling library from a content delivery network and its fonts from Google when it starts. Those services see your device's network address and browser type, the same as any web page that uses them, and never any check-in content. We are moving both onto our own domain. The pages of this site already load nothing from third parties.
This site sets no cookies, runs no analytics, and includes no tracking of any kind.
How long
Retention
On your device: until you delete it, or clear the browser's storage for the app's address.
Shared rows: kept as sent during the prototype. A retention schedule that reduces older shared rows to summary numbers is being designed; when it ships, this page will say exactly what it does and the date above will move.
Contributed labels and notes: kept for the review they were sent for, and for the Conditions Report they feed.
Your choices
What you can do at any time
See your data. It is on your phone, and Settings exports all of it as one file.
Delete your data. Settings has one button that removes every check-in, note, profile setting, and draft from the device.
Stop sharing. Switch it off in Settings. From that moment nothing more leaves the device, and no one is told.
Rows already shared carry a random installation code and no identity, so we cannot connect them to you. That is by design, and it also means we cannot pull them back out for you once sent. Stopping sharing stops everything from that point forward.
Ask us anything. The feedback button inside the app reaches the team directly, and so does the contact form on the About page. We answer requests about your data regardless of which state or country you live in.
Plain limits
What Endure is not
Not medical care or advice. Endure is a self-report instrument about your working conditions and what they cost you. It does not diagnose, treat, or monitor anything, and no one reads your entries in real time.
Not a validated clinical scale, yet. Reserve is a directional indicator computed by transparent arithmetic. The validation plan is on the how it works page.
Not a place for patient information. Endure holds clinician self-report only and is not built to hold anything about a patient. Please keep patient details out of your notes.
Not for anyone under 18. Endure is for working clinicians.
In crisis, please don't wait on an app: call or text 988, call 911, or call the Physician Support Line, free and confidential, at 1-888-409-0141.
Changes
When this page changes
Endure is a prototype and it will change. When a change affects what the app collects, sends, or keeps, this page changes first and the date at the top moves. Nothing new starts leaving your device without being described here.