ProxForm
The GDPR-proof way to send a medical form.
Patient intake with nothing to breach. No server. No database. No third-party processor. Answers travel directly browser-to-browser over an end-to-end encrypted, peer-to-peer channel — and vanish when you close the tab.
No account. No DPA needed. Works in any modern browser.
- 📄Like paper, in a browser
- 🔒End-to-end encrypted
- 🚫Zero PHI on any server
GDPR by architecture
No servers. No third-party processors. No PHI at rest. The entire app is HTML, CSS, and JavaScript — auditable in your browser, nothing phoning home. The GDPR risk surface eliminated by architecture, not policy.
How it works
-
1. Build the form
Pick a template or build from scratch — text, choices, dates, sections, files, signatures, multi-page, conditional logic. Live preview as you build. Nothing is saved on a server.
-
2. Share two things, two ways
Send your patient the link by email and the passphrase by SMS or phone. That two-channel split is the actual security property.
-
3. Patient unlocks & replies
They open the link, enter the passphrase, and their browser generates a short reply link. They send that back to you (any channel) — it's what wires the direct connection.
-
4. You connect, they fill
Paste their reply link and the browsers connect directly — no server in between. Answers stream into your dashboard live as they type. Save locally, print to PDF, or End Shift to wipe.
It just works like a paper form.
No account. No cloud account to manage. No SaaS overhead. Build a form, hand it to your patient, get it back filled. The whole thing lives in a browser tab — same way a clipboard lives on a desk.
When the tab closes, it's like putting the clipboard in a drawer. Nothing to log in to next time. Nothing to upload. Nothing waiting on someone else's server.
And nothing to breach.
The data never touches our servers because there are no servers. Patient answers travel browser-to-browser, end-to-end encrypted, and stay on your device — exactly like a paper file in your own cabinet.
Not "GDPR-compliant." GDPR-proof. The risk surface is removed by architecture, not papered over with a Data Processing Agreement.
Who it's built for
Built for medical intake — useful anywhere a paper clipboard already works. If the answer to "can we trust your cloud?" is "you don't have one?" you're in the right place.
Pre-appointment intake, telehealth screening, in-clinic consent, post-procedure follow-up. Templates for new-patient forms, allergy reviews, history questionnaires — the original use case, GDPR-proof out of the box.
New-patient questionnaires, anesthesia history, dental hygiene assessments, eyewear prescriptions. Same architecture, same shielded handoff at reception.
Law-firm client intake, on-site notary identity verification, municipal license and zoning applications. Sensitive personal data without a cloud-storage paper trail.
Boutique hotel check-in, luxury auto test-drive paperwork, VIP event and gala registration. Passport scans and signatures straight to the desk browser, no third party in between.
On-site interview NDAs and background-check consent, visitor logs at defense and biotech facilities, contractor liability waivers. Data that never touches the public internet.
Tattoo and piercing medical histories, spa and aesthetics consent forms, climbing-gym and MMA injury waivers. High-liability paperwork archived locally on the studio's own device.
New-pet intake, surgical consent, emergency-clinic triage. Owners fill on their phone in the waiting room, the form lands on the receptionist's browser — no cloud vendor sees a single record.
Aid-distribution registration, on-the-ground research surveys, refugee or asylum-intake interviews. Works in low-trust environments where data sovereignty is the whole point.
Why it's GDPR-proof (and not just "GDPR-friendly")
Most "GDPR-compliant" form tools still store your patient's data on their servers and ask you to sign a Data Processing Agreement. ProxForm removes the entire risk surface instead of papering over it.
- No data at rest. Nothing is stored on any ProxForm server, because there is no ProxForm server. Article 32 risk assessment: trivial.
- End-to-end encryption. PBKDF2 (100k iters) + AES-256-GCM on the handshake. DTLS 1.3 on the data channel itself.
- Two-channel sharing. The link and the passphrase travel through different channels. Compromising one isn't enough.
- Session verification (SAS). Both screens show a matching short code — read it aloud to confirm there's no person-in-the-middle.
- No accounts, no cookies, no analytics. No third-party processors to declare under Article 30.
- Auditable. Every line of crypto and protocol code runs in your browser — inspect it, verify it. No black boxes, no obfuscation.
Frequently asked questions
Is ProxForm GDPR-compliant?
ProxForm is GDPR-proof by architecture: no server-side storage of patient data, no third-party processors, no PHI at rest. The clinician remains the data controller for any local copies they choose to save — but ProxForm itself eliminates the data-at-rest, processor-relationship, and transit-encryption risk surfaces that drive most GDPR exposure.
Do I need a Data Processing Agreement (DPA)?
No. ProxForm never receives or processes patient data — answers travel directly browser-to-browser over an end-to-end encrypted WebRTC channel. There's no processor relationship to formalize because there is no processor.
Where is patient data stored?
Nowhere by default. Answers exist only in the two open browser tabs during the session. The clinician can choose to save a local copy (JSON or printed PDF) on their own device — that copy is then their responsibility under their own legal basis.
How is the connection encrypted?
PBKDF2 (100,000 iterations, SHA-256) derives a key from the shared passphrase, which encrypts the WebRTC handshake metadata with AES-256-GCM. The data channel itself runs over DTLS 1.3. A short verification code (SAS) lets both sides confirm there's no person-in-the-middle.
What about HIPAA?
Under HIPAA's conduit exception, Artivicolab is not a Business Associate — patient data never touches our infrastructure, so we have no persistent access to PHI. The clinic remains the covered entity for the data it collects through ProxForm. We don't market ProxForm as "HIPAA-compliant SaaS" because that label assumes a relationship that doesn't exist here. Full HIPAA position, including a Security Rule technical-safeguards mapping →
Does ProxForm cost anything?
ProxForm runs entirely in your browser with no accounts and no analytics. Pricing for clinical use will be announced — early users can contact Artivicolab for access.
Can I handle multiple patients at the same time?
Yes. The Portal supports parallel sessions — fire as many invites as you need, each lands as its own card in a first-come queue with a DMV-style ticket label (1A, 2A, …). Replies trickle back independently. Live previews stream into their own cards as patients type.
What happens if I reload the dashboard or close the tab?
Active invites are remembered as dormant cards in the next session. The previous WebRTC connection is dead (no JS can survive a reload), but clicking Reopen mints a fresh link + passphrase under the same session ID. If the patient was mid-fill, their draft auto-restores when they open the new link.
What's the "privacy shield"?
Two automatic layers: (1) every patient name on the Portal blurs to *** by default — hover to peek or click Show to unlock for a few minutes; (2) inside a submission, every answer auto-masks with *** after 30 s – 5 min of inactivity (configurable, never off). It's the "data at rest, on your own screen" defense — designed for shared clinic devices.
How do I clean the device at the end of a shift?
One button on the Portal: End shift — wipe patient data. Confirms with an explicit warning, then deletes every submission, every dormant invite, every patient draft. Your form templates and your shield/theme preferences stay. Next person at the device starts at ticket 1A on a clean inbox.
Does this site use analytics or cookies?
Only this landing page, and only if you say yes. It offers Google Analytics purely to count visits — and it does not load until you click Accept on the consent banner. Decline and nothing loads, ever. The ProxForm app and the patient form page run zero analytics and zero cookies no matter what you pick here — patient data never touches Google or any third party. Full detail on the GDPR page →
Where exactly do my received submissions live — and can I lose them?
Received submissions are stored in your browser's local IndexedDB on this device only. There is no server copy and no cloud backup — that's the whole point. Consequence: if you clear your browser data, use a different browser or device, or your device is wiped, those submissions are gone. Before clearing browser data, export anything you need to keep — every submission has an Export JSON button, and the detail view has Print / PDF. Treat ProxForm submissions like a paper inbox: move the ones you need into your records system, shred the rest with End Shift.
Try it now
Open two browser windows, build a form in one, open the link in the other.
Build a form — free →