Privacy Policy

Last updated: 2026-08-04

This policy describes how Read Your Scan handles your data. Health data is special-category personal data; we process it only with your explicit consent and to provide the service you request.

What we process

Account data: email and authentication identifiers.
Imaging you upload — de-identified in your browser(converted to NIfTI) before it is stored.
Analyses, generated reports, and your questions and answers.
Billing records (via Stripe; we do not store card numbers).
How you first reached the site (referring page, campaign tags in the link you followed, first page seen), recorded once and stored with your account. No IP address, no device fingerprint, no cross-site tracking.

How we use it

To reconstruct and display your studies and to generate explanations you request.
To operate accounts, credits, and payments.
We do not sell your data or share it with third parties except the processors needed to run the service.

Processors

We rely on infrastructure and model providers (e.g. hosting, database and storage, and AI providers) under data-processing agreements. Before handling protected health information at scale, these are covered by the appropriate agreements (e.g. HIPAA BAAs) — see the compliance notes in the project documentation.

Security

Data is encrypted in transit and at rest. Access is restricted and sensitive actions are audit-logged.

Data retention

We keep your studies for as long as you use your account. Two things are never deleted by us: any study that has had a paid reading, and anything at all while your account is in use.

If an account goes unused for 180 days and it holds a study that is older than 90 days and has never had a paid reading, that study becomes eligible for deletion. Before anything is deleted we email you at least 14 days in advance, and simply signing in stops the deletion — the clock restarts. Deletion removes the imaging and its stored analyses; your account, your credits and your billing records are not affected.

This policy applies from 4 August 2026 onwards. Studies uploaded before that date are measured from it, not from the day they were uploaded, so nothing is deleted under a rule that did not exist when you uploaded it.

Your rights

Export your data as JSON from your account page.
Delete your data or your entire account at any time.
Withdraw consent by deleting your account.

Contact

For privacy requests, contact the address listed on the site.