Read Your Scan
Template only — these documents must be reviewed and finalized with legal counsel before launch. They are not legal advice.

Privacy Policy

Last updated: 2026-09-11

This policy describes how Read Your Scan handles your data. Health data is special-category personal data; we process it only with your explicit consent and to provide the service you request.

What we process

  • Account data: email and authentication identifiers.
  • Imaging you upload — de-identified in your browser(converted to NIfTI) before it is stored.
  • Analyses, generated reports, and your questions and answers.
  • Billing records (via Stripe; we do not store card numbers).
  • How you first reached the site (referring page, campaign tags in the link you followed, first page seen), recorded once and stored with your account. No IP address, no device fingerprint, no cross-site tracking.

How we use it

  • To reconstruct and display your studies and to generate explanations you request.
  • To operate accounts, credits, and payments.
  • We do not sell your data. We share it only with the processors needed to run the service and — only if you accept advertising cookies — with Google and Meta, as described below.

Cookies, analytics and advertising

If you accept “analytics and advertising cookies” in the banner, we use Google Analytics and the Meta Pixel. They record the pages you visit and a few steps in the product — creating an account, loading a study, finishing a free reading, starting a checkout, a purchase — so we can measure what works and show our ads to people who have visited before, or to people similar to them.

When you buy credits with that consent given, our server also reports the purchase to Meta (the Conversions API): your email address and account id in hashed form (SHA-256), Meta’s browser cookies, and the value of the order. This lets the sale be counted even if you close the tab after paying.

Your images, reports and anything about what they show are never sent to Google or Meta. If you decline or never choose, nothing is sent to Meta, and Google Analytics runs without cookies and without identifying you. Google and Meta process what they receive under their own terms and privacy policies. To withdraw consent, clear this site’s cookies and stored data and choose again in the banner.

Processors

We rely on infrastructure and model providers — hosting, database and storage, and the AI providers that read your images — under data-processing agreements. Your studies and reports are stored in the European Union (Frankfurt). Our application servers and the AI providers run in the United States, so your data is transferred outside the EU under those agreements and the safeguards they carry.

We are not a HIPAA-covered entity, and we do not claim to be one. HIPAA binds hospitals, clinics, insurers and the vendors acting on their behalf. Read Your Scan is a service you use directly, with images you upload yourself — your data does not reach us from a healthcare provider. We handle it as special-category health data under GDPR Article 9 instead. If that ever changes, this page changes with it.

Security

Data is encrypted in transit and at rest. Access is restricted and sensitive actions are audit-logged.

Data retention

We keep your studies for as long as you use your account. Two things are never deleted by us: any study that has had a paid reading, and anything at all while your account is in use.

If an account goes unused for 180 days and it holds a study that is older than 90 days and has never had a paid reading, that study becomes eligible for deletion. Before anything is deleted we email you at least 14 days in advance, and simply signing in stops the deletion — the clock restarts. Deletion removes the imaging and its stored analyses; your account, your credits and your billing records are not affected.

This policy applies from 4 August 2026 onwards. Studies uploaded before that date are measured from it, not from the day they were uploaded, so nothing is deleted under a rule that did not exist when you uploaded it.

Your rights

  • Export your data as JSON from your account page.
  • Delete your data or your entire account at any time.
  • Withdraw consent by deleting your account.

Contact

For privacy requests, contact the address listed on the site.