Privacy Policy
Draft version 0.1 ·
Draft (version 0.1): these texts are not yet in force and will be published after legal review. Highlighted fields will be filled in once the company is set up.
This notice is provided under Articles 13-14 of the EU General Data Protection Regulation (GDPR) and Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK).
1. Controller
Company name, address, e-mail. EU representative (GDPR Art. 27): name, address.
2. Principles
- We do not process patient data. Information you enter in report templates, calculators, the dosimetry simulator, image analysis and academic tools is processed in your browser and is not sent to our servers; report texts are never stored. In image analysis, DICOM files you load are read only in your browser; patient names and identifiers are not shown; anonymised copies are also produced in the browser. The anonymous usage signal contains only series types and counts, never images or header data. In the reference formatting tool, pressing "Fetch" or "Check" sends only the DOI or PMID you typed, through our server, to Crossref and to the US National Library of Medicine's PubMed service; your reference list is not sent.
- Usage data is processed anonymously and in aggregate; it is not used to identify anyone.
- Data minimisation: we collect only what the Service needs.
- We do not sell your data or share it for advertising.
3. Data, purposes and legal bases
| Data | Purpose | Legal basis (GDPR Art. 6 / KVKK Art. 5) |
|---|---|---|
| Account: name, e-mail, Google ID, language, country, title/specialty (optional) | Creating and managing the account | Contract (6(1)(b)) |
| Study data: answers, review list, notes, flags, highlights, exam results | Providing the Service, syncing across devices | Contract |
| Subscription: plan, period, status (payment data stays with Paddle) | Managing the subscription, invoicing | Contract; legal obligation (tax law) |
| Feedback: the text you write, its type, the page you sent it from, language, screen width, theme, browser type; optional e-mail (only if you enter it). Votes under animations and figures. No IP address is stored | Replying, and checking errors against sources and fixing them; the text, page and language are sent to Anthropic (Claude) for an AI pre-review (e-mail and device details are not sent). If you entered an e-mail, you receive one "fixed" message when your report is applied (Resend) | Legitimate interest (6(1)(f)) |
| Usage signals: chapter and time read, the ID of each question answered and the option chosen, animation step times, search terms and result counts, the tool used (not the values entered); a random session ID per browser tab that cannot be linked across visits. No name, e-mail, IP or cookie ID | Improving content and tools (learning platform): hard questions, content gaps, unclear steps | Consent (Settings → "Share usage data"; off by default, can be turned off at any time). While off, the data stays in your browser only. For the weekly analysis only aggregate counts (e.g. a question's error rate, search terms with no results) are sent to Anthropic for an AI report; session IDs are not sent |
| Voluntarily donated anonymous examples (report sample, case) | Developing the library and tools | Consent (6(1)(a)) |
| Questions and text you send to AI features | Answering your request; quality measurement | Contract; legitimate interest for quality measurement |
| Technical logs: IP address, browser type, error logs | Security, abuse prevention; Turkish Law No. 5651 | Legal obligation; legitimate interest |
| Country your connection comes from (two-letter code only; from the hosting service) | Showing calendar entries for your country and choosing the opening language | Legitimate interest; kept in a cookie in your browser, not stored on the server |
| Marketing e-mail preference | Newsletter and announcements | Consent |
We do not process special categories of data (including health data). Identifying information in case and image uploads is removed in the browser before upload; truly anonymised data falls outside data protection law.
4. How we collect data
Directly from you (forms, account, settings), from Google when you sign in with Google (name, e-mail), from Paddle (subscription status) and automatically while you use the Service (anonymous signals, technical logs).
5. Recipients
We share data only as needed with these processors:
| Recipient | Function | Location |
|---|---|---|
| Vercel Inc. | Hosting | USA / EU |
| Supabase Inc. | Database (feedback, consented usage signals), later authentication | EU (Frankfurt, Germany) |
| Paddle.com Market Ltd. | Payments, merchant of record | United Kingdom |
| Anthropic PBC | AI features (Claude) | USA |
| Resend | E-mail delivery | USA |
| Sentry (Functional Software Inc.) | Error tracking | USA / EU |
| Plausible Insights OÜ | Cookieless, anonymous visit statistics | EU |
International transfers rely on the EU Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework; under KVKK Art. 9 (2024 amendment) on standard contracts notified to the Turkish authority or on your explicit consent. Content sent to the AI provider is not used to train its models (to be confirmed by contract); patient identifiers are never sent.
We disclose data to public authorities only where required by law.
6. Retention
| Data | Period |
|---|---|
| Account and study data | While the account is open; deleted within 30 days of a deletion request (within 90 days from backups) |
| Invoices and subscription records | 10 years (tax law) |
| Technical logs (IP) | 1-2 years (Turkish Law No. 5651) |
| Usage signals (consented) | 24 months, then deleted automatically from the database. Aggregate results (e.g. a question's error rate) indefinitely |
| Feedback and messages | 3 years |
7. Your rights
Under GDPR Art. 15-22 and KVKK Art. 11 you may access your data, obtain a copy (portability), rectify, erase, restrict processing, object, withdraw consent at any time, and not be subject to solely automated decisions with significant effects.
- Most can be done yourself: Settings → Download my data / Delete my account.
- Other requests: e-mail or in writing to address. We reply free of charge within 30 days.
- You may complain to your local data protection authority or to the Turkish Personal Data Protection Authority (kvkk.gov.tr).
8. Security
Encryption in transit (HTTPS), row-level access rules in the database, least-privilege access, regular security reviews and backups. Data breaches are notified to authorities and affected people within the legal deadlines.
9. Children
The Service is not intended for people under 18 and we do not knowingly collect their data.
10. Changes
This notice may be updated; material changes are announced. The version and date are shown at the top of the page.