🔒 Privacy Policy

1. Data Controller & Global Regulatory Compliance

1.1. This Privacy Policy governs the processing of personal data by RadBot AI (hereinafter the "Service" or "Platform"), operated by independent healthcare technology specialist Sofya Aleksandrovna Lelyukhina (Tax ID / INN: 781450780176, St. Petersburg, email: support@ai-protocol.ru, hereinafter the "Data Controller").

1.2. International Compliance Frameworks: The Service is architected from the ground up to respect global healthcare data privacy standards:

• United States (HIPAA & CCPA/CPRA): Fully adheres to the HIPAA Safe Harbor De-identification standard (45 CFR § 164.514(b)) and the California Consumer Privacy Act as amended by the CPRA. Protected Health Information (PHI) is automatically anonymized prior to any cloud transit.
• European Union (GDPR Regulation (EU) 2016/679): Compliant with Article 6 (Lawfulness) and Article 9 (Special Categories of Data / Health Data). Zero persistent storage of identifiable patient records.
• United Kingdom (UK GDPR & DPA 2018): Strict data minimization and clinical confidentiality protections for NHS and private practitioners.
• Brazil (LGPD Lei nº 13.709/2018): Protection of sensitive personal health data under Article 11.
• Turkey (KVKK No. 6698) & GCC (PDPL): Compliance with national sensitive health data protection mandates.

2. Categories of Information Processed

2.1. Physician / User Account Data: Work email address, practitioner name, clinical specialty, preferred reporting modalities, custom draft templates, and UI localization preferences.

2.2. Voice Dictation Audio: Transient audio packets generated during voice dictation. Zero-Disk Retention: Audio streams are converted to text strictly in volatile server memory (RAM) and permanently purged from memory immediately upon completion of speech-to-text generation.

2.3. Clinical Case Texts: Structured diagnostic drafts and protocol sections composed by the clinician.

2.4. Diagnostic Imaging (DICOM / Vision AI): Imaging series uploaded for auxiliary computer vision triage. Patient tags embedded within DICOM headers (PatientName, PatientID, Institution, AccessionNumber) are automatically pseudonymized or stripped before cloud analysis.

2.5. Technical Telemetry: IP address, user agent, session token, and security access logs.

3. Legal Bases for Processing

3.1. Under GDPR Article 6(1) and LGPD Article 7, data processing is grounded in:

• Contractual Necessity (Art. 6(1)(b)): Provision of core SaaS diagnostic reporting features;
• User Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a)): Clinician authorization granted upon registration;
• Legitimate Interests (Art. 6(1)(f)): Preventing cyberattacks, brute-force intrusions, and ensuring API reliability.

4. Patient Confidentiality & Automated De-Identification (PD Guard)

4.1. Prohibition of Raw PHI: Clinicians are instructed never to submit raw, unencrypted direct patient identifiers.

4.2. Automated De-Identification Engine: RadBot incorporates the PD Guard filter, which scans all outgoing dictation and template text to detect and redact all eighteen (18) HIPAA Safe Harbor identifiers:

• Patient names, initials, and family member details;
• Geographic subdivisions smaller than a state;
• Dates directly related to an individual (birth date, admission date, discharge date);
• Telephone and facsimile numbers, email addresses, Social Security numbers;
• Medical record numbers, health plan beneficiary identifiers, account numbers;
• Certificate/license numbers, vehicle and device serial identifiers;
• Web URLs, IP addresses, biometric identifiers, and full-face photographic images.

5. AI Infrastructure & Zero-Model-Training Guarantee

5.1. All inference calls pass through the Provider's authenticated API proxy, guaranteeing rigorous end-to-end token auditing and preventing direct third-party tracking.

6. Third-Party Disclosures & Non-Sale of Data

6.1. The Data Controller does not sell, rent, monetize, or trade practitioner personal data or clinical reports to any third-party marketing firms, advertisers, or data brokers.

6.2. Disclosure of data to public or law enforcement authorities occurs strictly pursuant to valid, legally binding subpoenas or judicial warrants issued by competent courts.

7. Data Retention Schedule

8. Cookies & Local Browser Storage

8.1. The Platform utilizes strictly essential functional cookies and HTML5 LocalStorage entries (e.g. radbot_token for session authentication, ui_locale for language preference, and interface themes).

8.2. Third-party commercial marketing cookies, tracking pixels, and behavioral ad networks are strictly prohibited and entirely absent from the Platform.

9. International Data Subject Rights (GDPR / CCPA / LGPD)

In accordance with GDPR (Articles 15–22), UK GDPR, CCPA/CPRA, and LGPD, Users maintain the following enforceable rights:

• Right of Access: Request full disclosure of personal data held by the Controller;
• Right to Rectification: Update or correct inaccurate personal credentials or templates;
• Right to Erasure ("Right to be Forgotten"): Permanently delete account and all historical records;
• Right to Restriction of Processing & Data Portability: Export historical reports in structured formats;
• Right to Lodge a Complaint: Clinicians in the EU/UK may file a grievance with their respective national Data Protection Authority (DPA / ICO).

To exercise any statutory right, use the "Delete Account" button in your Web App settings, or email: support@ai-protocol.ru.

10. Security Incident Response & Breach Notification (GDPR Art. 33 / 72-Hour Standard)

10.1. In the unlikely event of a confirmed personal data security incident or unauthorized breach, the Platform complies with mandatory 72-hour regulatory disclosure standards:

• The competent supervisory authority is notified without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach;
• Impacted data subjects are notified promptly if the breach is likely to result in a high risk to their individual rights and freedoms;
• Immediate corrective mitigation and vulnerability patching are enacted.

Security vulnerabilities and incident reports can be reported directly to: support@ai-protocol.ru.

11. Technical & Organizational Security Safeguards

11.1. The Platform implements multi-layered security controls: TLS 1.3 encryption in transit with forward secrecy, AES-256 database rest encryption, one-time passcode (OTP) email authentication, secure PIN protection, regular automated vulnerability audits, and strict workspace isolation.

12. Privacy Contact & Inquiries

For inquiries regarding privacy, HIPAA compliance, or GDPR data subject requests, please contact our Data Protection desk at: support@ai-protocol.ru.