Privacy Policy

1. Who This Applies To

R+ is provided to Clinics, not directly to the general public. Clinic staff accounts are created by the Clinic administrator; there is no public self-registration. Patients interact with R+ only through a time-limited, credential-protected download link sent by their Clinic.

2. Information We Collect

• Staff account data: name, username, role, and authentication credentials, created and managed by the Clinic.
• Protected health information (PHI): patient demographics, orders, imaging studies, and reports entered or generated by the Clinic in the course of care. R+ processes this data solely on behalf of the Clinic, which remains the data controller.
• Patient portal access data: the access code, password, and session token issued for a specific study, and basic request metadata (timestamp, IP address) used to detect abuse and enforce expiry.
• Technical data: log data, error reports, and cookies strictly required for authentication and session management (e.g. the session cookie set on sign-in).

3. How Information Is Used

Information is used only to operate the Service: authenticating users, delivering imaging results to the correct patient, generating reports, maintaining audit trails, and diagnosing technical issues. We do not sell personal information or PHI, and we do not use PHI for advertising.

4. Storage & Security

Imaging bundles are stored in access-controlled object storage and are only retrievable with a valid, time-limited access code and password. Download links and portal pages are excluded from search engine indexing. Passwords and credentials are hashed; download tokens are short-lived and signed. Access to the underlying database is restricted to the Clinic's authorized administrators.

5. Retention

Patient result bundles and their associated access credentials expire automatically after the retention period configured by the Clinic. Expired links can no longer be used to retrieve imaging data.

6. Third-Party Processors

We may use subprocessors for object storage and transactional email delivery solely to operate the Service. These processors act under contractual obligations to protect data and do not use it for their own purposes.

7. Your Rights

Requests to access, correct, or delete personal information or PHI should be directed to the Clinic that ordered the study, as they control the underlying medical record. Clinic staff may contact their system administrator to manage account data.

8. Contact

Questions about this Privacy Policy can be directed to [privacy@example.com].