Privacy Policy

You sign in before saving a case. We then record the identity supplied by the authentication provider (email address and account identifier), the display name you provide, and your account role in our system. We do not ask for identity-card numbers, policy numbers, or financial data.

We also record whether you are preparing the summary for yourself or someone else. A caregiver's role is kept separate from the patient's role. To contact you, we store the contact channel you choose: email, telephone, or both, together with the contact name, city, and preferred channel.

The report-upload flow creates a structured case summary. Stored fields may include cancer type and subtype, stage when known, histology, diagnosis date, molecular-testing status, tested markers and the results you enter, current disease state, the latest imaging summary, treatment history and the outcome you report, planned payment method, an optional budget note, travel readiness, urgent-symptom signals, and your main question.

Every entry is recorded as an unverified patient report. It is explicitly labelled and kept distinct from facts later supported by documents or clinical review, so an entry is not treated as a validated test result.

You may upload medical files in PDF, JPEG, PNG, up to 15 MB each. Files are stored in private storage rather than a publicly accessible location, using a path that contains your account and case identifiers.

After upload, the server checks the file type and size, verifies that the content matches the declared type, and calculates a SHA-256 fingerprint. This lets authorized staff compare the stored document with the submitted document without copying its contents elsewhere.

Access to files and case summaries is restricted to your account. Before granting access, the server checks that the requested case belongs to the signed-in account, and database row-level restrictions prevent one account from reading another account's cases. Authorized staff can open documents only through time-limited links issued by the server.

The server issues a signed upload link valid for about 2 hours. A document download link is valid for only 60 seconds. These links are issued only after ownership checks and stop working after they expire.

A case is not stored until you actively check the consent box. We record the consent event, its version, time, and scope: storing the case summary, contact by a navigator, and preliminary clinical-trial eligibility review. The consent record remains linked to the case.

An audit event is also recorded when consent is accepted. This is an operational trace of why the data was stored and who consented, not an assessment of you.

We do not make an automated diagnosis or store medical conclusions that you did not provide. We do not request policy, bank-account, or other sensitive financial numbers, and the form warns you not to enter them.

We do not make your medical documents public, use them for advertising, or copy their contents into third-party services. Documents remain in private storage accessible only through time-limited links.

Analytics are used to understand the user journey, not the contents of your files. We record event name, time, traffic class, and event properties restricted by an allowlist. Values resembling personal identifiers are discarded, and report text, diagnosis details, and patient identities are not sent to analytics.

Events may be linked to cases and leads through identifiers so that the next step can be measured. The link contains identifiers rather than clinical content, allowing measurement without moving medical-record contents into analytics.

We use service providers for database, authentication, private storage, internal email notifications, customer-relationship management for operational follow-up, and an official messaging provider when that channel is enabled.

Internal notifications and CRM records contain only a case reference, request source and goal, priority, and a link to the operations panel. They do not contain clinical details, report contents, diagnoses, or patient names. Access is limited to authorized staff.

Case data and documents are kept while your case is active and still needed to follow up your request. You may request deletion at any time, and a summary stored in your browser can be removed by you directly.

Detailed retention periods, deletion-request timelines, and the lawful basis for processing are not yet final and require owner legal review. We state them as undecided rather than promise terms we cannot yet support.

You may request a copy of data we hold about you, correction of inaccurate data, deletion, and withdrawal of consent for future processing. Withdrawal does not undo processing that occurred before consent was withdrawn.

A local summary can be deleted from its summary page. For access, correction, consent withdrawal or deletion of server-stored data, use the official privacy contact on this page. Start with your account email or case reference; do not attach medical reports to ordinary email. Identity and authority must be verified before data is disclosed or deleted.

The operator and official privacy contact are published on this page. The office address and appointment of a data protection officer have not been confirmed. The navigator is a coordination contact, not a designated data protection officer.

When this policy changes, this page and its update date will be revised. The notification method, lawful basis, and binding retention periods require owner legal review before they are stated as commitments.

The lawful basis for health-data processing, exact retention periods, access and deletion response times, policy-change notification, and appointment of a data protection officer still require formal decisions.

We identify these points openly so that no legal statement appears more certain than it is. Until reviewed, this page explains our operational flow and is not presented as a final legal instrument.