Privacy Policy

1. Introduction

AccuVis AI ("AccuVis", "we", "us", "our") is committed to protecting the privacy of everyone who interacts with our website and our clinical analysis console (together, the "Services"). This policy explains what information we collect, how we use and protect it, and the choices and rights available to you. By using the Services, you acknowledge the practices described here.

2. Our role: controller and processor

For information collected through our public website (for example, contact enquiries), AccuVis acts as a data controller. For patient and clinical information processed within the analysis console on behalf of a healthcare organization ("Customer"), AccuVis acts as a data processor, and the Customer is the controller responsible for that data. Where we act as a processor, our handling of personal and health data is governed by the agreement (including any Data Processing Agreement) between AccuVis and the Customer.

3. Information we collect

• Website enquiries. When you submit the contact form, we collect your name, email address, organization, organization type, country, indicative X-ray volume, timeline, and your message.
• Account & access data. When an administrator provisions console access, we store account email, a securely hashed password, assigned role, and session information used to keep you signed in.
• Patient & clinical data. Within the console, the Customer may create patient records (such as identifier, name, date of birth, gender, contact details, smoking and family history, occupation, and notes), upload chest radiographs (including DICOM files and their metadata), and generate analysis results, clinician reviews, and recommendations.
• Generated outputs. We store AI-generated risk scores, pathology probabilities, attention/heatmap images, and the reports produced from them, including any shareable report links created by authorized users.
• Technical data. Standard server logs (such as IP address, timestamps, and request metadata) used to operate and secure the Services.

4. How we use information

We use information to provide and operate the Services; to authenticate users and manage console access; to perform image analysis and produce clinical decision-support outputs; to respond to enquiries; to maintain security, prevent abuse, and meet legal obligations; and to improve the reliability and quality of the Services. We do not sell personal information. We do not use identifiable patient data to train models except where expressly permitted under our agreement with the relevant Customer.

5. Storage and retention

Unlike a transient demonstration, the console is a record-keeping system: patient records, uploaded images, analysis results, and reports are stored so that authorized clinicians can review them over time. Account passwords are stored only as salted hashes. We retain data for as long as needed to provide the Services, and—where we act as a processor—for the period defined by the Customer or by applicable law. Customers may request export or deletion of their data in accordance with their agreement. Shareable report links remain accessible until they are revoked.

6. Sharing and sub-processors

We share information only as necessary to operate the Services: with infrastructure and hosting providers acting as sub-processors under appropriate contractual safeguards; with a Customer's own authorized users; with recipients of a report link explicitly created by an authorized user; and where required by law or to protect rights and safety. We do not disclose personal or health information for advertising.

7. Security

We apply technical and organizational measures designed to protect information, including encrypted transport (HTTPS), hashed credentials, role-based access controls, session management, and unguessable tokens for shared reports. No system is perfectly secure; we cannot guarantee absolute security, and you are responsible for safeguarding your account credentials.

8. International transfers

Information may be processed and stored in countries other than your own. Where required, we use appropriate safeguards for cross-border transfers. Customers can discuss data-residency options with us as part of their agreement.

9. Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal data, and to object to certain processing. For data we hold as a controller (e.g., website enquiries), contact us using the details below. For patient or clinical data processed within the console, please direct requests to the relevant healthcare organization (the controller), which we will support as its processor.

10. Children's data

The website is not directed to children. Patient data processed within the console may relate to individuals of any age and is handled under the controlling healthcare organization's authority and applicable law.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, through additional notice.

12. Contact

For privacy questions or to exercise your rights, please use the contact form. A Data Processing Agreement is available to Customers on request.