Privacy Policy for NeuroRadX

The controller responsible for processing your personal data is:

Further legal information is available in our Impressum. For data protection enquiries or to exercise your rights, contact us at the address or email above.

Under Swiss law we process data lawfully, proportionately, transparently and for the purposes described here. Where a justification is required, it may arise from consent, an overriding private or public interest, or law (Art. 31 FADP). The GDPR legal bases stated below apply only where the GDPR applies.

This Privacy Policy applies to the NeuroRadX website, application, and related services. When you register for an account, purchase a plan (when available), or otherwise use the Service, we process personal data as described here and as necessary to perform our Terms of Use.

• Contract performance (Art. 6(1)(b) GDPR): Account creation, authentication, providing study features, support, and billing where applicable.
• Consent (Art. 6(1)(a) GDPR): Optional profile fields and, where required, specific checkout or marketing consents.
• Legitimate interests (Art. 6(1)(f) GDPR): Security, fraud prevention, service improvement, and essential technical operation, balanced against your rights.

We process your personal data in the following categories:

NeuroRadX may use automated or AI-assisted tools to enrich educational content, discover scientific references, or improve internal workflows. This section describes how such processing relates to your personal data.

• Administrator content enrichment: Authorised administrators may use tools such as Google AI (Gemini) to enrich question text with scientific references. Only question content is processed in this workflow. We do not send your personal profile, notes, or activity data to Google AI for this purpose.
• User-facing features: If future features expose AI-assisted outputs directly to users, we will describe the relevant processing in an updated version of this Policy before launch.
• We do not make exclusively automated individual decisions with legal or similarly significant effects within Art. 21 FADP or, where applicable, Art. 22 GDPR. Security checks may block a registration or sign-in attempt; contact support for human review if this prevents access.

Transfers from Switzerland are subject to Art. 16–17 FADP. We rely on an applicable Swiss adequacy decision or appropriate safeguards, such as recognised standard contractual clauses with Swiss adaptations. The Swiss–US Data Privacy Framework applies only to US recipients with an active certification covering the transfer; the EU–US framework alone is not a Swiss transfer basis. Where the GDPR applies, its Chapter V safeguards also apply. Contact us for information about safeguards applicable to your data.

We do not sell your personal data. We share data only with service providers who help us operate the Service, subject to appropriate safeguards:

• Google Firebase / Google Cloud provides authentication, database storage and hosting. The application server is configured in Germany. The Firestore database uses Belgium and the Netherlands, with a witness replica in Finland; Firebase Authentication processes data in the United States. This is not Switzerland-only hosting. Other Google services, global content delivery and support may involve additional processing locations described in Google’s service and subprocessor information.
• Algolia: Powers search functionality. We index question content, not personal user profiles. Algolia may process data in the EU or USA under appropriate safeguards.
• Google AI (Gemini): Used by administrators to enrich question content. Only question text not linked to identifiable users is processed, as described in Section 4.
• Email delivery (Google Workspace): Sends transactional emails such as account verification, password reset, organisation invitations and notices to organisation administrators. Google receives the recipient's email address and the message content. Firebase Authentication generates the one-time codes contained in verification and password-reset links.
• Your organisation: If you join an institution or scientific society (by invitation, registration code, or your email domain) and agree to progress visibility, authorised staff of that organisation can see the progress reports intended for learning supervision. They do not see your personal notes.
• For institutional checkout payments, Stripe processes contact, billing and payment data, including processing in Ireland and the United States. NeuroRadX stores customer, subscription and transaction identifiers and payment status, not full card details. Purposes are contract performance and compliance with applicable record-retention obligations. Where the GDPR applies, Art. 6(1)(b) and (c) apply. The international-transfer safeguards below also apply.
• Apple / Google (future in-app purchases): If in-app purchases are offered, those platforms process payment data under their own privacy policies.

Service providers acting as processors are engaged under Art. 9 FADP and, where applicable, Art. 28 GDPR. Some payment or platform providers also process data as independent controllers for their own legal duties; their privacy notices explain that processing.

Registration and, when required, sign-in use Google reCAPTCHA. IP addresses, browser and device information and interactions may be sent to Google, and information may be stored on or read from your device. Transfers to third countries, including the USA, may occur. See Google’s privacy policy for details of its processing.

Abuse prevention serves secure operation under the Swiss FADP. Where the GDPR applies, the basis is Art. 6(1)(f), subject to a balancing of interests. Device storage is also subject to Art. 45c of the Swiss Telecommunications Act and any applicable foreign consent requirements. If verification blocks access, contact support@neuroradx.com for assistance.

If you participate in a learning study, we process the information requested in the participation form, versioned consent and learning and assessment results. The purpose, participation conditions and consent are explained before participation. Study administrators can export the designated study evaluations. With institutional access, authorised staff receive the progress reports intended for learning supervision under the sharing notice shown to you. Send access, deletion or consent-withdrawal requests to support@neuroradx.com; withdrawal does not affect the lawfulness of earlier processing.

If you delete your account: your pre- and post-test answers and the demographic data you gave for the study (position, experience, clinical background, language, institution, and whether you agreed to be contacted) are kept for the study analysis, under your participant code. Your name, email address, and profile are deleted, so the study data can no longer be attributed to you. If you want your study data deleted as well, write to support@neuroradx.com before deleting your account. Study data are kept only as long as the study and its scientific publication require and are used only in aggregated form, as described in the consent you gave.

• Account and progress data: Retained while your account is active. When you delete your account, we delete your profile (including the registration IP address and the record of your acceptance of the legal texts), progress, notes, bookmarks, notifications, support messages, and profile photo. Issue reports you submitted are kept without your name, user ID, or email address, because they concern question content. Study data are handled as described in the research section above.
• Backups: Database backups are kept for up to 90 days. Data you delete therefore disappears from backups within 90 days at the latest.
• Billing and accounting records: retained for applicable Swiss statutory periods, including ten years from the end of the financial year for records covered by Art. 958f of the Code of Obligations. Data outside retention duties is kept only as long as necessary for its purpose or legitimate legal claims.
• Server and security logs: Typically retained for up to 30 days unless longer retention is necessary to investigate security incidents or comply with law.
• Support messages and issue reports: Retained as long as needed to resolve the issue and improve the Service, and in any case deleted or anonymised as described above when you delete your account.

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), access controls, and secure authentication. Our infrastructure is hosted on Google Cloud Platform with industry-standard security practices. No method of transmission or storage is completely secure; please use a strong password and keep your credentials confidential.

This Service is for medical education and does not support processing identifiable patient data. Do not enter patient names, identifiers, health records or other sensitive personal data under Art. 5(c) FADP or Art. 9 GDPR in notes, reports or profiles.

If you believe you have submitted such data in error, contact us promptly so we can delete it.

Under the FADP you may request access to your data (Art. 25), correction of inaccurate data and, where the legal conditions are met, deletion or cessation of processing (Art. 32). You may request delivery or transfer of data under Art. 28 where its conditions are met. Consent may be withdrawn for future processing; statutory retention duties and other lawful grounds remain unaffected.

Where the GDPR applies, you additionally have its rights of access, rectification, erasure, restriction, portability and objection (Art. 15–21), withdrawal of consent (Art. 7(3)) and complaint to a competent supervisory authority (Art. 77), subject to the conditions of those provisions.

You may report suspected breaches of Swiss data protection law to the Federal Data Protection and Information Commissioner (FDPIC/EDÖB). Civil-law remedies before the competent courts remain available.

Contact the controller in Section 1 to exercise your rights. Access requests under Swiss law are generally answered within 30 days; we will inform you within that period if more time is needed. Where the GDPR applies, its one-month period and extension rules apply. We may request proportionate identity verification.

NeuroRadX is intended for medical students, residents, radiologists, neuroradiologists, neurologists, neurosurgeons, and other healthcare professionals or trainees. We do not knowingly collect personal data from children under 18. By registering, you confirm that you are at least 18 years old, consistent with our Terms of Use. If you believe we have inadvertently collected data from a person under 18, please contact us and we will delete it promptly.

We may update this Privacy Policy to reflect legal, technical, or business changes. Immaterial changes may take effect upon publication. Material changes will be notified by updating this page and, where appropriate, by email or in-app notice at least 30 days before they take effect. The "Last updated" date at the top indicates the current version.

For any questions about this Privacy Policy or our data practices, please contact us at support@neuroradx.com or at the address in Section 1.