Privacy Policy

Effective date: August 3, 2025 · Last updated: August 3, 2025

DecodeMD ("we," "us," or "our") is committed to protecting your privacy and ensuring transparency in how we handle your personal data. This Privacy Policy describes how we collect, use, store, and share information when you access or use our website or services.

By accessing or using DecodeMD, you consent to the practices described in this Privacy Policy.

1. Scope of Policy

This Policy applies to all visitors and users of the DecodeMD platform, including individuals located in the United States, the European Economic Area (EEA), the United Kingdom (UK), and California. It complies with:

• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
• The General Data Protection Regulation (GDPR) (EU Regulation 2016/679)

2. Information We Collect

We collect the following categories of information:

a. Personal Information You Provide Voluntarily

• Content submitted via text input (e.g., portions of medical reports for translation)
• Feedback or inquiries submitted through contact forms or email

b. Automatically Collected Data

• IP address
• Device and browser type
• Operating system
• Referring URLs
• Pages visited and usage patterns
• Time spent on the site

This information is collected through cookies, analytics tools, and server logs.

3. Legal Bases for Processing (GDPR)

If you are located in the EEA or UK, we process your personal data under the following lawful bases:

• Consent (Article 6(1)(a)) — when you explicitly agree to our use of cookies or submission of text
• Legitimate Interests (Article 6(1)(f)) — for analytics, service improvement, and security
• Contract (Article 6(1)(b)) — when we provide services you request

4. How We Use Your Information

We use your data solely to:

• Translate complex medical language into plain-language summaries
• Improve the user experience, performance, and interface
• Detect, prevent, and address technical issues and abuse

We do not:

• Sell your data to third parties
• Share your data for advertising purposes
• Use your input to train AI models (we disable logging on OpenAI's API)

5. Data Retention and Deletion

We do not store submitted text or medical data long-term. Inputs are processed in-session and discarded unless:

• You voluntarily request to download results
• Retention is required for a specific service feature (e.g., customer support)

Automatically collected analytics data may be retained for up to 12 months for system optimization and security audits.

You may request data deletion by contacting: privacy@decodemd.co

6. Your Rights

a. Under CCPA/CPRA (California Residents)

You have the right to:

• Know what personal data is collected and why
• Access your personal data
• Request correction or deletion
• Opt out of the sale or sharing of personal information
• Limit use of sensitive personal data (if applicable)
• Not be discriminated against for exercising these rights

To exercise these rights, email: privacy@decodemd.co

DecodeMD does not sell or share your data and is not subject to "Do Not Sell My Info" opt-outs at this time.

b. Under GDPR (EEA/UK Residents)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Lodge a complaint with your local Data Protection Authority

To make a request, email: support@decodemd.co

7. Data Transfers Outside the EU/UK

Our services may be hosted on servers in the United States or other jurisdictions. If you are located in the EEA or UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Appropriate safeguards to protect personal data transferred outside the EU

8. Cookies and Analytics

We use minimal cookies and analytics tools (e.g., Google Analytics) to understand traffic patterns and improve functionality. You can manage your cookie preferences through your browser settings or via any consent banner provided.

9. Children's Privacy

DecodeMD is not intended for individuals under the age of 13 (or 16 in the EU/UK). We do not knowingly collect or store data from children. If we learn that a child has submitted data, it will be deleted promptly.

10. Data Security

We implement reasonable technical and organizational safeguards, including:

• SSL/TLS encryption
• Limited session-based data handling
• Role-based access controls (where applicable)
• Use of reputable third-party processors with strong privacy commitments

That said, no system can guarantee 100% security. Use of this platform is at your own risk.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Effective Date." Continued use of our services after a change constitutes acceptance of the new terms.

12. Contact Us

If you have questions or wish to exercise your privacy rights, contact us at: support@decodemd.co

If you are in the EEA or UK, you may also contact your local data protection authority.