Data controller
The controller for data processed on this site is:
- Trading name: ExplainMyScan
- Contact email: hola@explainmyscan.com
Health data, first
The medical reports and images you upload are special category data under Article 9 of the General Data Protection Regulation. They deserve different treatment, which is why they come before anything else here.
The legal basis for processing them is your explicit consent, given when you order an analysis (Article 9(2)(a)). You can withdraw it at any time; withdrawing it means we can no longer provide the service.
They are not used to train artificial intelligence models. They are not sold or shared for commercial purposes. They are never combined with visit analytics.
What we process
- Account: email address and, if you provide them, name and country.
- Study: the files you upload and the context you fill in (age, sex, height, weight, allergies, surgery, medication, implants, and anything else you tell us).
- Generated report: the explanation text and the PDF.
- Payment: amount, date and status. Your card details are handled directly by Stripe; we never see or store them.
- Browsing: landing page, referring domain, language, country, device type and campaign parameters. We do not store your full IP address or user agent.
- Service activity: if you are signed in, which panel screens you open and which step of the form you are on. It tells us where people get stuck so we can fix it. The free DICOM tools work without an account, and used that way they are not linked to anyone.
Purposes and legal bases
- Providing the analysis service: performance of the contract, plus explicit consent for health data.
- Managing your account and subscription: performance of the contract.
- Invoicing and tax obligations: legal obligation.
- Measuring where visits come from and whether campaigns work: legitimate interest in sustaining the service, using minimal data.
- Understanding how the service is used in order to improve it: legitimate interest. If you are signed in, that activity is linked to your account. It is never used for advertising and never combined with your health data, and you can object by writing to us.
- Answering your questions: legitimate interest in replying to you.
Who else processes it
We work with providers acting as processors, under contract and with no more access than strictly necessary:
- OVH (servers in France): hosting of the website, the database, the files you upload and the backups, which are encrypted.
- Anthropic: the artificial intelligence model that reads your study and writes the explanation.
- Stripe: payments and invoicing.
- Resend: sending the service emails (your address and the content of the notice; never your health data).
Some of these providers may process data outside the European Economic Area. Where that happens, the transfer relies on the standard contractual clauses approved by the European Commission or on an adequacy decision.
How long
The files you upload and the report generated from them are kept for 90 days from the request, then deleted automatically. You can ask us to delete them sooner.
Account data is kept while your account is open. Billing data is kept for the period tax law requires, which in Spain is six years.
Browsing data is kept in aggregate form to measure campaigns.
Automated decisions
The explanation is written by an automated system, but it is not a decision producing legal effects or similarly significantly affecting you under Article 22 of the Regulation: it is informational text about a document you already had, not a diagnosis and not a refusal of anything.
Either way, clinical decisions about your health are made by your doctor, not by this service.
Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@explainmyscan.com. You can also withdraw your consent at any time.
If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to your local supervisory authority.
Security
Files are held in private storage, encrypted at rest and in transit, and reachable only from your account. Passwords are never stored in plain text. Internal access is limited to what is needed to operate the service.
When someone on our team needs to look at the health data of a request — to resolve an incident or handle a complaint — who did it and when is recorded. That log cannot be switched off from the panel, and you can ask us for a copy of the part that concerns you.
Before your images are sent to the model, they are converted to a format that discards DICOM metadata, which is where your name and hospital record number usually sit.