Privacy policy

Data controller

The controller for data processed on this site is:

• Registered name: SmartSites SL
• Trading name: ExplainMyScan
• NIF: B81546372
• NIF-IVA: ESB81546372
• Registered address: Carrer d'Aribau, 25, 08172 Sant Cugat del Vallès (Barcelona), España
• Contact email: hola@explainmyscan.com

Health data, first

The medical reports and images you upload are special category data under Article 9 of the General Data Protection Regulation. They deserve different treatment, which is why they come before anything else here.

The legal basis for processing them is your explicit consent, given when you order an analysis (Article 9(2)(a)). You can withdraw it at any time; withdrawing it means we can no longer provide the service.

They are not used to train artificial intelligence models. They are not sold or shared for commercial purposes. They are never combined with visit analytics.

What we process

• Account: email address and, if you provide them, name and country.
• Study: the files you upload and the context you fill in (age, sex, height, weight, allergies, surgery, medication, implants, and anything else you tell us).
• Generated report: the explanation text and the PDF.
• Payment: amount, date and status. Your card details are handled directly by Stripe; we never see or store them.
• Browsing: landing page, referring domain, language, country, device type and campaign parameters. We do not store your full IP address or user agent.

Purposes and legal bases

• Providing the analysis service: performance of the contract, plus explicit consent for health data.
• Managing your account and subscription: performance of the contract.
• Invoicing and tax obligations: legal obligation.
• Measuring where visits come from and whether campaigns work: legitimate interest in sustaining the service, using minimal data and no individual profiling.
• Answering your questions: legitimate interest in replying to you.

Who else processes it

We work with providers acting as processors, under contract and with no more access than strictly necessary:

• Supabase: database and file storage.
• Vercel: website hosting and running the analysis.
• Anthropic: the artificial intelligence model that reads your study and writes the explanation.
• Stripe: payments and invoicing.

Some of these providers may process data outside the European Economic Area. Where that happens, the transfer relies on the standard contractual clauses approved by the European Commission or on an adequacy decision.

How long

The files you upload and the report generated from them are kept for 90 days from the request, then deleted automatically. You can ask us to delete them sooner.

Account data is kept while your account is open. Billing data is kept for the period tax law requires, which in Spain is six years.

Browsing data is kept in aggregate form to measure campaigns.

Automated decisions

The explanation is written by an automated system, but it is not a decision producing legal effects or similarly significantly affecting you under Article 22 of the Regulation: it is informational text about a document you already had, not a diagnosis and not a refusal of anything.

Either way, clinical decisions about your health are made by your doctor, not by this service.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@explainmyscan.com. You can also withdraw your consent at any time.

If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to your local supervisory authority.

Security

Files are held in private storage, encrypted at rest and in transit, and reachable only from your account. Passwords are never stored in plain text. Internal access is limited to what is needed to operate the service.

Before your images are sent to the model, they are converted to a format that discards DICOM metadata, which is where your name and hospital record number usually sit.