Privacy Policy

Radiology Assist is a product of Avium Marketing Ltd (company number 16022897), registered at 99 Richmond Road, Montpelier, Bristol, BS6 5EP. We provide an AI-assisted draft reporting tool for radiologists and act as the data controller for the personal data described in this policy.

Contact: [email protected]

When you use Radiology Assist, we process:

• Account data — your name, email address and authentication details, managed through our authentication provider (Clerk).
• Style corpus reports — the previous reports you upload so the product can learn your reporting style. You are responsible for removing patient-identifying information from these before upload; our PHI detection provides an additional safeguard.
• Dictations and transcripts — your dictated findings are transcribed to text. Dictation audio is processed for transcription and is not retained as a stored recording.
• Draft reports — the structured drafts generated from your dictation, stored in your account so you can review, edit and export them.
• Patient form fields — if you enter patient details (name, date of birth, identifier) into the report form, these are stored alongside the draft in your account. These fields are optional and are not sent to AI services.
• Usage and technical data — logs and error reports needed to operate and improve the service.

Clinical findings in dictations and reports constitute special category data (health data) under UK GDPR Article 9. We process this data on the basis of your explicit consent (Article 9(2)(a)), which you provide when you create an account and use the service to process clinical content. You may withdraw consent at any time by closing your account, at which point your data will be deleted.

For general personal data (account details, usage data), our lawful basis is the performance of our contract with you (Article 6(1)(b)) and our legitimate interests in operating and securing the service (Article 6(1)(f)).

Radiology Assist is designed so that AI services work with de-identified clinical findings. Built-in detection finds and strips patient data from transcripts before report structuring. If you enter patient details into the optional form fields, these are stored in the database but are never sent to AI providers.

Your dictations, transcripts and reports are used solely to provide the service to you — they are never used to train AI models, ours or our providers'.

• To provide the service: transcription, style learning and draft report generation.
• To operate, secure and support your account.
• To fix faults and improve reliability, using technical logs.
• To communicate with you about the service.

We use the following service providers, each under a data processing agreement:

• Anthropic — AI report structuring (USA)
• OpenAI — dictation transcription (USA)
• Supabase — database and storage (EU-hosted, Frankfurt)
• Clerk — authentication (USA)
• Vercel — application hosting (USA headquarters, EU serving)
• Sentry — error monitoring (EU data residency)
• Cloudflare — DNS and security (USA)

The current list, each provider's role, and DPA status is published on our security page.

Some of our processors are based in the United States (Anthropic, OpenAI, Clerk, Vercel). Where personal data is transferred outside the UK, the transfer is protected by the UK International Data Transfer Agreement (UK IDTA) or UK Addendum to EU Standard Contractual Clauses, as included in each processor's data processing agreement.

Data is encrypted in transit using TLS and encrypted at rest. Accounts are isolated so your reports and style profile are accessible only to you. Patient data is stripped before report structuring. See our security overview for detail.

Your reports, style profile and account data are retained while your account is active. You can delete individual reports at any time. If you close your account, all associated personal data is deleted from our systems, except where we are required to retain limited records by law.

Audit logs are retained for up to 24 months for security and accountability purposes. Usage analytics are retained for up to 12 months.

Radiology Assist uses only strictly necessary cookies for authentication and session management. We do not use advertising, analytics or tracking cookies. No cookie consent is required for strictly necessary cookies under PECR, but we disclose their use here for transparency.

Under UK GDPR you have the right to access, rectify, erase, restrict and object to our processing of your personal data, and to data portability. You can export all your data from your account settings, or contact us to exercise any right.

Contact: [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We will post any changes to this policy on this page and update the date above. If a change is material, we will notify you by email or in the product.