Security & data protection
Built for clinical trust
What happens to your data, who touches it, and where the AI's authority ends — in specifics, not reassurances.
Patient identifiers stripped before report structuring.
Your reports never train our models.
What the AI does
- Transcribes your dictated findings
- Structures them into your report sections
- Phrases them in your learned reporting style
- Flags missing details for your review
What it never does
- Interpret images or generate findings
- Add, remove or modify clinical content
- Produce a final report without your review
- Use your reports to train AI models
The data flow
Five steps. No surprises.
- 01
You dictate
You describe your findings as you review the study.
- 02
Identifiers stripped
Built-in PHI detection finds and removes patient identifiers from transcripts before report structuring.
- 03
AI structures
The de-identified dictation is structured into a draft in your style. Nothing clinical is added or removed.
- 04
You review
The draft returns to you. You edit, resolve quality flags, and approve — or discard it.
- 05
You export
Only after your review does a report leave the product, as a copy or PDF under your name.
In practice
How we protect your data
Patient identifiers stripped before report structuring
PHI detection runs before any data is sent to AI services. The models that structure your dictation work with de-identified findings, not patient details.
Your reports never train our models
Your dictations, transcripts and reports are used solely to produce your drafts. They are not used to train AI models — ours or our providers'. Our AI providers process API data under zero-training terms.
Encryption in transit and at rest
All traffic is encrypted with TLS, and stored data is encrypted at rest on EU-hosted infrastructure.
Your data stays yours
Accounts are isolated — your style profile and reports are visible only to you. Delete a report, or your account, and the associated data goes with it.
No audio retained
Dictation audio is processed for transcription and is not kept as a stored recording on our servers.
Designed for UK data protection
Built around UK GDPR and the Data Protection Act 2018, with data processing agreements in place with every provider listed below.
Subprocessors
Who we work with
Every provider that touches your data, and why. Data processing agreements are in place with each of them.
| Provider | Purpose | Notes |
|---|---|---|
| Anthropic | AI Report Structuring | DPA in Place · Zero Data Retention for Training |
| OpenAI | Dictation Transcription | DPA in Place · API Data Not Used for Training |
| Supabase | Database & Storage | DPA in Place · EU-Hosted · Encrypted at Rest |
| Clerk | Authentication | DPA in Place |
| Vercel | Application Hosting | DPA in Place · EU Serving Regions |
| Sentry | Error Monitoring | DPA in Place · EU Data Residency |
| Cloudflare | DNS & Security | DPA in Place |
The boundary
Not a medical device — by design
Radiology Assist is an AI-assisted drafting tool. It does not interpret images, make diagnoses, or provide clinical decision support, and it is not a regulated medical device. Every report it produces is a draft that requires review by a qualified radiologist before use.
Questions about security, data handling or procurement? We answer them directly.
See also our Privacy Policy and Terms of Service.