Data Rights

Version 1.11 — effective 28 October 2026

Who this applies to

This page explains how to exercise GDPR rights with SYNRADX TECHNOLOGIES S.R.L. It applies to data for which SYNRADX is controller, including account, security, contract, billing and support data.

For content entered by a clinic or organisation in its own activities, the customer is ordinarily the controller. In that case, a request about that content should go to the customer and SYNRADX will support it as processor.

Available rights

Subject to law, you may request:

• information and access to data and explanations about its processing;
• rectification of inaccurate data and completion of incomplete data;
• erasure where no basis remains for retention;
• restriction in the situations defined by the GDPR;
• portability of supplied data in a structured, commonly used format where conditions are met;
• objection to processing based on legitimate interests, including direct marketing;
• withdrawal of consent without affecting prior lawful processing;
• not to be subject to a solely automated decision with legal or similarly significant effect under GDPR Article 22.

IMORAY does not make solely automated decisions with legal or medical effects on a patient. AI outputs are editable texts subject to user decision.

How to submit a request

Write to privacy@imoray.app or use account export and deletion features. For a notice by post, SYNRADX's postal address is available in the Legal Notice.

State the requested right and account email. Do not send a national identification number, full ID copy, patient data or clinical content by email. If identity verification is needed, we will request information proportionate to risk and use the authenticated account where possible.

Response and cost

We respond without undue delay and ordinarily within one month. For complex or numerous requests, the period may be extended by two months with notice during the first month.

Requests are free. We may charge a reasonable fee or refuse a manifestly unfounded or excessive request, particularly if repetitive, while explaining reasons and appeal options.

Limits and legal retention

A right may be limited by law, others' rights, professional secrecy, security, tax duties or the need to establish, exercise or defend legal claims. Account deletion does not instantly remove rotating backups or records that must legally be retained; these remain blocked from incompatible purposes and are deleted when the period ends.

Purely local preferences may remain in the browser until you clear site data. Logout clears account data and the local audio queue but may preserve theme or other device preferences.

Complaint

If you believe processing breaches the law, request review at privacy@imoray.app and lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing at www.dataprotection.ro.