Privacy Notice

Version 1.11 — effective 28 October 2026

Who we are

The operator of IMORAY is SYNRADX TECHNOLOGIES S.R.L. For privacy questions and the exercise of your rights, contact us directly at privacy@imoray.app. Full company identification and the postal contact address are available in the Legal Notice.

Data roles

SYNRADX is controller for account, authentication, security, contractual, billing, support and service-administration data.

Where a clinic, organisation or professional uses IMORAY for content entered in its own activities, the customer determines the purposes and legal bases for that content. In that situation the customer is controller and SYNRADX acts as processor under the Data Processing Agreement.

IMORAY is not intended as a medical service for direct patient use and does not accept children's accounts. Accounts are for people aged at least 18, including consumers buying a personal subscription and people using the service professionally.

Data we process

We may process:

• name, email, organisation, role and language or interface preferences;
• passwords held only as hashes, session and device identifiers, security events and IP addresses reduced or protected according to purpose;
• plan, subscription status, the declared capacity in which the buyer is acting (consumer or professional/business customer), immediate-performance request and withdrawal-information evidence, offer and term, seat count, applied discounts, billing, withdrawal and refund events and tax documents; full card details are managed by Stripe, not IMORAY;
• for personal subscriptions and team orders: payer account and payer type, plan, monthly period, currency, price, discount and seat count, recipient addresses predesignated by the payer, normalised addresses used for matching, order, payment, invitation, activation, renewal, cancellation and withdrawal status, the link to a verified account, and identifiers or timestamps needed for reconciliation;
• for invoicing and accounting: billing identity and address, tax identifier where provided and, for businesses in other member states, the result of the VIES check of the VAT number (date, member state, result, name, address and consultation number), B2C/B2B type, plan, period, currency, taxes, Stripe references, original invoices and corrective documents, payment evidence, fees, payouts and reconciliation data, including dated exchange rates where needed; packages prepared locally in Control Center and the manual handoff history for Keez are accessible only to authorised personnel; clinical content is not intentionally included in this flow;
• dictated text, transcriptions, templates, editable reports, impressions, revision instructions, style documents and voluntarily supplied feedback;
• temporary audio needed for transcription and anonymised images explicitly submitted for OCR;
• operation count and duration, estimated cost, technical errors and security logs, without intentionally including the body of clinical content in operational telemetry;
• support communications and evidence of legal-document acceptance.

For recipients who did not provide their address directly to IMORAY, the source of the address is the team-order payer. The payer must provide only addresses needed for the order and have a basis for providing them. SYNRADX directly informs the recipient in the invitation email about the source of the address, the invitation purpose and this Privacy Notice. If invitation delivery is not enabled, the address is not used for an external email.

We do not need a patient's name, national identification number, contact details or case number. The customer must anonymise content before submission.

Purposes and legal bases

We process data for:

• account creation, service delivery and support — performance of the contract;
• authentication, abuse prevention, integrity, error diagnosis and defence of rights — legitimate interests and, where applicable, legal obligations;
• billing, accounting and responses to authorities — contract and legal obligations;
• preparing and performing a personal subscription or team order, preserving the seat for the named recipient and matching activation only to the same verified address — performance of the contract with the payer and the legitimate interest in preventing incorrect or duplicate activation, reconciling payment and renewal and resolving corrections, support or disputes;
• optional preferences or communications — consent where this is the appropriate basis;
• functional improvement from separate and voluntary feedback — legitimate interests or contract, without reusing clinical content for general model training.

For health data entered by the customer, the customer must identify the applicable GDPR Article 6 basis and Article 9 condition, inform data subjects and comply with professional secrecy.

Required and optional data

At least the email, credentials or authentication method, legal confirmations and technical data strictly needed for the session are required to create and secure an account. For a paid subscription, the plan, the capacity in which the buyer is actually acting (consumer or professional/business customer), currency and billing, payment and tax details required for the transaction are mandatory; for a team order, seat count and recipient addresses are required, while authority to contract is mandatory only when the payer acts for a company or organisation. Without these data, we cannot create or secure the account, conclude or perform the subscription, allocate seats, issue tax documents or meet legal duties.

Display name, organisation for a personal buyer, preferences, passkey, Personal Style, feedback, marketing communications and saved content not required for the requested feature are optional. Refusal does not prevent basic functions, but the corresponding optional feature cannot be supplied. Required fields and the consequence of refusal must be marked before collection.

AI assistance

The minimum content needed for the chosen feature is sent server-side to the configured Google Gemini services. Provider credentials do not reach the browser. For paid Gemini services, Google states that prompts and responses are not used to improve its products; limited security and abuse-prevention retention may apply under the relevant plan and terms. Google Search Grounding entails provider retention of the prompt, context and result for 30 days. The application does not retain Pathology Summary results in the workspace or history.

IMORAY does not use clinical content for advertising, commercial profiling or training its own general-purpose model.

Browser storage

The browser may retain preferences, a workspace recovery snapshot, personal templates and reports explicitly saved by the user. On sign-in, radiology-demo-session stores in localStorage the name, email, optional organisation, pseudonymous user identifier, device identifier and session timestamps, with a 14-day expiry; radiology-demo-device separately retains the browser UUID until cleanup. These keys are not the authenticated-session cookie and contain no password, authentication token or clinical content, but people or extensions with access to the same browser profile may read them. The imoray_passkey_challenge cookie binds the browser to a passkey ceremony for at most 5 minutes; it is HttpOnly, single-use and contains no private key. sessionStorage may temporarily hold technical identifiers and the amount/currency needed for the Checkout return, without email, card data or clinical content, as well as release-notice acknowledgement for the tab session. Audio retained for offline recovery is stored in IndexedDB on the device, with a maximum of three files and 50 MiB per user and a 24-hour expiry. Purposes and security details are in the Cookies and Local Storage Notice.

Recipients

Data may be accessed, to the extent necessary, by providers described in the Subprocessor List, authorised personnel and advisers under confidentiality. For a paid subscription, Stripe processes payment and the data needed to issue the SYNRADX invoice. The VAT number of a business in another member state is sent for checking to the European Commission's VIES system, which consults the database of the issuing member state. For orders through Link (“Sold through Link, LLC”, Stripe's reseller service), Link processes the buyer's payment and billing data as a controller, as the seller (merchant of record). Original documents and reconciliation data needed for accounting are prepared in Control Center and manually uploaded to Keez by authorised personnel; the application does not send them automatically to Keez. Clinical content is not sent for this purpose. We may disclose data to authorities only where required by law or necessary to protect our rights.

In the team flow, the recipient-address list remains in the application and is not included in Stripe metadata. The payer may see only the total number of seats, aggregate number activated and order status, not a recipient's content, usage counters or individual activity.

International transfers

We principally use European infrastructure. Some global providers may process data outside the EEA. In such cases we use the mechanism available under the applicable contract, including adequacy decisions, Standard Contractual Clauses and supplementary measures as appropriate. You may ask privacy@imoray.app for information about the applicable mechanism and a copy or intelligible summary of the safeguards, subject to protecting confidential information.

Retention

• account sessions ordinarily last 30 days and may be revoked earlier;
• the passkey challenge and associated browser token expire after at most 5 minutes and are single-use;
• the local radiology-demo-session copy expires after 14 days; the separate radiology-demo-device identifier remains until account or browser-data cleanup;
• password-reset tokens expire in 60 minutes and email-verification tokens in 24 hours;
• audio submitted for transcription is processed for the current request and is not retained by the application as a clinical recording; local offline copies expire in 24 hours;
• the active snapshot remains until overwritten, Reset, disallowed-input detection, logout or account cleanup;
• saved reports are pruned by default after 90 days and capped at 100 items unless an organisation lawfully configures another policy;
• team orders before payment, failed or abandoned, and their email addresses are retained only as needed to complete, reconcile and secure the order, resolve support or disputes and meet legal duties, then erased or anonymised when no longer needed; this rule does not state that a fixed-duration automated deletion currently exists;
• for a team subscription, the beneficiary address and seat link are retained as needed for invitation, activation, the paid period, renewal, cancellation, corrections, refunds and disputes, then minimised, erased or anonymised except for tax, accounting, anti-fraud or legal-claim records retained for the period permitted by law;
• account data is kept for the contract and deletion-recovery period, while tax and legal records are kept for the legally required period;
• backups and logs rotate under security and continuity schedules, and data subject to a dispute or obligation may be retained until it is closed.

Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction, portability or objection and may withdraw consent without affecting prior processing. You may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing.

Send requests to privacy@imoray.app. We will verify identity in proportion to risk and ordinarily respond within one month. Where we act as processor, we will route or support the request through the controller customer.

Security and incidents

We apply proportionate technical and organisational controls described in the Security Overview. No online service can guarantee absolute security. Report concerns to security@imoray.app without patient data in the email.

Changes

We may update this notice when the service, providers or law changes. For material changes, we will display an in-service notice or use account contact details before effectiveness where required.