ICD Diagnostica – Privacy Policy

This Privacy Notice for ICD Diagnostica ("we", "us", or "our") describes how and why we may access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://icd-diagnostica.com or any subdomain that links to this Privacy Notice;
• Register for, sign in to, or use the ICD Diagnostica diagnostic-support web application;
• Subscribe to a paid plan (Clinical Plan) and complete payment via our payment processor;
• Communicate with us by e-mail (e.g. [email protected] or [email protected]) or other support channels.

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed in our capacity as Data Controller for our own operational data, and as Data Processor for Patient Data (see Section 13 of our Terms and Conditions). The relationship is not a joint-controllership within the meaning of Article 26 GDPR; the operational parameters set by the Operator (default retention windows, soft-delete grace periods, backup roll-off cycles, security architecture, sub-processor selection) are means of processing rather than purposes – see Section 13.6 of the Terms and Conditions for the full reasoning. If you do not agree with our policies and practices, please do not use the Services. If you still have any questions or concerns, please contact us at [email protected].

TABLE OF CONTENTS

1. What information do we collect?
2. How do we process your information?
3. What lawful basis do we rely on?
4. When and with whom do we share your personal information?
5. Do we use cookies and other tracking technologies?
6. Do we offer artificial-intelligence-based products?
7. How do we handle your social logins?
8. Is your information transferred internationally?
9. How long do we keep your information?
10. How do we keep your information safe?
11. Do we collect information from minors?
12. What are your privacy rights?
13. Controls for Do-Not-Track features and Global Privacy Control
14. Do US residents have specific privacy rights?
15. Do we make updates to this notice?
16. How can you contact us?
17. How can you review, update, or delete the data we collect from you?

1.What information do we collect?

Personal information you disclose to us

The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we may collect includes:

• Account credentials: e-mail address, password (stored only as a salted hash by Firebase Authentication; we never see or store the plain password).
• Profile attributes: display name (nickname), full name (optional), professional specialty / role (optional), avatar image or initials.
• Preferences: interface language (PL / EN), timezone, dark-mode preference, ICD-11 filter set, notification preferences, two-factor-authentication setting.
• Authentication metadata: last sign-in timestamp, sign-in IP address (for security), user-agent, login-event log.
• Patient Data (special-category – clinician-Controller scope): when you, as a healthcare professional, choose to enter information about third-party patients (symptoms, ICD codes selected, free-text notes, demographic age / sex if provided, pseudonymised identifiers, clinical-event timeline), we process that data only as Data Processor on your behalf (see Section 13 of the Terms and Conditions). We do not use Patient Data for any purpose other than providing the Service to you.
• Communications: the contents of any e-mail or support message you send to us, including any attachments (e.g. bug-report screenshots).
• Consent records: proof of GDPR consent (timestamp, IP, version of the policy accepted) for documentation purposes.

Sensitive information

When processing as Data Processor on the User's instructions, the Service may handle the following categories of sensitive information under Article 9(1) GDPR:

• Health data – patient symptoms, mental-health complaints, prior diagnoses, clinical observations, free-text notes about a third-party patient.
• Patient Data as defined in Section 1 of the Terms and Conditions.

We do not intentionally process: genetic data, biometric data (for identification), data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or data concerning sexual orientation or sex life – except to the extent that a clinician chooses to record such information about a patient as part of clinical free-text notes, in which case the User remains Controller and is solely responsible for the lawful basis under Article 9(2) GDPR.

Payment data

If you choose to subscribe to a paid plan, you provide payment information (card number, expiry date, CVC, billing address, billing e-mail) directly to Stripe, our payment processor. ICD Diagnostica never sees, transmits, or stores full payment-card numbers or CVC values. We retain only:

• A Stripe Customer ID (an opaque string such as cus_XXXXXXXX) linking your account to a Stripe customer record;
• Subscription metadata: plan, status, billing interval, current period end, cancellation status;
• Last 4 digits of the active card and card brand (for display in "manage payment method");
• Invoice references (URL pointers to the hosted Stripe invoice).

Stripe's privacy notice is available at stripe.com/privacy.

Social-media login data

You may register and sign in using your existing Google account. If you choose to do so, we receive from Google only the information you authorize via the OAuth scope: name, e-mail address, Google account ID, and profile photo URL. We do not request, receive, or store contacts, calendar, drive contents, or any other Google-account data.

The Service does not support sign-in via Facebook, X (Twitter), LinkedIn, Apple, GitHub, or any other identity provider at this time. If we add an additional provider in the future, this Privacy Notice will be updated.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

We automatically collect certain information when you visit, use, or navigate the Services. This information does not directly reveal your identity but, when combined with other data, may. It includes:

• Log and usage data: IP address, request timestamp, HTTP method and path, response status, user-agent (browser, OS), referrer URL, error-event metadata, request latency, Cloud Function execution traces.
• Device data: screen resolution category (small/medium/large), browser locale, accepted languages, time-zone offset.
• Location data – coarse only: country and (where helpful) region inferred from IP. We do not collect GPS / precise device location. We do not use HTML5 Geolocation API.
• Application telemetry: features used (which sections of the Service the User opens), but stored at an aggregate, non-identifying level. Patient Data is excluded from any analytics.

Information collected via cookies and similar technologies is described in our separate Cookie Policy.

Google API services

Our use of information received from Google APIs (limited to the Sign-in with Google flow and Firebase Authentication) adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for serving ads, training generalized AI/ML models, or any purpose unrelated to providing the Service.

2.How do we process your information?

We process your personal information for the following purposes, depending on how you interact with the Services:

• Account creation and authentication. To allow you to register, sign in, recover access, and manage your account.
• Service delivery. To provide the diagnostic-support functionality, the Clinical-plan AI-Assist verification (Section 6), patient-record management, and exports.
• User support. To respond to your inquiries and resolve issues you encounter.
• Service-related communications. To send transactional e-mails: e-mail verification, password reset, two-factor codes, payment receipts, subscription cancellation confirmations, scheduled-deletion warnings, security notifications. We do not send marketing or promotional e-mails. If we ever introduce them, they will be opt-in only and unsubscribable at any time.
• Order fulfillment. To process and manage paid Subscriptions, refunds, and proration via Stripe.
• Service improvement. To analyze aggregate, non-identifying usage patterns (which features are used, where errors occur) so that we can improve the Service. Patient Data is excluded from improvement analytics.
• Security and abuse prevention. To detect and prevent fraud, brute-force credential attacks, scraping, automated abuse, and unauthorized access.
• Legal compliance. To comply with applicable law, regulatory obligations, court orders, and lawful government requests.
• Legitimate interests – security and audit. To preserve audit logs documenting security incidents, attempted intrusions, and abuse – under Article 6(1)(f) GDPR (legitimate interest in the integrity and security of the Service) and, where applicable, under Article 6(1)(c) GDPR (compliance with security-incident-reporting obligations).

We do not process your information to:

• sell, rent, or license your personal data to any third party;
• build or sell advertising profiles;
• train any third-party large-language model (no OpenAI / Anthropic / Google / Microsoft / Meta LLM is invoked – see Section 6);
• perform automated decision-making with legal or similarly significant effects on you within the meaning of Article 22 GDPR.

3.What lawful basis do we rely on to process your information?

If you are located in the EU or EEA, this section applies to you

The General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Polish Personal Data Protection Act (Ustawa o ochronie danych osobowych) require us to identify the lawful basis on which we process your personal information. We rely on the following bases:

• Consent (Article 6(1)(a) GDPR). Where we ask for your specific consent – for example, to enable optional preferences, to receive any future opt-in newsletter, or to allow processing of a special category of data outside the clinician-instructions scope – we process your data on the basis of your freely given, specific, informed, and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.
• Performance of a contract (Article 6(1)(b) GDPR). We process your account information, billing references, and service-state data because it is necessary to provide the Service that you requested by accepting the Terms and Conditions.
• Compliance with a legal obligation (Article 6(1)(c) GDPR). We process information where necessary to comply with applicable law – for example, retention of accounting records, response to lawful court orders or supervisory-authority requests, anti-fraud / anti-money-laundering checks performed by Stripe, breach-notification under Articles 33–34 GDPR.
• Legitimate interests (Article 6(1)(f) GDPR). We rely on legitimate interests for: (a) securing the Service against abuse, fraud, scraping, and unauthorized access (reCAPTCHA, App Check, rate-limiting, audit logging); (b) running and maintaining the Service infrastructure (logs, performance traces, error reports); (c) operating non-personalized internal analytics that help us improve the Service; (d) defending and pursuing legal claims; (e) preserving audit logs documenting security incidents and attempted intrusions. In each case we balance our interest against your rights and freedoms (Article 6(1)(f) balancing test) and use the least intrusive means. A copy of the relevant Legitimate Interest Assessment (LIA) is available on request to [email protected].
• Vital interests (Article 6(1)(d) GDPR). Reserved for the rare cases in which processing is genuinely necessary to protect a person's life or physical integrity. This basis is not used by the Operator for ordinary security or audit-log preservation – those purposes rely on Article 6(1)(f) above.
• Article 9(2)(h) GDPR – special-category data (provision of healthcare or treatment). Where Patient Data (special-category data under Article 9(1)) is involved, the processing is grounded in the User-Controller's lawful basis under Article 9(2)(h) GDPR – necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health care or treatment – relied upon by the licensed clinician under their own professional regulations. The Article 9(2)(h) basis is read together with Article 9(3) GDPR, which requires that such processing be carried out by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law. All Users of the Services must be licensed mental-health professionals subject, in Poland, to the medical-confidentiality duty under Article 40 of the Ustawa z dnia 5 grudnia 1996 r. o zawodach lekarza i lekarza dentysty (or an equivalent professional-secrecy duty in another EEA Member State or in the United States as a HIPAA "covered entity"). The Operator processes such data solely as a Processor on the User's documented instructions under Article 28 GDPR pursuant to the Data Processing Agreement at /en/dpa.

Article 13(2)(e) – statutory or contractual nature. Provision of account data (e-mail, password, display name) is contractually required to use the Services; without it, we cannot create your account or provide the Service. Provision of optional fields (full name, professional specialty, avatar, timezone preference) is voluntary and has no consequence on access. Provision of payment data (handled by Stripe) is required only if you choose to subscribe to a paid plan.

You have the right to object to processing based on our legitimate interests at any time, by contacting [email protected]. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

If you are located in Canada, this section applies to you

We may process your information if you have given us specific permission (express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (implied consent), in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial equivalents. You may withdraw your consent at any time by contacting [email protected].

In some exceptional cases, we may be legally permitted under applicable Canadian law to process your information without your consent, including, for example:

• where the collection is clearly in your interests and consent cannot be obtained in a timely way;
• for investigations and fraud-detection purposes;
• for business transactions, provided certain conditions are met;
• where it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim;
• for identifying injured, ill, or deceased persons and communicating with next of kin;
• where there are reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse;
• where collection and use with consent would compromise the availability or accuracy of the information and the collection is reasonable for purposes related to investigating a breach of agreement or contravention of Canadian or provincial law;
• where disclosure is required to comply with a subpoena, warrant, court order, or rules of the court;
• where it was produced in the course of an individual's employment, business, or profession and the collection is consistent with the purposes for which the information was produced;
• where the collection is solely for journalistic, artistic, or literary purposes;
• where the information is publicly available and is specified by the regulations;
• or where we may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments.

If you are located outside the EU or Canada

For Users located in other jurisdictions, we apply the lawful-basis framework above by analogy and additionally rely on the equivalent provisions of local applicable law (e.g. for US Users, see Section 14).

4.When and with whom do we share your personal information?

We may share your personal information in the following situations:

• With our sub-processors who provide technical infrastructure required to deliver the Service. Each sub-processor is bound by a Data Processing Agreement (or equivalent terms) imposing GDPR-compatible obligations.
• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. In such an event, we will provide notice on the website and, where required, in-app, before personal data becomes subject to a different privacy notice.
• Legal obligations & protection of rights. We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental request, judicial proceeding, court order, or legal process; or to protect our rights, property, or safety, or that of our Users or others; or in connection with investigating fraud or other unlawful activity.
• With your consent. We may disclose your personal information for any other purpose with your specific consent.

Sub-processors used by ICD Diagnostica

The following sub-processors process personal data in connection with the Service:

Canonical sub-processor list. This Privacy Notice reproduces the sub-processor list to satisfy the disclosure obligations of Articles 13(1)(e) and 14(1)(e) GDPR. The definitive contractual list, which controls in case of any inconsistency, is published at Annex A of the Data Processing Agreement and updated under DPA Section 9 (30-day prior notice for additions or replacements).

Note on the WHO ICD-11 API. The Service consults the WHO ICD-11 reference API (Geneva, Switzerland) server-side for canonical ICD-11 entity look-ups. No User personal data, no Patient Data, and no User IP address is transmitted to WHO – only the ICD-11 code being queried. WHO is therefore not a sub-processor of personal data within the meaning of Article 28 GDPR, and is not listed in the table above. Switzerland benefits from a European Commission adequacy decision (Decision 2000/518/EC), so any incidental transmission would in any case satisfy Article 45 GDPR.

The Service does not use, and does not share data with: Google Analytics, Adobe Analytics, Plausible, Matomo, Mixpanel, Hotjar, FullStory, Sentry (not in use; this Policy will be updated and consent obtained where required if introduced), Meta/Facebook Pixel, LinkedIn Insight Tag, Google Ads, TikTok Pixel, Microsoft Clarity, Twitter Pixel, or any other advertising or behavioral-analytics provider.

5.Do we use cookies and other tracking technologies?

We use cookies and similar tracking technologies (such as localStorage, sessionStorage, IndexedDB, and a small number of third-party security/payment cookies set by Google reCAPTCHA Enterprise, Cloudflare bot-management, and Stripe on payment pages) to gather information when you interact with the Services. These technologies help us:

• maintain the security of the Services and your account (App Check, reCAPTCHA, anti-abuse rate-limiting, CSRF protection);
• keep you signed in across pages without re-entering credentials;
• process payments via Stripe;
• save your preferences (interface language, timezone, ICD-11 filter set, dark-mode);
• restore your in-progress diagnostic session for up to 1 hour after the last interaction;
• deliver static assets efficiently via Cloudflare's edge network.

We do not permit third parties or service providers to use online tracking technologies on the Services for analytics or advertising. The Services do not contain advertising, tracking pixels, web beacons, abandoned-cart reminders, or interest-based-advertising tags. To the extent any future tracking technology would be deemed a "sale" or "sharing" under applicable US state laws, you may opt out by submitting a request as described in Section 14.

No Google Analytics, no advertising pixels

ICD Diagnostica does not use Google Analytics, Google Display Network Impressions Reporting, Google Ads remarketing, Adobe Analytics, Plausible, Matomo, Mixpanel, Hotjar, FullStory, Meta/Facebook Pixel, LinkedIn Insight Tag, TikTok Pixel, Microsoft Bing UET, or any other web-analytics or advertising-measurement provider. Should we add an analytics provider in the future, we will update this Privacy Notice and the Cookie Policy and obtain consent where required.

Specific information about how we use cookies and how you can refuse certain cookies is set out in our Cookie Policy.

6.AI features

AI-Assist outputs are informational only and do not replace clinical judgment. AI-Assist is disclosed as an AI feature in line with Article 50(1) of the EU AI Act (Reg. (EU) 2024/1689). See Section 5 of the Terms and Conditions.

7.How do we handle your social logins?

The Services offer you the ability to register and sign in using your Google account via the standard OAuth 2.0 / OpenID Connect flow operated by Firebase Authentication. Where you choose to do so, we receive from Google only the profile attributes you authorize: name, e-mail address, Google account ID, and profile-photo URL. We do not request, receive, or store your Google contacts, calendar, drive contents, or any other Google-account data; we do not request expanded scopes beyond openid, profile, email.

We use the information we receive only for the purposes described in this Privacy Notice (account creation, authentication, contact). We do not control, and are not responsible for, other uses of your personal information by Google. We recommend that you review Google's privacy notice at policies.google.com/privacy and configure your Google account settings as appropriate.

The Services do not currently support sign-in with Facebook, X (Twitter), LinkedIn, Apple, GitHub, Microsoft, or any other identity provider. If we add an additional provider in the future, we will update this Privacy Notice in advance.

8.Is your information transferred internationally?

Our primary infrastructure (Firebase / Google Cloud) operates in the European Union (multi-region eur3 for Firestore; EU-based for Cloud Functions). Transactional e-mail (Hostinger SMTP) operates within the EU (Lithuania). The Cloudflare edge network has points-of-presence worldwide, with EU PoPs serving European Users; corporate processing by Cloudflare in the United States is governed by SCCs.

Stripe processes EEA card payments through its EU subsidiary (Stripe Payments Europe Ltd., Ireland); certain corporate functions (fraud-detection algorithms, treasury) are conducted by Stripe, Inc. in the United States under Standard Contractual Clauses approved by the European Commission.

Where personal data is transferred outside the European Economic Area (EEA) or Switzerland, the transfer is conducted under one of the following safeguards:

• European Commission adequacy decisions (where applicable to the destination country);
• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision (EU) 2021/914);
• Supplementary technical, contractual, and organizational measures, in line with the "Schrems II" guidance from the European Data Protection Board (EDPB).

If you are a resident in the EEA or Switzerland, please be aware that countries outside these jurisdictions may not necessarily have data-protection laws as comprehensive as those in your own. We will, however, take all necessary measures to protect your personal information in accordance with this Privacy Notice and applicable law. You may request, free of charge, a copy of the relevant SCCs or supplementary safeguards by writing to [email protected].

9.How long do we keep your information?

We will keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us to keep your personal information for longer than the period during which you have an account with us, except as set out below.

The following retention periods apply:

• Account profile (display name, e-mail, plan): retained for the lifetime of your account. On account deletion: 30-day grace period (recoverable), followed by permanent removal from active systems and subsequent purge from rotating backups in line with the Operator's documented retention policy.
• Patient records (User-Controller scope): retained until the User deletes them or terminates the account. Soft-delete archive is retained for a limited recovery window before being permanently purged via an automated job.
• Authentication logs (last sign-in time, IP, user-agent): retained for a limited period for security and incident-response purposes.
• Cloud Logging records (server-side request traces, error reports): retained under the platform's default log-retention policy; longer for security-relevant events.
• Billing and invoice records: retained for the period required by Polish accounting law (currently five (5) years from the end of the calendar year in which the transaction occurred – Article 74 of the Accounting Act of 1994).
• Consent records (proof of GDPR consent): retained for as long as the consent remains relied upon, plus the statutory limitation period for related claims.
• Backups: automated Firestore backups under a documented rotation policy – deleted personal data persists in backups only until the next overwrite cycle, after which it is purged. Backups are isolated from operational processing in line with EDPB Guidelines 5/2021.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it. Where this is not possible (for example, because the personal data has been stored in a backup archive), we will securely store your personal information and isolate it from any further processing until deletion is possible.

10.How do we keep your information safe?

We have implemented and maintain technical and organizational security measures designed to protect the confidentiality, integrity, and availability of personal information, including in particular:

Transport & cryptographic controls

• HTTPS-only with HSTS preload, TLS 1.3 where supported by the client;
• AES-GCM client-side encryption (PBKDF2 key derivation tied to user UID) for sensitive fields stored in localStorage;
• Passwords stored as salted hashes by Firebase Authentication – the Operator never sees plain-text passwords;
• Secrets (Stripe API key, SMTP credentials) stored in Google Secret Manager; access scoped to specific Cloud Functions.

Identity & access controls

• Firestore security rules with owner-safe validators preventing privilege escalation (admin / plan / billing / 2FA fields server-only);
• Identity Platform with email-enumeration protection and Account Defender;
• Optional two-factor authentication (2FA) via e-mail one-time codes;
• Custom-claim based admin authorization, mirrored to Firestore for UI;
• MFA gate on high-risk admin operations with time-limited re-verification.

Application security

• Firebase App Check + reCAPTCHA Enterprise (v3) on every callable Cloud Function and Firestore client request;
• Per-user rate limiting on rate-sensitive endpoints (account-deletion, e-mail verification, password reset, subscription cancellation);
• Strict Content Security Policy (CSP) with violation reporting to /api/csp-report;
• Storage rules restricting upload size and MIME type (image-only);
• Input validation and output escaping at server boundaries to prevent injection.

Operational controls

• Automated Firestore backups under a documented retention policy;
• Cloud Monitoring alerts on anomaly detection (function errors, request spikes, scraping signatures);
• Incident-response procedure with explicit breach-notification commitments under GDPR Articles 33 and 34: we will notify the Polish supervisory authority (UODO) without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal-data breach, in line with Article 33(1) GDPR (unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons); we will notify the affected data subject without undue delay where the breach is likely to result in a high risk under Article 34(1) GDPR; where the Operator processes Patient Data as Processor, the User-Controller is notified without undue delay under Article 33(2) GDPR;
• Stripe-handled payments – no card data stored on our platform;
• Cloudflare WAF and DDoS protection.

Records of processing & Data Protection Impact Assessment

Article 30 GDPR – Records of processing. The Operator maintains a record of processing activities under Article 30(1) GDPR. The record is made available to the Polish supervisory authority (UODO) on request under Article 30(4) GDPR. See also Section 12.8 of the Terms and Conditions.

Article 35 GDPR – Data Protection Impact Assessment (DPIA). The Operator has carried out a Data Protection Impact Assessment under Article 35 GDPR in respect of the large-scale processing of special-category Patient Data through the Service. The DPIA documents identified risks (re-identification, unauthorized access, breach in transit, mis-routing, AI-Assist output misinterpretation, sub-processor failure), mitigations (encryption, access control, App Check, reCAPTCHA, audit logging, sub-processor flow-down), residual risks, and the rationale for proceeding without prior consultation under Article 36 GDPR. A summary of the DPIA is available on request to enterprise Users and to the Polish supervisory authority (UODO) under the Operator's Article 35(9) cooperation duty. See also Section 12.7 of the Terms and Conditions and Annex B of the Data Processing Agreement.

However, despite these safeguards and our commercially reasonable efforts to secure your information, no electronic transmission over the Internet or information-storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. You should always access the Services within a secure environment.

11.Do we collect information from minors?

We do not knowingly collect, solicit data from, or market to children under 18 years of age (or the equivalent minimum age specified by law in your jurisdiction), nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 years old (or the equivalent age in your jurisdiction) and have the legal capacity to enter into a binding contract.

If we learn that personal information from Users under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware that any data has been collected from a child under 18, please contact us immediately at [email protected].

Patient Data and minors. Where a clinician records information about a pediatric patient (under 18), the clinician acts as Data Controller and is solely responsible for compliance with all applicable child-data-protection law (including Article 8 GDPR "child's consent in relation to information-society services" where relevant) and parental-consent requirements under their professional code.

12.What are your privacy rights?

In some regions (such as the EEA, Switzerland, and Canada), you have specific rights under applicable data-protection law. These include:

• Right of access (Article 15 GDPR) – to obtain confirmation of whether we are processing your personal data and a copy of that data;
• Right to rectification (Article 16 GDPR) – to have inaccurate or incomplete data corrected;
• Right to erasure ("right to be forgotten", Article 17 GDPR) – to have your personal data deleted, subject to certain legal-retention exceptions;
• Right to restriction of processing (Article 18 GDPR);
• Right to data portability (Article 20 GDPR) – to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller;
• Right to object (Article 21 GDPR) – including the right to object to processing based on legitimate interests;
• Right not to be subject to automated decision-making (Article 22 GDPR). We do not perform decision-making based solely on automated processing that produces legal or similarly significant effects on you. The differential ranking and AI-Assist output of the Service are decision-support outputs only – the licensed practitioner makes the final decision.
• Notification of recipients (Article 19 GDPR). Where you exercise your rights of rectification, erasure, or restriction (Articles 16, 17, 18 GDPR), we will communicate the change to each recipient (sub-processor) to whom we previously disclosed the personal data, unless this proves impossible or involves disproportionate effort. We will inform you of those recipients on request.

You may exercise these rights by contacting [email protected] or by using the in-app self-service tools (Account → Security → Delete account; Account → Settings → Export data). We will respond to your request within thirty (30) days.

Withdrawing your consent

If we are relying on your consent to process your personal information (express and/or implied, depending on applicable law), you have the right to withdraw your consent at any time by contacting [email protected]. Withdrawal will not affect the lawfulness of any processing carried out prior to withdrawal nor processing conducted on a different lawful basis (such as performance of contract or legitimate interest).

Opting out of marketing communications

ICD Diagnostica does not currently send marketing or promotional e-mails. If we begin sending such communications in the future, you will be able to unsubscribe at any time by clicking the unsubscribe link in any such e-mail or by contacting us. Note that we may continue to send you transactional, security, and service-related messages necessary for the administration of your account (e-mail verification, password reset, 2FA codes, billing receipts, security alerts) regardless of your marketing preferences.

Account information

If you would like to review, change, or terminate your account at any time, you can:

• Sign in to your account settings (Account → Profile, Account → Security) and update or delete your data directly through the in-app interface;
• Submit a Data Subject Access Request to [email protected].

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases according to the retention schedule in Section 9. We may retain limited information in our archives where required by law (tax, accounting, fraud-prevention, dispute-resolution).

Cookies and similar technologies

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject cookies. If you choose to remove or reject cookies, this may affect certain features or services of the Services. See the Cookie Policy for the full list and management options.

If you have questions or comments about your privacy rights, you may e-mail us at [email protected].

13.Controls for Do-Not-Track features and Global Privacy Control

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. Some browsers also support the Global Privacy Control ("GPC") signal.

At this stage, no uniform technology standard for recognising and implementing DNT or GPC signals has been finalised. Because ICD Diagnostica does not deploy advertising, marketing, cross-site tracking, or third-party analytics cookies, there is effectively no behavior to suppress when you set DNT or GPC on the Services – strictly necessary cookies (authentication, security, payment) remain in operation regardless because they are required for the Services to function.

If a uniform standard for online tracking is adopted that we are required to follow in the future, we will inform you about that practice in a revised version of this Privacy Notice. California law (CCPA / CPRA § 1798.135(b)(1)) requires us to honor the Global Privacy Control (GPC) signal as a valid opt-out of any sale or sharing of personal information for cross-context behavioral advertising. We honor GPC signals received from your browser as such an opt-out; however, because the Service does not sell or share personal information for cross-context behavioral advertising, no responsive action is required and the GPC signal is acknowledged as effective by configuration. The same applies to the older Do-Not-Track (DNT) header – we acknowledge it but, because we do not deploy the technologies that DNT was designed to suppress, no behavior changes.

14.Do US residents have specific privacy rights?

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. The categories are taken from the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), and used as a common reference framework across other US state laws.

We may also collect other personal information outside of these categories where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer-support channels;
• Participation in customer surveys (if any) – currently none;
• Facilitation in the delivery of the Services and to respond to your inquiries.

Sources of personal information

Sources of personal information are the same as those described in Section 1: directly from you (registration, profile, payments via Stripe), from Google (OAuth where you sign in with Google), from automated technical mechanisms (server logs, App Check, reCAPTCHA).

How we use and share personal information

How we use and share personal information is described in Section 2 and Section 4. We share personal information with sub-processors (Google, Stripe, Cloudflare, Hostinger) under written contracts; we do not sell or share personal information for cross-context behavioral advertising.

We may use your personal information for our own business purposes – such as for undertaking internal research and statistical analysis to improve the Services, security incident response, and the operation of the Services. This is not considered to be "selling" or "sharing" under California law.

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, or other consumers.

Your rights

You have rights under certain US state data-protection laws. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data;
• Right to access your personal data;
• Right to correct inaccuracies in your personal data;
• Right to request the deletion of your personal data;
• Right to obtain a copy of the personal data you previously shared with us;
• Right to non-discrimination for exercising your rights;
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling") – note that we do not engage in any of these activities, so this opt-out is informational only.

Depending upon the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (Minnesota);
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (California, Delaware, Maryland);
• Right to obtain a list of specific third parties to which we have disclosed personal data (Minnesota, Oregon);
• Right to obtain a list of third parties to which we have sold personal data (Connecticut) – N/A, we do not sell personal data;
• Right to review, understand, question, and (where permitted) correct how personal data has been profiled (Connecticut, Minnesota) – N/A, we do not profile;
• Right to limit use and disclosure of sensitive personal data (California);
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial-recognition feature (Florida) – N/A, we do not use voice or facial recognition.

How to exercise your rights

To exercise these rights, you can contact us by submitting a Data Subject Access Request, by e-mailing us at [email protected], or by referring to the contact details in Section 16 below.

Under certain US state data-protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof of valid authorization.

Request verification

Upon receiving your request, we will need to verify your identity to determine that you are the same person about whom we have information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request, and the agent will need to provide a written and signed authorization.

Appeals

Under certain US state data-protection laws, if we decline to take action regarding your request, you may appeal our decision by e-mailing us at [email protected]. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general.

15.Do we make updates to this notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this document. If we make material changes to this Privacy Notice, we may notify you by prominently posting a notice on the Service, by sending you an in-app notification, or by sending you an e-mail to the address associated with your account, in advance of the change taking effect (typically at least thirty (30) days). We encourage you to review this Privacy Notice periodically to be informed of how we are protecting your information.

Non-material amendments (clarifications, corrections, formatting, sub-processor list updates) take effect immediately upon publication.

16.How can you contact us about this notice?

Data Protection Officer (Inspektor Ochrony Danych)

The Operator has appointed a Data Protection Officer in line with Article 37(1)(c) GDPR (core activity consisting of large-scale processing of special-category data within the meaning of Article 9). You may contact the DPO directly at [email protected].

Correspondence

• General contact: [email protected]
• Data-protection / GDPR / DSAR / DPA requests: [email protected] (subject line "DSAR" for fastest handling)
• Data Protection Officer: [email protected]
• Security disclosures: /.well-known/security.txt

Trademarks. "ICD Diagnostica" is a trade name used by the Operator; no registered trademark is currently asserted. ICD-11 is a designation of the World Health Organization, used under CC BY-ND 3.0 IGO.

17.How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country or state of residence in the US, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

To request to review, update, or delete your personal information:

1. In-app self-service. Sign in to your account and use Account → Profile (review/update) or Account → Security → Delete account (deletion, with 30-day grace).
2. Submit a Data Subject Access Request (DSAR). E-mail [email protected] with the subject "DSAR" and a description of the information you would like to access, correct, or delete. We will respond within thirty (30) days. We may extend this period by up to two further months where necessary, taking into account the complexity and number of requests, in line with Article 12(3) GDPR – and we will inform you of any such extension within the first month.
3. Authorized agent (US state laws). You may designate an agent to act on your behalf; we may require evidence of authorization.

We will not charge a fee for handling reasonable requests. We may charge a reasonable administrative fee, or refuse to act, where requests are manifestly unfounded, excessive, or repetitive (Article 12(5) GDPR).