Privacy policy

This policy describes how IMAFRIK processes personal data. It distinguishes three situations, each governed by different rules: the professionals who use the service, the patients whose examinations are transmitted, and the people who contact us through this website.

1. Data relating to professional users

For this data, SOLVIAN AI LLC is the controller.

Data processed

• Identity: name, title, professional council registration number
• Contact details: email address, work telephone number
• Account data: encrypted password, organisation, role
• Usage data: log of sign-ins and of access to examinations
• Second authentication factor: mandatory for radiologists and the IMAFRIK team, optional for facilities

Purposes and legal basis

• Providing the service and managing access: performance of the contract
• Ensuring the traceability of access to health data: legal obligation and legitimate interest in security
• Invoicing and paying for examinations read: performance of the contract

Retention period

• Login account (email address, access): for the duration of the contractual relationship, then five years for evidential purposes, after which it is deleted. The identity of signatories and of those who accessed data remains attached to signed reports and to the audit log for as long as these are kept.
• Log of access to examinations: for as long as the examinations to which they relate, as they constitute the audit trail of those examinations.
• Technical logs: a few weeks, with automatic rotation; thirty days for monitoring checks.

2. Patients’ health data

For this data, the healthcare facility is the controller and IMAFRIK acts as a processor, on documented instructions, under the data processing agreement annexed to the contract.

• Data processed: examination images and DICOM metadata, patient identity, clinical information provided, reports produced
• Sole purpose: enabling remote interpretation and producing the requested report
• No other use: no model training, no identifiable statistical reuse, and no disclosure to any third party not provided for in the contract
• Retention: images: the period set by the facility in the contract, after which they are removed from our servers; without a set period, nothing is deleted automatically. Signed reports: twenty years, in locked storage where no one can alter or delete them. Encrypted backups: no more than twelve months after they are made.
• Return of data: on request, the facility receives an export of its examinations, comprising DICOM images, signed PDF reports and a manifest of checksums

3. Enquiries received through the website

For the contact details submitted through the contact form, SOLVIAN AI LLC is the controller. They are used solely to respond to the enquiry and to present the service (legitimate interest), are not shared with anyone, and are kept for three years after the last contact, then deleted automatically.

Recipients

Examinations are accessible only to members of the facility that sent them and to radiologists bound to that facility by a current service contract. Isolation is enforced by the database on every request.

Sub-processors

Sub-processors are contractually bound by security and confidentiality obligations equivalent to our own. Facilities are notified of any change before it takes effect.

• Hetzner Online GmbH: platform servers: application service, central PACS. Location: Germany.
• Cloudflare, Inc.: encrypted storage of images, reports and backups (R2). Location: European Union (EU storage jurisdiction).
• Supabase, Inc.: application database and authentication. Location: European Union.
• Vercel Inc.: web interface hosting. Location: Paris, France (compute region).
• Functional Software, Inc. (Sentry): technical error reports, with health data removed before transmission. Location: European Union (Germany).
• Tailscale Inc.: coordination of the private network between the gateways and the platform: technical addresses of the devices only, never any examination content. Traffic is encrypted end to end. Location: Possibly outside the European Union, under standard contractual clauses.

Transfers outside the European Union

Images, reports, the database and backups are hosted in the European Union; the location of storage and of error reports is checked at every deployment. The only processing that may take place outside the Union is the coordination of the private network (Tailscale): it concerns the technical addresses of the gateways, never the content of examinations, which travels encrypted end to end. This processing is governed by the European Commission’s standard contractual clauses.

Security

Encryption in transit and at rest, isolation between organisations enforced in the database, named accounts with two-factor authentication, automatic termination of inactive sessions, logs that cannot be altered from the application, and encrypted backups with a test restore every week. The measures are described in detail on the Security page and, in contractual form, in the data processing agreement.

Your rights

Professional users have the rights of access, rectification, erasure, restriction and objection in respect of their own data, which they may exercise by writing to donnees@imafrik.tech. Erasure deletes the login account immediately (email address, password, two-factor authentication); the name, title and registration number of a person who signed a report or accessed an examination remain attached to that report and to the audit log, of which they form part, for as long as these are kept. Patients exercise their rights with the facility that performed the examination, as it is the controller. IMAFRIK assists the facility within the time limits set out in the contract.

Complaints

Anyone may lodge a complaint with the competent data protection authority: in Togo, the Personal Data Protection Authority (Instance de protection des données à caractère personnel, IPDCP); in France, the Commission nationale de l’informatique et des libertés (CNIL, cnil.fr); elsewhere, the authority of the data subject’s country of residence.