Privacy Policy

1. General Information

This Privacy Policy outlines how your personal data is handled when you use the dcmage website (dcmage.com) and applications.

The controller of your personal data is Michal Sadurski, contactable via email at [email protected].

2. On-Device Processing and De-identification

dcmage is built as a local-first application. All core features (including DICOM tag editing, de-identification, DICOM PS3.15 profile application, facial defacing, and 3D MPR rendering) run 100% on-device within your browser sandbox or local Tauri desktop installation.

Ordinary use transmits nothing: opening, editing, de-identifying, viewing, and exporting a study involve no network transmission at all. The single exception is the support channel described in section 3 — a report you write and submit yourself, together with anything you deliberately attach to it.

dcmage can apply the de-identification profiles defined in DICOM PS3.15, which are commonly used to meet the HIPAA Safe Harbor standard. Applying a profile is a tool, not a certification: you remain responsible for verifying that a data set is adequately de-identified before you share it. dcmage makes no claim of HIPAA compliance, is not offered as a Business Associate, and does not assert conformity with the HIPAA Security Rule.

3. Data Collection and Purposes

We do not collect personal tracking cookies or run invasive third-party analytics. Browsing the website and contacting us involve only:

• Contact requests: If you send us an email at [email protected], we process your email address and any content provided to answer your inquiry based on our legitimate interest (Art. 6(1)(f) GDPR).
• Server logs: When browsing our website, our hosting provider may collect standard server request logs (IP address, user agent). This is necessary for infrastructure security and maintenance (Art. 6(1)(f) GDPR).

3.1 In-app bug reports and feature requests

The app contains a feedback form. It transmits data only when you fill it in and submit it, and only what is listed here. Nothing is sent in the background, and the form is the only feature in the app that contacts a server.

• The report itself: the title, description, steps, and expected/actual behaviour you write, plus the area of the app the report concerns.
• Your email address: optional, and processed only so we can reply to you.
• Files you attach: optional — screenshots, logs, and text. The desktop app cannot attach a DICOM file at all; it is refused whatever you do. In the web version a DICOM can be attached, but only after it clears a PHI scan and you confirm an explicit override, so a study sent that way may still contain health data. Please do not send us patient data — de-identify it in dcmage first, or describe the tag structure instead.
• Diagnostic context: optional and switched off by default, so it is sent only if you turn it on. It holds the app version and commit, your platform and user agent, the active tool, viewport and unsaved-edit counts, and recent audit entries with PHI removed.

The legal basis is our legitimate interest in diagnosing and fixing reported problems (Art. 6(1)(f) GDPR), and, for anything you choose to attach or include beyond the report itself, your consent (Art. 6(1)(a) GDPR) given by attaching the file or switching the context block on.

Reports are received by a Cloudflare Workers endpoint (feedback.dcmage.com) and attachments are stored in Cloudflare R2 in the European Union. Cloudflare, Inc. acts as our processor for this purpose. Reports are not used for advertising, profiling, or analytics, and are not shared with anyone else.

4. Your Rights under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure / "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych - UODO, ul. Stawki 2, 00-193 Warszawa).

5. Cookies and Local Storage

This website does not write non-essential tracking cookies or analytical storage keys to your browser. You can configure your browser to reject all cookies if desired.

6. Security

The measures below are properties of how the app is built, and each is covered by automated tests that run on every change.

• Outbound requests are restricted to an allow-list. The desktop app declares the hosts it may contact at the platform capability layer, outside the reach of page code. A build that points the app at a host outside that list is refused at runtime, and a test asserts exactly that.
• No accounts and no third-party SDKs. dcmage has no sign-in and no persistent user identifier, so nothing it sends can be tied to an identity. No advertising, analytics, or crash-reporting SDK is bundled.
• Encrypted local vault. Where dcmage stores data at rest on your behalf, keys are derived with PBKDF2 and content is encrypted with AES-GCM through the platform's own cryptography, not a hand-rolled implementation.
• Tamper-evident exports. An export can be accompanied by a signed manifest (ECDSA P-256 over a SHA-256 digest of the exported file and a snapshot of the audit chain, in the standard JWS format). It can be verified with off-the-shelf tooling, without dcmage.
• Sandboxed distribution. The Mac App Store build runs under the macOS App Sandbox and reaches only the files you open or save through the system file picker.

No software is free of defects. dcmage is pre-release research software provided without warranty; see the Terms. To report a security issue, email [email protected] — please do not include patient data.