Privacy, security and retention

Medical information is sensitive, so the product is designed around keeping as little of it as possible for as short a time as possible.

How your documents are handled

• • Documents are handled with data minimization from the first upload — we keep what the analysis needs and nothing else.
• • Sensitive information is encrypted in transit and at rest, and documents are never placed in public storage.
• • Access is controlled and document links are short-lived and signed, never guessable public URLs.
• • Sensitive medical detail is kept out of application logs, URLs and analytics.
• • Identifying information is separated from analytical data wherever technically practical.
• • Session replay and invasive tracking are not used on document or report screens.

Retention windows

Anonymous free scan

Original documents are deleted shortly after processing, apart from a short quality window.

Paid anonymous X-Raye

Documents are retained securely through the 30-day follow-up period, then deleted unless you have chosen to save the episode.

Account holder

You explicitly choose whether to save an Episode of Care, and you can delete it at any time.

Your episodes on this device

Nothing is stored on this device right now.

X-Raye does not claim HIPAA compliance. The application is architected with healthcare-grade safeguards and is designed to support future independent security and privacy review.