Privacy Policy

Effective: 8 December 2025 • Last updated: 12 July 2026

RadRelay provides a secure teleradiology workflow platform for clinics and licensed radiologists, including the electronic submission of imaging studies and the generation and delivery of radiology reports. This Privacy Policy explains how RadRelay collects, uses, stores, shares, and protects personal data in accordance with the applicable data protection and health‑information laws of your country, and other laws that apply where we operate.

1. Who We Are

Data Controller: RadRelay
Contact: admin@radrelay.org

For data protection matters, RadRelay’s Founder acts as the Acting Data Protection Supervisor (DPS).

2. The Personal Data We Collect

RadRelay collects and processes information necessary to operate the platform safely and to support clinical reporting workflows. This may include:

• Account and access data: email address, role (clinic, radiologist, admin), authentication/session data.
• Patient and study details: patient name, patient identifier, age/date of birth (where provided), modality, body part, clinical history.
• Medical imaging files: imaging uploads (e.g., JPEG/DICOM where supported) and related attachments submitted for reporting.
• Radiology report data: draft and final report content, timestamps, and report PDFs.
• Payment and transaction confirmations: payment references/status from our payment processors and related reconciliation metadata.
• Operational and security logs: records needed for audit, troubleshooting, access control, and security monitoring.

3. Special Personal Data (Health Data)

RadRelay processes health and medical information in the context of imaging studies and reporting. We treat this category of data with heightened confidentiality and security safeguards.

4. How We Use Personal Data

We use personal data to:

• create and manage user accounts and role-based access
• enable clinics to submit studies and attach imaging files
• enable radiologists to access assigned studies and produce reports
• generate and deliver final reports (including PDF reports)
• process and confirm payments and maintain financial records
• provide support, investigate issues, and maintain platform reliability
• protect the platform from fraud, unauthorized access, and abuse
• comply with legal/regulatory obligations under applicable law

5. How Data Is Shared

RadRelay limits data access to authorized persons and does not sell personal data. In normal operation, personal data is shared only as required for the clinical workflow:

• Within RadRelay: authorized admins for operational support and governance.
• Clinics: clinics access studies they create and the corresponding reports.
• Radiologists: RadRelay-approved radiologists access only studies assigned to them.
• Infrastructure providers: providers that host and operate the platform (see Section 6).

6. Third-Party Providers and Infrastructure

RadRelay uses third-party infrastructure services to operate securely. These providers may process or store data strictly to provide their services to RadRelay:

• Supabase: database, authentication, and storage services.
• Vercel: application hosting and delivery.
• Payment processors: Hubtel (Ghana) and Payaza (international) for payment processing and transaction confirmation, according to the country in which your clinic operates.

7. Cross-Border Processing

RadRelay uses cloud infrastructure. Depending on provider configurations and network routing, personal data may be processed or stored outside your country. RadRelay manages this risk through governance controls, access restrictions, and security safeguards appropriate for health data.

8. Security Safeguards

RadRelay applies technical and organisational safeguards proportionate to the sensitivity of health data, including:

• role-based access control (clinic, radiologist, admin separation)
• secure authentication and controlled administrative access
• encryption in transit (HTTPS) and platform security controls where supported
• incident detection, reporting, and response procedures

9. Data Retention

RadRelay retains personal data only for as long as reasonably necessary for the purposes of clinical reporting, platform operations, legal/regulatory obligations, and dispute resolution. When data is no longer required, RadRelay will delete or destroy it in a manner intended to prevent reconstruction, consistent with applicable law.

10. Your Rights

Subject to applicable law and identity verification, you may request:

• access to personal data we hold about you
• correction of inaccurate or incomplete data
• deletion/destruction where we no longer have lawful grounds to retain the data

To make a request, email admin@radrelay.org. We may ask for information to confirm identity and locate the relevant records.

11. Breach Notification

Where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorized person, RadRelay will take appropriate steps consistent with applicable law, including notifying the relevant authority and/or affected persons where required.

12. Changes to This Policy

We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes. Where appropriate, we will post the updated version on this page with a revised “Last updated” date.

13. Contact

Email: admin@radrelay.org