Privacy Policy

1. Data Controller

CoreVita (hereinafter “CoreVita,” “we,” “us”) is the data controller for the processing of personal data in connection with the operation of the CoreVita platform. Contact: zriguiadam@gmail.com

2. Types of Data We Process

We process the following categories of personal data:

• Account data: name, email address, profile picture, professional role
• Usage data: login activity, studies uploaded, features used
• Billing data: payment method details (processed via Stripe, we do not store full payment credentials)
• Medical data: DICOM images and metadata you upload (processed on your behalf as a data processor)

3. Legal Basis for Processing (GDPR Art. 6)

• Account management: performance of a contract (Art. 6(1)(b))
• Medical data processing: our legitimate interest in providing the service, and your responsibility as a healthcare provider (Art. 6(1)(f), Art. 9(2)(h))
• Billing: performance of a contract and legal obligation (Art. 6(1)(b), Art. 6(1)(c))
• Analytics & improvement: legitimate interest (Art. 6(1)(f))
• Consent-based processing: where you have given explicit consent (Art. 6(1)(a))

4. Data Processing for Medical Images

When you upload DICOM images, we act as a data processor on your behalf. You remain the data controller for the patient data contained in those images. We process this data solely to provide the service: storage, viewing, and sharing via secure links. We do not use medical images for any other purpose, including training AI models, without your explicit, separate consent.

5. Data Sharing

We share your data only with:

• Stripe (payment processing — see their privacy policy at stripe.com/privacy)
• Backblaze (cloud storage of DICOM files — SOC 2 certified)
• Firebase / Google Cloud (authentication and hosting — GDPR-compliant DPA in place)
• Authorized recipients you designate when you share studies via secure links

We do not sell your personal data to third parties.

6. Data Retention

Account data is retained for the duration of your account. Medical images are retained as described in Section 7 of our Terms of Service (active subscription duration plus 30-day grace period). Billing records are retained for the duration required by applicable law.

7. Your Rights (GDPR)

You have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of your data
• Right to rectification (Art. 16) — correct inaccurate data
• Right to erasure (Art. 17) — request deletion of your data
• Right to restrict processing (Art. 18)
• Right to data portability (Art. 20) — receive your data in a machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interest
• Right to withdraw consent where processing is based on consent

To exercise any of these rights, contact us at zriguiadam@gmail.com. We will respond within 30 days.

8. Data Security

We implement appropriate technical and organizational measures, including encryption in transit (TLS 1.3) and at rest (AES-256), access controls, regular security audits, and staff training on data protection.

9. International Data Transfers

Data may be processed on servers within the European Economic Area (EEA) and in the United States. For transfers to the US, we rely on the EU-US Data Privacy Framework and Standard Contractual Clauses as appropriate.

10. Complaints

If you believe we have violated your data protection rights, you have the right to lodge a complaint with your local data protection supervisory authority.

11. Changes to This Policy

We will notify you of material changes via email or through the Platform. The date of the latest revision is shown at the top of this page.

12. Contact

For privacy-related inquiries: zriguiadam@gmail.com