Privasi

1. Scope and operator

This Policy describes how Celiums Solutions, LLC, the sole operator of OncoRadar, handles personal data for the website, accounts, workspaces, research chat, uploads, API and MCP interfaces. Contact privacy@oncoradar.org for privacy matters. A business mailing address and jurisdiction-specific representative details remain pending review.

2. Data we handle

We handle the minimum data reasonably needed to operate accounts, research conversations, uploads and developer access. Uploaded documents and images are handled as described in section 5.

• Account and identity: identity-provider subject, email, display name. Purpose: Authentication and account administration.
• Workspace and organization: memberships, projects, roles, cases. Purpose: Tenant isolation and collaboration.
• Conversations and research activity: chat messages (redacted for identifiers before storage), research runs and plans, retrieved records and cited study ids, pattern findings and verification notes, saved searches, collections, alerts. Purpose: Provide conversational research discovery, source-grounded synthesis and findings.
• Uploaded documents and images: PDF, DOCX and text documents, photographs and scanned pages, DICOM imaging series, de-identified derivatives (text, masked pages, frames, de-identified DICOM), de-identification reports and processing status. Purpose: Research analysis of user-supplied material after automated de-identification; source-grounded findings; the viewer.
• Dataset contributions: contribution record, consent document version and content hash, license, status (offered, accepted, withdrawn, purged), withdrawal time. Purpose: Evidence per-item opt-in to the OncoRadar research dataset and manage withdrawal.
• Developer access: API key prefix, scopes, last-used time, one-way secret hash. Purpose: API and MCP access control.
• Security and operations: session hash, request ID, IP prefix, user-agent hash, audit events (counts and statuses, never file names or content), quota usage. Purpose: Security, abuse prevention, reliability and enforceable quotas.
• Sign-in abuse prevention: source IP, encrypted browser/session security token, browser and automation characteristics, mouse, keypress and form interaction signals, challenge completion timestamps, aggregate firewall metrics. Purpose: Detect automated sign-in attempts, present security challenges and apply temporary rate limits.
• Legal records: document version, content hash, acceptance timestamp, request ID, dataset consent per item. Purpose: Prove the notice, terms and consent presented.
• Privacy requests: export or deletion request, status, completion timestamps. Purpose: Process and evidence privacy requests.

3. Sources and purposes

Data comes from you, organization administrators, your browser or API client, security logs, files you upload, and configured research sources. We use it to authenticate users, provide research chat, retrieval and synthesis, de-identify and analyze uploaded material, maintain workspaces, enforce quotas, secure and troubleshoot the service, answer requests, and maintain legal records. We do not use OncoRadar to sell personal data, deliver targeted advertising, or perform cross-site tracking.

• Upload patient-derived documents, images or imaging only through the upload flow, where they are encrypted and de-identified before any model or reviewer sees them. Text typed into the chat is redacted for identifiers before storage, but the chat is not a channel for patient records.
• Material intended for individual patient care is out of scope; findings are research patterns, not diagnoses.
• Published literature and research metadata are service datasets and are not treated as your personal account data merely because you searched them.

4. Sharing and processors

We disclose data to service providers only as needed for their configured functions, to an organization that controls a workspace, when you direct us, to protect rights and security, or when legally required. The entities acting as processors are named only in the Subprocessor Notice; their roles are described below. We do not attribute operation of OncoRadar to an infrastructure or model provider.

• Cloud infrastructure: Hosting, encrypted object storage, key management, managed identity and database services, logging and backups.
• Sign-in security: Global edge filtering, browser security signals, automatic challenges, CAPTCHA and temporary IP rate limits to prevent automated sign-in abuse.
• De-identification services: OCR, identifier detection and clinical entity coding applied to uploaded content before any model or reviewer sees it.
• Medical imaging store: Storage and metadata for de-identified DICOM imaging only.
• Research language model hosted in our cloud provider: Plans searches, reads de-identified text and images, and writes source-grounded answers.
• Calibrated decision model: Receives only de-identified text or literature, never images or original files.

5. Uploaded documents, images and AI processing

Files you upload are encrypted with a customer-managed key. The original file is readable only by an isolated processing role and is retained 30 days by default (or until you delete it), after which it is purged from active storage. Before any model or reviewer sees content, an automated de-identification pipeline removes or replaces identifiers: DICOM imaging is processed under the DICOM PS3.15 basic profile with date shifting and pseudonymous ids; documents and images go through OCR, identifier detection and rule-based redaction; burned-in text is masked. Only de-identified derivatives are used by models, shown in the viewer, or eligible for the research dataset. Items the pipeline cannot clear with confidence are held for review rather than treated as clean.

A research language model hosted in our cloud provider receives your redacted chat text, de-identified text and images from your uploads, retrieved literature passages and system instructions, and writes source-grounded answers. A calibrated decision model receives only de-identified text or literature, never images or original files. De-identification is automated and may be imperfect; do not use the chat or uploads to bypass it, and never submit credentials or third-party confidential information to prompts.

Contributing de-identified material to the OncoRadar research dataset happens only through an explicit, per-item opt-in recorded under the Dataset Contribution Terms; it is separate from acceptance of this Policy and can be withdrawn.

6. Retention, deletion and backups

Chat conversations and findings are kept until you delete them or your account is deleted. Uploaded originals are purged after 30 days by default (configurable) or earlier on deletion; de-identified derivatives remain until the attachment, conversation or account is deleted; dataset snapshots follow their license and the Dataset Contribution Terms.

A deletion request is recorded as pending, revokes active OncoRadar sessions and personal-workspace API credentials, and flags organization-workspace access for administrator and operator review; it does not erase active records or provider backups. No deletion is represented as complete until the operator has run and verified the required removal or de-identification process. Backup handling, organization records, legal holds and the completion timeline require documented operational and legal decisions.

• Session: Until expiry, logout, security revocation, or deletion request; expired rows may be pruned operationally.
• API credential: Until revoked/expired; only metadata and one-way hashes are stored.
• Chat conversations and findings: Until deleted by the user or processed through account deletion, subject to organization rights.
• Uploaded originals: 30 days by default (configurable by the operator) or until deleted by the owner, whichever is earlier; then purged from active storage.
• De-identified derivatives: Until the attachment, conversation or account is deleted; they are the only material used by models, shown in the viewer or eligible for the dataset.
• Dataset snapshots: According to the dataset license and the Dataset Contribution Terms; withdrawal removes future copies, while already distributed dataset versions may persist.
• Workspace content: Until deleted by an authorized user or processed through account deletion, subject to organization rights.
• Licensed literature index: According to source licenses and service needs; it is not treated as a user's personal export.
• Backups: Catalog and control-plane database backups rotate under operational schedules; deletion propagates on backup rotation rather than instantly.
• Audit, security and legal evidence: Limited to legitimate security/legal needs; final numeric periods remain pending review.

7. Your choices and requests

The localized privacy center provides an authenticated JSON export and a deletion-request workflow. You can delete individual uploads and conversations in the workspace, and withdraw a dataset contribution as described in the Dataset Contribution Terms. Depending on applicable law, you may also request access, correction, restriction or objection by contacting the privacy address. We may verify identity and authority, protect other users' data, and retain a minimal request or legal record where permitted.

8. International processing and security

Account, research and upload processing takes place in our cloud provider's US East (Northern Virginia) region in the United States, using services eligible for regulated health data under a Business Associate Agreement that the operator is putting in place with that provider. Website delivery and sign-in abuse prevention also use the provider's global edge network. That agreement is not a certification; OncoRadar does not claim HIPAA compliance certification and does not claim certifications not expressly listed. The calibrated decision model provider receives only de-identified text or literature; its region disclosure remains pending confirmation. Transfer-mechanism disclosures for users outside the United States remain pending legal confirmation. We use safeguards described in the Security Notice, but no system is risk-free.

9. Children and changes

OncoRadar is intended for professional and adult research use, not for children or collection of children's data. Contact us if such data may have been submitted. Policy updates will change the version or effective date, and material changes may be shown in-product.