Privacy
Privacy Policy
What this service is
RadProtocol, on the web at radprotocol.ca and as an iPhone app, is a clinical decision-support tool that helps authorized clinical staff match an MRI or CT clinical indication to an approved order code and an Ontario priority level. It is for decision support only; the ordering clinician remains responsible for the final order.
Information we process
- Account details. If you create an account, we keep your email address and a one-way scrambled (hashed) form of your password, used only to sign you in and to send a password-reset email when you ask for one.
- Clinical details you enter or dictate: age, sex, care setting, the clinical indication, and any contraindications. Do not enter names, health-card numbers, medical record numbers, dates of birth, phone numbers, or addresses. The service detects details like these and replaces them before processing.
- Dictation. When you dictate in the iPhone app, your speech is turned into text by iOS on your phone. The recording is not sent to us or to anyone else.
- An activity log of sign-ins, recommendations (including the redacted clinical text), and configuration changes, kept so the department can review how the tool was used.
- On the website, a session cookie required for sign-in and security. The app keeps its sign-in token on your phone. No advertising or analytics trackers are used anywhere.
Who processes it
- Google Cloud, in Montreal, Canada, runs the service and stores accounts and the activity log.
- OpenAI, in the United States, receives the redacted request and the approved order list in order to produce a recommendation. Under OpenAI's API terms this data is not used to train their models; OpenAI may keep it for up to 30 days to detect abuse.
- An email delivery provider sends password-reset emails that you request. It receives your email address and the reset link, and nothing else.
Retention and deleting your account
Your account is kept until you delete it. You can delete it at any time: in the app under Account, or on the website from your account page. Deleting it removes your email address and password immediately. Entries in the activity log that record past use are kept by the department as part of its audit record.
Contact
Questions about this policy or the service can be sent to joshossip10@gmail.com.