Privacy Policy

Effective date: 26 October 2026

OLRAD is a radiology workflow service for authorized medical professionals. This policy describes how the OLRAD service operator processes information when you use OLRAD at app.olrad.pro. For privacy questions or requests, contact contact@olrad.pro.

Information we process

• Account and security information: account identifiers, authentication information, permissions, session cookies, IP addresses, and sign-in and administrative audit records.
• Workflow information: findings, reports, templates, preferences, and referral images or text that you submit. If you use dictation, OCR, translation, or report generation, we process the audio, images, or text needed for that feature.
• Remote-workstation information: connection and session information and the remote desktop, clipboard, or selected screen regions needed for the features you use.
• Operational information: service events, errors, performance measurements, and usage records needed to operate and secure the service.

Google Gmail access

OLRAD connects to an operator-authorized Gmail mailbox to retrieve one-time authentication codes used to sign in to the MAR clinical system. This is not a requirement to connect every doctor's personal Gmail account.

With the mailbox owner's permission, OLRAD uses the gmail.modify scope. This permits reading and modifying messages; OLRAD uses it to find and read relevant authentication messages and move processed code messages to Gmail's Trash. It also checks the connected mailbox's email address and stores OAuth credentials needed to maintain the connection. OLRAD does not use this connection to send email.

Gmail data is used only to provide the MAR authentication feature. We do not sell it, use it for advertising, build advertising profiles from it, or use it to train AI or machine-learning models. Gmail message content and authentication codes are not sent to the dictation, OCR, or report-generation AI providers.

OLRAD's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Human access to Google user data is limited to circumstances permitted by that policy, such as your explicit consent, security investigations, or legal obligations.

Why we process information

We use information to authenticate authorized users, connect clinical workstations, provide the features you request, save workflow data and preferences, prevent abuse, troubleshoot failures, and meet legal obligations. Where applicable law requires a legal basis, processing is based on providing the requested service, legitimate interests in security and reliability, legal obligations, or consent where required.

Service providers and disclosures

Infrastructure, network, and feature providers process information as needed to deliver the service. These include Kamatera for hosting, Cloudflare for network delivery, Soniox for dictation, and OpenRouter and the selected model provider for AI features. Only the information needed for a requested feature is sent to that feature's providers. Processing may take place outside your country. Your organization is responsible for confirming that its use of these features, including any transfer of patient information, is authorized.

We do not sell personal information. We may disclose information when legally required, to protect the service or people from harm, or as directed by your organization. Google user data remains subject to the Limited Use restrictions above.

Retention and protection

We retain saved workflow data, account records, and security records for as long as needed to provide the service, support your organization's requirements, or comply with legal obligations. OAuth credentials are retained while the mailbox connection is needed. Authentication messages are processed to extract codes, not maintained as a separate email archive by OLRAD; the original messages remain subject to the mailbox owner's Gmail settings.

We use access controls, encrypted network connections, and restricted credential storage. No system is completely secure. Deletion from active systems may not immediately remove copies in backups; those copies remain protected until the backups are replaced or expire.

Your choices and requests

The mailbox owner can revoke OLRAD's Google access through Google Account connections. Revocation prevents future authorized access but does not itself delete information already retained. Contact contact@olrad.pro to request disconnection, deletion of stored OAuth credentials and related retained Google data, or access, correction, or deletion of personal information. We may verify your authority and retain records that law requires. For clinical records controlled by your employer or healthcare organization, contact that organization as well.

Cookies, children, and changes

OLRAD uses cookies needed for authentication and security. This service is intended for authorized professionals, not children. We may update this policy; the effective date above identifies the current version, and material changes will be communicated through the service or to your organization.