Comprehensive Privacy Notice

1. Personal data we collect

We may collect the following categories of personal data:

Identification and contact data

• Email address.
• Name, alias or identifier, if provided by the user.
• Technical access data, such as IP address, date and time of use, browser, operating system, session identifiers and activity logs.

Sensitive personal data

• Medical images, studies, DICOM, JPG, PNG or equivalent format files uploaded by the user to the platform.
• Metadata contained in medical or image files, where present.
• Results, findings, reports and data derived from the automated analysis, to the extent that they may reveal information about a person's present or future health status.

2. Purposes of processing

Personal data will be processed for the following primary purposes, which are necessary to provide the service:

• Registering and administering access to the live demo.
• Sending verification codes, operational notices or communications related to access to the service.
• Receiving, storing, converting, processing and analyzing the images or studies uploaded by the user.
• Generating, displaying and allowing the download of results or technical reports derived from the analysis.
• Tracking the user's analysis history within the platform.
• Preventing misuse, abuse of the service, fraud, security incidents and unauthorized access.
• Handling requests related to ARCO rights (access, rectification, cancellation, opposition), revocation of consent, questions or incidents.

Additionally, and only if the data subject expressly authorizes it through a separate mechanism, data may be processed for the following secondary purposes:

• Improving, evaluating, training or recalibrating artificial intelligence models.
• Generating statistics, metrics, internal reports or aggregated analyses.
• Publishing anonymized results, technical examples or demonstration material, provided they have previously undergone a sufficient dissociation or anonymization process.

If you do not wish your data to be used for secondary purposes, you may indicate so through the mechanism made available to you or by sending your request to contacto@cirusdev.com.

3. Consent for sensitive data

Since the images and data involved may reveal health information, their processing may involve sensitive personal data. Therefore, use of the live demo must be subject to an express declaration of consent given by electronic means, as well as acceptance of this privacy notice.

The user declares that:

• They are the owner of the uploaded data, or
• They hold sufficient authorization from the data owner, or
• They have previously anonymized or dissociated the information appropriately.

4. Transfers of personal data

Your personal data will not be sold or transferred to third parties for commercial purposes.

Data may only be shared, where necessary, with:

• Providers acting on behalf of the data controller for hosting, storage, email delivery, monitoring, technical support or processing strictly necessary to operate the platform;
• Competent authorities, where there is a legal requirement, ruling or duly founded mandate.

In all applicable cases, we will seek to ensure that such persons or entities process the data in accordance with the controller's instructions and under confidentiality and security obligations.

5. Means to limit the use or disclosure of your data

You may request at any time the limitation of the use or disclosure of your personal data by sending an email to contacto@cirusdev.com with the subject line: "Limitation of use of personal data", clearly stating your name, registered email and the specific request.

6. ARCO rights and revocation of consent

You have the right to Access, Rectify, Cancel or Oppose the processing of your personal data (ARCO rights), as well as to revoke the consent you have granted us, in the cases and under the conditions provided by applicable law.

To exercise these rights, you must send a request to contacto@cirusdev.com with the subject line: "ARCO rights / Revocation", including at least:

• Name or means of identification of the data subject,
• Registered email address,
• A clear description of the data with respect to which the right is sought to be exercised,
• The right you wish to exercise,
• Documents or information reasonably necessary to prove identity or representation, where applicable.

The request will be handled within the applicable legal timeframes.

7. Data retention

Personal data will be retained only for as long as necessary to fulfill the purposes described in this notice, comply with legal requirements, resolve disputes, exercise defenses and meet security, traceability and audit obligations.

For images uploaded by the user, the specific behavior of the live demo is as follows:

• The uploaded original file is validated and normalized into an internal PNG without metadata; the original is deleted immediately after normalization and is not automatically backed up to external storage.
• DICOM files containing identifiable patient metadata (name, ID, date of birth, institution, referring physician, among others) are rejected; no automatic anonymization is performed.
• Files derived from the analysis (normalized PNG, image with the model's detections) are kept in private, non-public storage, with a default retention of 24 hours, configurable by the operator, after which a cleanup process may remove them.
• The analysis history (metadata: date, sanitized file name, status, technical findings) is associated only with the email address the user logged in with.

Once the purpose of the processing has been fulfilled, the data may be blocked and subsequently deleted, anonymized or dissociated, as appropriate.

8. Security measures

The data controller adopts and seeks to maintain reasonable administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction or unauthorized use, access or processing.

These measures may include, as applicable:

• Access controls,
• Authentication,
• Environment segregation,
• Event logging,
• Session protection,
• Encryption in transit,
• Restricted custody of files and results,
• Least-privilege policies, and
• Operational security reviews.

9. Cookies, tracking technologies and technical logs

The site may use technical cookies, session identifiers and server logs necessary for the operation of the service, authentication, security, abuse prevention and the correct operation of the demo.

10. Minors

The live demo is not directed at minors. If we detect that personal data of minors has been provided to us without the involvement of a person holding parental authority or guardianship, we may cancel or delete such information.

11. Changes to this privacy notice

Any changes to this privacy notice will be announced through:

• https://mastolensai.cirusdev.com/en/privacy, and/or
• Email, where appropriate.

12. Contact

For any questions regarding this notice or the processing of your personal data, you can write to:
Controller: CirusDev
Privacy email: contacto@cirusdev.com
Website: https://cirusdev.com/