Privacy Policy

1. Who we are and what this Policy covers

This Policy explains what personal data the RadVoice service (https://radvoice.com.ua) processes, for what purposes, on what legal basis, with whom it is shared, how long it is kept and what rights you have. It forms an integral part of the Public Offer Agreement (https://radvoice.com.ua/en/terms).

Data controller: individual entrepreneur Oleksandr Viktorovych Berezovskyi, taxpayer ID 3114619894, Ukraine (“we”, “RadVoice”). E-mail for data-protection matters: berezovskiy.a@gmail.com.

Person responsible for personal-data protection (Article 24 of the Law of Ukraine “On Personal Data Protection”): Oleksandr Berezovskyi in person. No separate GDPR Data Protection Officer has been appointed, as processing is not large-scale within the meaning of Article 37 GDPR.

The Policy addresses two audiences: physicians and other users who create an account (Sections 3–13), and patients whose data may appear in reports (Section 14).

2. Two roles: your data and patient data

For your account data and usage data we are the data controller and determine the purposes and means of processing ourselves.

For the clinical content of your reports, transcripts and dictations, which may contain patient data, the controller is you or the healthcare facility on whose behalf you work. We act as a processor: we handle such data only on your instructions, only to run the service, and never for our own purposes. Our processor obligations are set out in Section 10 of the Public Offer Agreement.

We do not require or recommend entering direct patient identifiers. The service works fully with de-identified reports.

3. What data we collect

Account data: e-mail address; name (optional); password hash (we never store the password itself); with Google sign-in — your Google ID and the e-mail and name from your Google profile (we do not receive your photo or other profile fields); e-mail verification status; two-factor authentication secret if enabled; creation, last sign-in and last activity dates.

Working data (clinical content): report texts including every template section you filled in; cleaned and verbatim dictation transcripts; report version history; assistant chat messages; plain-language patient explanations; your custom templates; workspace settings. If you filled in or dictated the template fields “patient name”, “date of birth” or “identifier”, that data is stored on the server as part of the report.

Audio: by default dictation audio is sent for transcription, processed in memory and not stored on our server or your device once the text is returned. The only exception is the voluntary recognition-improvement programme (Section 6).

Usage data: number of reports created, finalized and copied, dictation minutes (for plan quotas), template used, dictation duration, current plan. These records contain no report text.

Payment data: invoice ID and status at the payment service, amount, date, plan name, fiscal receipt number, and a saved-card token if you opted into automatic renewal. We never receive or store the full card number, CVV or expiry date.

Technical data: IP address and request headers appear in short-lived server logs (Section 9) and are used for rate limiting and abuse protection; when you submit feedback we store the page URL and browser user-agent string. We do not store IP addresses in your profile or keep a sign-in history by IP.

Feedback: message text, category and your e-mail address.

Data in your browser: drafts, last template, interface settings and up to five recent report-recipient addresses are stored locally in your browser (Section 11).

We do not collect data from other sources and do not use web analytics, advertising identifiers, social-media pixels or session-recording tools.

4. Purposes and legal bases

Providing the service: account creation, authentication, speech recognition, structuring and storing reports, cross-device sync, sending reports by e-mail at your command. Basis — conclusion and performance of the contract with you (Article 11(1)(5) of the Law of Ukraine “On Personal Data Protection”; Article 6(1)(b) GDPR). For patient data — your instruction as controller (Section 2).

Quotas and payments: plan-limit accounting, invoicing, payment confirmation, fiscalisation, refunds. Basis — performance of the contract and our legal obligations (tax and settlement-operations law).

Security: protection against unauthorised access, abuse and fraud; logging of administrative actions; password breach checks. Basis — our legitimate interest in the security of the service and its users (Article 11(1)(6) of the Law; Article 6(1)(f) GDPR).

Communication: service e-mails (verification, password reset, changes to terms, charge notifications), replies to requests. Basis — performance of the contract. We send no marketing e-mails; if we ever do, we will ask for separate consent.

Improving Ukrainian medical speech recognition: storing audio and verbatim transcripts. Basis — solely your separate explicit consent, which you may withdraw (Section 6).

Cross-border transfer to sub-processors outside Ukraine: your unambiguous consent given when accepting the Agreement, and the necessity of the transfer to perform the contract with you (Article 29(3)(1) and (2) of the Law).

5. Artificial intelligence and de-identification

Speech recognition is performed by an external speech-to-text model. Together with the audio it receives a prompt containing the template’s specialised terminology and your dictionary to improve accuracy. Audio containing dictated patient identifiers cannot be de-identified — which is why we ask you not to dictate them.

Structuring text into a report, transcript clean-up, impression drafting, safety checks and the chat assistant are performed by large language models via the OpenRouter gateway (Google Gemini, OpenAI and other models selectable in settings). For the core operations — template fill, transcript clean-up, Safety Gate and RadGuard checks — dates and fragments labelled as patient name or date of birth are automatically removed before the text is sent; the chat assistant never receives the “Patient data” section or the verbatim transcript. For certain auxiliary operations (impression drafting, patient explanation, voice-editing a single field, the template wizard) text is sent without that filter, so do not include patient identifiers in it.

We do not train our own models on your reports. Under our sub-processors’ contractual terms, data sent through their APIs is not used to train their models.

No decision about a patient is made automatically: the service only prepares a draft that the physician reviews and approves personally.

6. Voluntary recognition-improvement programme (dictation retention)

After your first sign-in we ask once whether we may retain your dictations. The option is off by default and is enabled only by your explicit action. The current consent text is dated 2 August 2026; we record the date of your decision and the consent version.

If you agreed, for each dictation we store: the audio file in protected object storage, the verbatim recognised text before auto-correction, the final field text after your edits, duration, language, recognition model, template name, modality and field name. The sole purpose is improving Ukrainian medical speech recognition. These records are not shared with outside organisations other than the storage provider and are never used for advertising or profiling.

You may withdraw consent at any time by e-mail to berezovskiy.a@gmail.com (an in-app toggle is in development). After withdrawal no new recordings are kept, and previously stored audio and transcripts are deleted within 30 days of your request, confirmed by e-mail.

Do not dictate patient names, dates of birth or other patient data. We remove them from text automatically where technically possible; from audio we cannot.

7. Who receives the data (sub-processors)

We do not sell personal data or share it for advertising. Data is received only by providers without which the service cannot run, and only to the extent needed for their function. Each is bound by a data-processing agreement or terms that prohibit use of the data for their own purposes. Current list:

• Railway Corp. (USA): hosting of the application server and primary PostgreSQL database, region us-west2 (USA). Receives all data in Section 3 except audio.
• Vercel Inc. (USA): hosting of the web interface. Receives technical request data for the site.
• OpenAI, L.L.C. (USA): speech recognition. Receives the dictation audio, a terminology prompt and the language code. We do not retain the audio after the text is returned.
• OpenRouter, Inc. (USA) and model providers routed through it (Google LLC, OpenAI, Anthropic PBC and others, depending on the selected model): text structuring, transcript clean-up, impressions, checks, chat. Receive transcript and report text after the de-identification described in Section 5.
• ElevenLabs Inc. (USA): alternative speech-recognition engine; used only when enabled by the service administrator. Receives dictation audio.
• Cloudflare, Inc. (USA, global network): R2 object storage for audio from recognition-improvement programme participants (Section 6). Receives audio files only, and only with your consent.
• Resend, Inc. (USA): e-mail delivery — verification, password reset, reports you choose to send by e-mail (it then receives the report text and recipient address), service notices.
• Google LLC (USA): sign-in with Google, if you choose it. Learns that you signed in to RadVoice; we receive your ID, e-mail and name.
• JSC Universal Bank, plata by mono payment service (Ukraine): payment acceptance, fiscalisation, refunds. Receives amount, plan name, invoice ID and an internal user identifier; not your e-mail or report content.
• Functional Software, Inc. (Sentry, USA): server and front-end error monitoring. Personal identifiers, cookies, request bodies and fields resembling patient data are stripped before sending; session replay is disabled.
• Telegram Messenger Inc. (UAE/UK): operational alerts to the service administrator about new sign-ups (e-mail, name, plan), submitted feedback (e-mail, category, first 120 characters) and report finalize/copy events (e-mail, template name, duration). Report text is never sent to Telegram.
• Have I Been Pwned (Superlative Enterprises Pty Ltd, Australia): on sign-up and password change the first 5 characters of the SHA-1 hash of your password are sent to check for known breaches. Neither the password nor its full hash is transmitted.

Data may also be disclosed to public authorities upon a lawful request under Ukrainian law, or to defend our rights in court. We notify you of such requests unless prohibited by law.

We announce the replacement or addition of a sub-processor handling clinical content in an updated version of this Policy and by e-mail at least 10 days in advance.

8. Cross-border transfers and storage location

The primary service database, including report texts, is hosted on servers in the United States of America (Section 7). Speech recognition, language models and e-mail delivery also operate in the USA. Your personal data and any patient data in your reports are therefore transferred outside Ukraine to a country not on the list of states with adequate protection under Article 29 of the Law of Ukraine “On Personal Data Protection”.

The basis for the transfer is your unambiguous consent given when accepting the Public Offer Agreement and the necessity of the transfer to perform the contract with you. For patient data, you as controller instruct us to make the transfer by accepting the Agreement; you remain free not to enter identifying patient data into the service.

For users in the European Economic Area, transfers to the USA rely on the European Commission’s Standard Contractual Clauses included in our providers’ agreements and/or their certification under the EU-U.S. Data Privacy Framework.

We are considering moving the primary database to the European Union and will announce any such move by updating this Policy.

9. Retention periods

• Account data: until you request deletion, or after more than 24 months of inactivity on the free plan (with 30 days’ notice).
• Reports, transcripts, version history, chat: until you delete them in the interface (a deleted report moves to the trash and is permanently erased within 30 days) or until account deletion. We impose no forced retention limit on your reports; you decide how long they are needed under medical-records requirements.
• Audio by default: not stored. Audio from recognition-improvement participants: until consent is withdrawn or deletion is requested (Section 6).
• Sign-in sessions: up to 30 days without activity; expired sessions are purged daily.
• Server logs (IP addresses, technical request data): about 7 days at the hosting provider.
• Administrative audit log and usage events (no report text): 3 years for security and accounting.
• Feedback: until resolved, no longer than 2 years.
• Payment records (invoices, fiscal receipts, payment confirmations): at least 3 years from the transaction date under Article 44 of the Tax Code of Ukraine, or longer where required by law.
• Database backups: automatic daily backups are kept for 7 days and then overwritten; data deleted from the primary database disappears from backups within that period.
• Data in your browser: until you click “Sign out” (working data is cleared) or clear the site data manually (Section 11).

10. Security

All connections to the service are protected by TLS (HTTPS); HSTS is enabled for the domain.

Passwords are stored only as Argon2id hashes and cannot be recovered; at sign-up the password is checked against known breaches. Two-factor authentication (TOTP) is available and mandatory for administrative actions.

Sign-in uses short-lived tokens (15 minutes) with refresh-token rotation; signing out ends all of the user’s sessions and clears local browser data.

Server access is protected by request-origin checks, rate limiting, a strict Content Security Policy and a ban on embedding the site in other pages.

The database and file storage are encrypted at the disk level by the hosting providers. Application-level encryption of individual report fields is not currently applied; we do not claim it and are working towards it.

Administrator actions are logged. Administrator access to report text is possible only for technical support at your request or for security-incident investigation.

No system is absolutely secure. We cannot guarantee that unauthorised access is impossible, but we undertake to respond to incidents promptly (Section 13).

11. Cookies and browser storage

The service uses only two strictly necessary sign-in cookies: “sid” (access token, 15 minutes) and “rid” (session refresh token, up to 30 days). Both are httpOnly and secure, inaccessible to page scripts and not used for tracking. As there are no other cookies, no cookie-consent banner is shown.

The web app stores in your browser’s local storage (localStorage and IndexedDB) report drafts, transcripts, the selected template, section layout, interface language and theme, and up to five recent report-recipient addresses. This data does not leave your device and prevents draft loss. When you click “Sign out” or another user signs in, working data (drafts, transcripts, templates) is cleared automatically; interface settings and recent recipients persist until you clear site data in your browser settings.

On a shared computer, always click “Sign out” when you finish.

12. Your rights

Under Article 8 of the Law of Ukraine “On Personal Data Protection” (and Articles 15–22 GDPR for EU residents) you have the right to: know about the processing of your data; access it and obtain a copy; have inaccurate data corrected; have it erased (subject to statutory retention); restrict processing; object to processing based on legitimate interest; withdraw consent (without affecting prior lawful processing); receive your data in a machine-readable format; not be subject to automated decisions; lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (https://ombudsman.gov.ua) or an EU supervisory authority, and with a court.

You can change your name and password in the service settings and delete reports yourself in the archive. For other requests (access, copy, export, account deletion, withdrawal of dictation-retention consent) e-mail berezovskiy.a@gmail.com from your account address. We reply within 30 calendar days; account deletion is completed within 30 days of the request and confirmed by e-mail. A self-service account-deletion button is in development.

To protect your data we may ask you to verify your identity (for example by replying from the account e-mail or signing in).

13. Data-breach notification

In the event of an incident resulting in unauthorised access to, loss or disclosure of personal data, we notify affected users by e-mail without undue delay and no later than 72 hours after discovery, describing the nature of the incident, likely consequences and measures taken. If the incident concerns patient data in your reports, we provide you with the information you need to notify patients and authorities as the law requires of you as controller.

Report a suspected vulnerability or incident to berezovskiy.a@gmail.com with the subject “Security”.

14. Information for patients

If your physician uses RadVoice, the text of your medical report may have been prepared with this service. The controller of your data is your physician or medical facility; RadVoice processes data only on their instructions and makes no decisions about your health — the report is prepared and signed by the physician.

We are unable to identify you in reports and do not match reports against other sources. To exercise your rights (access, correction, erasure) please contact your physician or medical facility; we give them all necessary technical assistance. If you do not know whom to contact, e-mail berezovskiy.a@gmail.com and we will help route your request.

15. Children

The service is intended for medical professionals aged 18 and over. We do not knowingly create accounts for persons under 18; any such account found will be deleted. Data of child patients may be processed within a physician’s reports on bases for which the physician is responsible.

16. Changes to this Policy

The current version is published at https://radvoice.com.ua/en/privacy with its version number and date. We announce material changes (new data categories, new sub-processors for clinical content, change of storage location, changed retention) by e-mail or in-app notice at least 10 days before they take effect. Previous versions are available on request.

17. Contact

Individual entrepreneur Oleksandr Viktorovych Berezovskyi, taxpayer ID 3114619894, Ukraine.

E-mail for all personal-data matters: berezovskiy.a@gmail.com.

Website: https://radvoice.com.ua. Public Offer Agreement: https://radvoice.com.ua/en/terms.