OpenMyScan

Privacy Policy — No uploads, no ad tracking, no account

Last updated: August 3, 2026

1. Data Controller

The data controller responsible for the processing of personal data on this website, within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection laws, is:

Gabriel Theis
Marquise Square Tower, 2214
Marasi Drive, Business Bay
Dubai, United Arab Emirates
Phone: +971 58 573 0655
Email: info@openmyscan.com

If you have any questions about how we handle your personal data, or to exercise your rights as a data subject, you can contact us at any time using the contact details above.

2. What data we process

OpenMyScan is built to be privacy-friendly by design. We collect as little data as possible. Below we explain transparently what data is processed and when.

2.1 Anonymous usage statistics

We count page visits so we can see which pages are useful and whether anything is broken. We count visits, not visitors — that distinction is the whole design, and everything below follows from it.

This runs on our own server. There is no Google Analytics, no advertising network, and no third-party tracking company involved.

  • No cookie is set for this.
  • Nothing is written to your browser's storage.
  • No device fingerprint is created.
  • You are never given an ID, so we cannot recognise you on a later visit.

For each page view we record: the page address (anything after a "?" is discarded), the domain you arrived from if any — never the full address, your country as a two-letter code (worked out from your IP address at the moment of the request; the IP itself is discarded immediately and never stored), whether your screen is phone-, tablet- or desktop-sized, how long the page stayed open, and how quickly it loaded.

Within one browser tab, page views share a temporary number so we can measure how long a single visit lasted. That number lives only in the tab's memory, is never stored on your device, disappears when you close the tab, and is erased from our records after 30 days.

Inside the viewer we additionally count that a scan was opened, roughly how many image series it held (as a range such as "6-20", never an exact count), which export button was used, and whether an error occurred. Nothing from the scan files themselves is ever transmitted — no file names, no folder names, no patient details, no image data.

This data is never sold, never shared, and never combined with data from anywhere else. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding how the website is used). You can switch it off entirely — see section 2.6.

2.2 Performance measurement

As part of the same page-view record we measure how fast the page loaded, how much the layout moved while loading, and how quickly it responded to your first interaction (the Core Web Vitals). These are timings only. They contain no personal data, set no cookies, and are collected by the same first-party system described above — no external performance service is used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining and improving site performance).

2.3 Your medical scans

When you use OpenMyScan to open an MRI, CT, or other DICOM scan, those files never leave your device. Processing happens entirely locally in your browser.

  • No upload to our servers takes place.
  • No transmission to third parties takes place.
  • When you close the browser tab, the images are removed from memory.

We do not have technical access to your scans — and we don't want it.

2.4 Server logs

When you visit our website, our hosting provider Vercel automatically creates server logs. These typically contain:

  • the IP address of the requesting device,
  • date and time of access,
  • the URL accessed,
  • the user agent (browser and operating system information),
  • HTTP status codes.

This data is used solely for technical delivery, security, and error analysis, and is automatically deleted by Vercel after a short period (typically within 30 days). No personal evaluation of these logs takes place.

2.5 Cookies

We do not use tracking cookies. We do not use advertising cookies. We do not use third-party cookies.

We set a single, technically necessary cookie called omsc_locale. It only stores your chosen language version (German or English), so that on a return visit you land directly in your preferred language. This cookie contains no personal data and is stored only on your device.

2.6 What the viewer keeps on your device

Apart from the language cookie, the viewer keeps a few things in your browser's own storage so it works properly. All of it stays on your device — none of it is ever sent to us or to anyone else. To be complete, here is everything:

  • A small preview image of each series you open, so the sidebar loads instantly. These are generated from your scan on your own device and are kept until you remove them. This is the one item derived from your medical images, and it survives closing the tab.
  • Any names you give a series, and which series you have hidden from your library.
  • Small technical values: the last version check, the current build number, whether the sidebar is collapsed, and the most recent error message, which help the viewer update itself and recover from a crash.

You can delete all of it at any time. In the viewer, open Settings: "Clear thumbnail cache" removes the preview images, and "Reset library" removes the rest. Clearing your browser's site data for openmyscan.com removes everything at once.

To switch off usage statistics (section 2.1), use the toggle in Settings. We also automatically respect the Global Privacy Control signal and the "Do Not Track" browser setting — if either is enabled, nothing is counted at all.

3. Legal basis

Processing of the data described above is carried out on the following legal bases under the GDPR:

  • Server logs and the language cookie: Art. 6(1)(f) GDPR (legitimate interest in the technical delivery and security of the website).
  • Anonymous usage statistics: Art. 6(1)(f) GDPR (legitimate interest in understanding how the website is used). No information is stored on, or read from, your device for this purpose, so § 25 TDDDG does not apply and no consent is required. As the stored data carries no personal reference, it is strictly speaking outside the scope of the GDPR; we cite a legal basis here for transparency.
  • Data the viewer keeps on your device: strictly necessary to provide the viewer you asked for (§ 25(2) no. 2 TDDDG). It stays on your device and is not processed by us.
  • Processing of your scans: We do not process your scans. They are displayed locally in your browser only.

4. Processors and third parties

We use the following service providers for the technical delivery of the website:

Vercel Inc.
340 S Lemon Ave #4133, Walnut, CA 91789, USA
Service: website hosting
Privacy policy: https://vercel.com/legal/privacy-policy

Cloudflare, Inc.
101 Townsend St, San Francisco, CA 94107, USA
Service: the server that receives our usage statistics, and the database that stores them
Privacy policy: https://www.cloudflare.com/privacypolicy/

We use no analytics, advertising or tracking provider of any kind. A Data Processing Agreement under Art. 28 GDPR is in place with each of the above. Data transfers to the United States are based on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

5. Transfers to third countries

Our hosting provider Vercel and our statistics server provider Cloudflare are both US companies, so server logs and anonymous statistics may be transferred to the US. The US is considered an unsafe third country under the GDPR.

Data transfers are based on the EU Standard Contractual Clauses (SCCs) issued by the European Commission. Both providers have implemented additional technical and organizational measures to ensure an appropriate level of data protection. Note that the usage statistics contain no identifier of any kind, so there is nothing in them that could be traced back to a person.

Your medical scans are never transferred to the US or any other third country — they do not leave your device at all.

6. Retention period

Retention periods depend on the purpose of processing:

  • Usage statistics: deleted after 12 months. The temporary per-tab number described in section 2.1 is erased after 30 days, after which individual page views can no longer be linked to one another at all.
  • Server logs: typically 30 days, then automatically deleted by the hosting provider.
  • Language cookie omsc_locale: up to 12 months, or until you delete the cookie yourself.
  • Data the viewer keeps on your device (section 2.6): kept until you delete it. It is on your device only; we never receive it and cannot delete it for you.
  • Medical scans: never transmitted to us and never stored by us — they do not leave your device.

7. Your rights as a data subject

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR),
  • Right to rectification (Art. 16 GDPR),
  • Right to erasure (Art. 17 GDPR),
  • Right to restriction of processing (Art. 18 GDPR),
  • Right to data portability (Art. 20 GDPR),
  • Right to object to processing (Art. 21 GDPR).

To exercise your rights, an informal email to info@openmyscan.com is sufficient.

8. Right to complain to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. You can contact the supervisory authority of your place of residence or habitual residence.

A list of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

9. Children

OpenMyScan is not directed at children under 16. We do not knowingly collect personal data from children. If you are a parent or guardian and become aware that your child has provided us with personal data, please contact us — we will delete it promptly.

10. Changes to this privacy policy

We reserve the right to update this privacy policy, for example when legal requirements change or new features are introduced. The current version is always available on this page. We will notify you of significant changes in an appropriate manner.

11. Contact

For privacy questions or to exercise your rights, you can reach us at any time:

Email: info@openmyscan.com

We usually respond within a few business days.