OpenMyScan

Privacy Policy — No uploads, no ad tracking, no account

Last updated: October 25, 2026

1. Data Controller

The data controller responsible for the processing of personal data on this website, within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection laws, is:

Gabriel Theis
Marquise Square Tower, 2214
Marasi Drive, Business Bay
Dubai, United Arab Emirates
Phone: +971 58 573 0655
Email: info@openmyscan.com

If you have any questions about how we handle your personal data, or to exercise your rights as a data subject, you can contact us at any time using the contact details above.

2. What data we process

OpenMyScan is built to be privacy-friendly by design. We collect as little data as possible. Below we explain transparently what data is processed and when.

2.1 Optional diagnostics and usage analytics

With your fresh permission, optional technical error reports, fixed usage counts, export outcomes and time measurements help us fix problems and improve useful features. Collection stays off until you allow it, and rejecting it does not restrict the viewer. Global Privacy Control and Do Not Track keep it off. Earlier grants need renewal; refusals remain honored. Your usage choice stays on your device for up to 180 days. Returning-browser analytics requires a separate choice under notice version 9; Accept enables both options, Decline enables neither, and Privacy details lets you choose usage only. Older grants never enable this new scope. You can withdraw it through “Privacy choices” at any time. Legal basis: consent, Art. 6(1)(a) GDPR.

Detailed reports contain fixed categories for container, encoding, color, bit depth, frame count, header, failure phase/reason and recovery, plus release and coarse browser/platform. Unknown or mixed values stay unknown. We count selected feature actions and broad page transitions, export outcomes, import/export durations in whole seconds, and visible, recently active view time with an idle cap. Reports have a server receipt timestamp; a client send-time value solely to check request freshness is not stored in reports. Export success means a browser download started; it does not confirm the file was saved. We send no scan contents, patient details, filenames, study/series identifiers, raw errors, stacks, URLs, paths, queries, referrers, coordinates or file/series counts. These technical reports have no visit, operation or persistent browser identifiers and are not joined to returning-browser records.

Unlinked usage reports sent in the existing version-8 report format may contribute to combined weekly totals after consent; older reports are not backfilled. These totals help us see trends over time and contain no identifiers, filenames, scans or medical or personal details. Detailed reports are kept for 30 days; weekly totals for 12 months from the end of their week.

We operate collection on Cloudflare. Each batch has a separate random deletion receipt held only in page memory and sent in collection/deletion request bodies; it is never reused across batches or reloads. The server stores a one-way hash. Withdrawal of usage permission stops both kinds of collection and requests deletion of matching unlinked detailed reports while their receipts and reports remain available. Failed requests retry while the page stays open. Once a contribution is combined into weekly totals, it cannot be separated or removed. Earlier page loads and backups are not immediately erased; retention limits are below.

Optional returning-browser analytics: with your separate permission, a securely random code stored in this browser connects page opens, broad feature use and eligibility, and import/export starts and outcomes on OpenMyScan. Each page load and import/export attempt has its own random code. No filenames, medical categories, detailed technical errors, file formats or processing durations are attached to this browser code. We do not link it to your name, email or purchases. These records are pseudonymous personal data, not anonymous. They are collected separately from the technical reports above.

The server stores keyed hashes rather than the raw random codes. A separate random deletion key is stored locally and can request deletion across page reloads. Turning returning-browser analytics off stops new linked collection and requests deletion of its linked details and daily return records. Deletion can be pending or fail; the interface reports confirmation only after the server acknowledges it. The deletion key is kept for retries until confirmation or expiry. Clearing site data first can remove this key and prevent us from finding those records. We do not recover identity using an IP address or device fingerprint.

The browser code expires after a fixed 90 days without extension by visits; a new affirmative choice is required to start again. Linked activity details are kept for up to 30 days, and minimal daily return records (date and whether successful use was observed) for the browser code’s remaining lifetime. These daily records remain deletable and do not enter the unlinked weekly archive.

2.2 Limits of analytics

Unlinked reports and action counts are not counts of people or complete visits. Optional linked analytics measures consenting browser codes and page loads, not named people or accounts. Different browsers, storage clearing, expiry and withdrawal affect counts. Missing outcomes are unknown, not proven failures or abandonment. Return rates use only cohorts with enough observation time. We report later observed success after failure as an association, not proof that the same scan was fixed. Consent and reporting limits mean results are incomplete and do not establish clinical compatibility.

2.3 Your medical scans

When you use OpenMyScan to open an MRI, CT, or other DICOM scan, those files never leave your device. Processing happens entirely locally in your browser.

  • No upload to our servers takes place.
  • No transmission to third parties takes place.
  • When you close the browser tab, the images are removed from memory.

We do not have technical access to your scans. We don't want it either.

2.4 Server logs

When you visit our website, our hosting provider Vercel automatically creates server logs. These typically contain:

  • the IP address of the requesting device,
  • date and time of access,
  • the URL accessed,
  • the user agent (browser and operating system information),
  • HTTP status codes.

This data is used solely for technical delivery, security, and error analysis, and is automatically deleted by Vercel after a short period (typically within 30 days). No personal evaluation of these logs takes place.

2.5 Cookies

We do not use tracking cookies. We do not use advertising cookies. We do not use third-party cookies.

We set a single, technically necessary cookie called omsc_locale. It only stores your chosen language version (German or English), so that on a return visit you land directly in your preferred language. This cookie contains no personal data and is stored only on your device.

2.6 What the viewer keeps on your device

Apart from the language cookie, the viewer keeps necessary settings and library values in your browser so it works properly. These viewer values stay on your device and are not read or transmitted by diagnostics. Your diagnostics choice is stored separately on your device for up to 180 days. Only after returning-browser permission, a random browser code and separate deletion key are stored locally with their fixed expiry. Page and attempt codes and unsent events remain in page memory. Returning permission expires with the browser code. Pending deletion keys survive reloads until confirmation or expiry. A separate random deletion receipt is generated for each report batch after consent; it exists only in page memory, is sent with that batch, and is not reused after reload or for another batch. It can request deletion only of matching reports, not all earlier reports. The viewer stores:

  • A small preview image of each series you open, so the sidebar loads instantly. These are generated from your scan on your own device and are kept until you remove them. This is the one item derived from your medical images, and it survives closing the tab.
  • Any names you give a series, and which series you have hidden from your library.
  • Small technical values: the last version check, the current build number, whether the sidebar is collapsed, and the most recent error message, which help the viewer update itself and recover from a crash.

You can delete all of it at any time. In the viewer, open Settings: “Clear thumbnail cache” removes the preview images, and “Reset library” removes the rest. Clearing your browser's site data for openmyscan.com removes everything at once.

Diagnostics are off until you allow them. Use “Privacy choices” to review or withdraw consent. We also respect Global Privacy Control and Do Not Track; either signal keeps diagnostics off.

3. Legal basis

The processing described here uses these legal bases:

  • Server logs and the language cookie: Art. 6(1)(f) GDPR (legitimate interest in delivering and securing the website).
  • Optional usage and technical diagnostics, and separately optional returning-browser analytics with its browser code and deletion key, including a random per-batch deletion receipt held only in page memory: your consent under Art. 6(1)(a) GDPR and, where applicable, consent under ePrivacy rules for storing or accessing information on your device. Diagnostics remain off until you allow them and can be stopped using “Privacy choices”.
  • The locally stored consent preference is necessary to remember and honour your choice (§25(2)(2) TDDDG); it contains no optional identifier.
  • Viewer data stored on your device is necessary to provide the viewer you requested (§25(2)(2) TDDDG). It remains on your device.
  • Your scan files are processed locally in your browser and are not received by us.

4. Processors and third parties

We use the following service providers for technical delivery:

Vercel Inc.
340 S Lemon Ave #4133, Walnut, CA 91789, USA
Service: website hosting
Privacy policy: https://vercel.com/legal/privacy-policy

Cloudflare, Inc.
101 Townsend St, San Francisco, CA 94107, USA
Service: hosting the first-party technical diagnostics collector and its database
Privacy policy: https://www.cloudflare.com/privacypolicy/

The optional diagnostics are operated by us, with collection hosting and database services from Cloudflare. The controller is based in the United Arab Emirates, and these providers are US companies. Depending on provider configuration and support access, information may be processed or accessed in the United States, the United Arab Emirates or other countries. Provider agreement coverage, service configuration and transfer arrangements remain under assessment; this notice does not assert that a particular agreement or transfer safeguard has been confirmed.

Feedback forms: when you send a message, the optional subject, message, optional reply email and current page context are forwarded to our support inbox using Resend (https://resend.com/security/gdpr). Resend processes this email content, sender and recipient addresses, and technical delivery metadata in the United States. Its Free, Pro and Scale plans retain email and log data for 30 days; Enterprise retention may differ. We do not use open or click tracking for feedback emails. No scan files or metadata are attached. Please do not include medical or patient details in your message.

5. Transfers to third countries

Our controller is based in the United Arab Emirates. Vercel and Cloudflare are US companies. Depending on the providers’ service configuration and support access, information may be processed or accessed in the United States, the United Arab Emirates or other countries. Server logs and optional technical reports may therefore be available outside your country. We are assessing the actual processing locations, access routes, provider terms and applicable transfer safeguards and will update this notice as those arrangements are confirmed. We do not claim that a particular transfer mechanism or additional safeguard is in place until it has been confirmed.

Your medical scan files are processed locally in your browser and are not sent to these providers by the viewer.

6. Retention period

Returning-browser analytics: the server enforces a fixed 90-day identity lifetime. Linked page and event details expire no later than 30 days after creation or the identity expiry, whichever comes first. Minimal daily return records expire with the identity. Withdrawing this purpose requests deletion of all its linked records. Keyed deletion tombstones remain for at least 91 days to prevent delayed requests from recreating erased records; they are not used for analytics. Cleanup is scheduled daily and reports exclude expired records. No linked records are merged into irreversible weekly totals.

Detailed reports are scheduled for daily deletion once older than 30 days; cleanup may run after that threshold. Combined weekly totals expire 12 months from the end of their week. Only consented unlinked reports in the existing version-8 format contribute; no older reports are backfilled. Totals contain no identifiers, filenames, scans or medical or personal details, and individual contributions cannot be separated or removed after combination.

For unlinked reports, withdrawal uses deletion receipts still held only in the current page’s memory to request deletion of matching detailed reports while available. Failed requests retry while the page stays open. Earlier page loads cannot be located this way. Separate pre-version-3 records keep their existing limits: up to 30 days for legacy linkages and the prior 365-day threshold for other historical records. New receipts cannot delete them.

Live deletion does not immediately erase backups. Cloudflare D1 Time Travel may retain backups for 7 days on Free or 30 days on Paid plans. After restoration, deletions must be reapplied before analytics access. Your consent preference stays on your device for up to 180 days. Server logs, feedback and viewer data follow the provider or device settings described above. We do not receive or store your medical scan files.

7. Your rights as a data subject

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR),
  • Right to rectification (Art. 16 GDPR),
  • Right to erasure (Art. 17 GDPR),
  • Right to restriction of processing (Art. 18 GDPR),
  • Right to data portability (Art. 20 GDPR),
  • Right to object to processing (Art. 21 GDPR).

To exercise your rights, an informal email to info@openmyscan.com is sufficient.

8. Right to complain to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data. You can contact the supervisory authority of your place of residence or habitual residence.

A list of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

9. Children

OpenMyScan is not directed at children under 16. We do not knowingly collect personal data from children. If you are a parent or guardian and become aware that your child has provided us with personal data, please contact us. We will delete it promptly.

10. Changes to this privacy policy

We reserve the right to update this privacy policy, for example when legal requirements change or new features are introduced. The current version is always available on this page. We will notify you of significant changes in an appropriate manner.

11. Contact

For privacy questions or to exercise your rights, you can reach us at any time:

Email: info@openmyscan.com

We usually respond within a few business days.